fixup!

fix: change button label on wallet
2025-11-26 14:26:16 +01:00 · 2025-11-26 14:25:21 +01:00
410 changed files with 40022 additions and 66652 deletions
@@ -23,10 +23,3 @@ mypy.ini
 package-lock.json
 package.json
 pytest.ini
-
-.mypy_cache
-.github
-.pytest_cache
-.vscode
-bin
-dist
@@ -6,21 +6,11 @@
 # The following settings are ONLY set in your .env file.
 # They are NOT managed by the Admin UI and are not stored in the database.

-# === First Install Token ===
-# If set the user is required to enter this token on the /first_install page
-# FIRST_INSTALL_TOKEN="myaccesstoken"
-
-# === Security ===
-# When enabled (recommended), auth cookies require HTTPS and SSO will reject insecure HTTP.
-AUTH_HTTPS_ONLY=true
-
 # === Logging and Development ===

 DEBUG=False
 DEBUG_DATABASE=False
 BUNDLE_ASSETS=True
-# add `?profiler=true` to the url to enable the profiler for that request
-PROFILER=False

 # logging into LNBITS_DATA_FOLDER/logs/
 ENABLE_LOG_TO_FILE=true
@@ -28,12 +18,9 @@ ENABLE_LOG_TO_FILE=true
 # https://loguru.readthedocs.io/en/stable/api/logger.html#file
 LOG_ROTATION="100 MB"
 LOG_RETENTION="3 months"
+    
 # for database cleanup commands
 # CLEANUP_WALLETS_DAYS=90
-# Hard limit for total created users. Set to 0 to disable the limit.
-# LNBITS_MAX_USERS=0
-# Hard limit for total installed extensions. Set to 0 to disable the limit.
-# LNBITS_MAX_EXTENSIONS=0

 # === Admin Settings ===

@@ -69,7 +56,7 @@ LNBITS_EXTENSIONS_DEFAULT_INSTALL="tpos"
 # LNBITS_EXT_GITHUB_TOKEN=github_pat_xxxxxxxxxxxxxxxxxx

 # which fundingsources are allowed in the admin ui
-# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet, StrikeWallet, CLNRestWallet, SparkWallet, SparkL2Wallet"
+# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet, StrikeWallet, CLNRestWallet"

 # uvicorn variable, allow https behind a proxy
 # IMPORTANT: this also needs the webserver to be configured to forward the headers
@@ -104,7 +91,7 @@ AUTH_SECRET_KEY=""
 ######################################

 AUTH_TOKEN_EXPIRE_MINUTES=525600
-# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth, oidc-auth
+# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth
 AUTH_ALLOWED_METHODS="user-id-only, username-password"
 # Set this flag if HTTP is used for OAuth
 # OAUTHLIB_INSECURE_TRANSPORT="1"
@@ -119,8 +106,6 @@ LNBITS_SITE_TAGLINE="Open Source Lightning Payments Platform"
 LNBITS_SITE_DESCRIPTION="The world's most powerful suite of bitcoin tools. Run for yourself, for others, or as part of a stack."
 # Choose from bitcoin, mint, flamingo, freedom, salvador, autumn, monochrome, classic, cyber
 LNBITS_THEME_OPTIONS="classic, bitcoin, flamingo, freedom, mint, autumn, monochrome, salvador, cyber"
-# Toggle the background styling on burger menus / drawers
-# LNBITS_DEFAULT_BURGER_MENU_BACKGROUND=true
 # LNBITS_CUSTOM_LOGO="https://lnbits.com/assets/images/logo/logo.svg"

 ######################################
@@ -202,15 +187,7 @@ BOLTZ_CLIENT_ENDPOINT=127.0.0.1:9002
 BOLTZ_CLIENT_MACAROON="/home/bob/.boltz/macaroons/admin.macaroon"
 # HEXSTRING instead of path also possible
 BOLTZ_CLIENT_CERT="/home/bob/.boltz/tls.cert"
-
-# SparkL2Wallet (external sidecar: https://github.com/lnbits/spark_sidecar)
-SPARK_L2_NETWORK=MAINNET
-SPARK_L2_EXTERNAL_ENDPOINT=http://127.0.0.1:8765
-SPARK_L2_EXTERNAL_API_KEY=
-# optional tuning
-# SPARK_L2_PAY_WAIT_MS=4000
-# SPARK_L2_PAY_POLL_MS=500
-# SPARK_L2_STREAM_KEEPALIVE_MS=15000
+BOLTZ_CLIENT_WALLET="lnbits"

 # StrikeWallet
 STRIKE_API_ENDPOINT=https://api.strike.me/v1
@@ -283,50 +260,6 @@ KEYCLOAK_DISCOVERY_URL=""
 KEYCLOAK_CLIENT_CUSTOM_ORG=""
 KEYCLOAK_CLIENT_CUSTOM_ICON=""

-# OIDC OAuth Config
-# Generic OIDC provider configuration
-# Make sure that the redirect URI in your OIDC provider is set to: https://{domain}/api/v1/auth/oidc/token
-# Required scopes: openid, email, profile
-# The discovery URL must be accessible from your LNbits server
-# Always use HTTPS in production environments
-# The CUSTOM_ORG and CUSTOM_ICON settings allow you to customize the login button
-# For example: "Login via Zitadel" with the Zitadel logo
-OIDC_DISCOVERY_URL=""
-OIDC_CLIENT_ID=""
-OIDC_CLIENT_SECRET=""
-OIDC_CLIENT_CUSTOM_ORG=""
-OIDC_CLIENT_CUSTOM_ICON=""
-
-# Example OIDC configurations for various providers:
-#
-# ZITADEL:
-# OIDC_DISCOVERY_URL=https://login.yourdomain.de/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-zitadel-client-id@project-id
-# OIDC_CLIENT_SECRET=your-zitadel-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Zitadel
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/zitadel.png
-#
-# AUTHENTIK:
-# OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/lnbits/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-authentik-client-id
-# OIDC_CLIENT_SECRET=your-authentik-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Authentik
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/authentik.png
-#
-# AUTHELIA:
-# OIDC_DISCOVERY_URL=https://auth.yourdomain.com/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-authelia-client-id
-# OIDC_CLIENT_SECRET=your-authelia-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Authelia
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/authelia.png
-#
-# OKTA:
-# OIDC_DISCOVERY_URL=https://your-domain.okta.com/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-okta-client-id
-# OIDC_CLIENT_SECRET=your-okta-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Okta
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/okta.png
-

 ######################################

@@ -382,12 +315,10 @@ LNBITS_SERVICE_FEE=0.0
 # disable fees for internal transactions
 # LNBITS_SERVICE_FEE_IGNORE_INTERNAL=true

-# The minimum fee reserved per payment (millisats)
+# value in millisats
 LNBITS_RESERVE_FEE_MIN=2000
-# The percentage of the payment amount to reserve for routing fees (percent)
+# value in percent
 LNBITS_RESERVE_FEE_PERCENT=1.0
-# The default time to wait to for status response from the funding source when paying an invoice
-LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS=5

 # limit the maximum balance for each wallet
 # throw an error if the wallet attempts to create a new invoice
@@ -402,3 +333,4 @@ LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS=5
 ######################################
 ###### Logging and Development #######
 ######################################
+
@@ -7,6 +7,10 @@ on:
        description: 'The tag name for the release'
        required: true
        type: string
+      upload_url:
+        description: 'The upload URL for the release'
+        required: true
+        type: string

  workflow_dispatch:
    inputs:
@@ -14,6 +18,10 @@ on:
        description: 'The tag name for the release'
        required: true
        type: string
+      upload_url:
+        description: 'The upload URL for the release'
+        required: true
+        type: string

 jobs:
  build-linux-package:
@@ -61,10 +69,7 @@ jobs:
            --onefile \
            --name lnbits \
            --hidden-import=embit \
-            --hidden-import=bitstring.bitstore_bitarray \
            --collect-all embit \
-            --collect-all bitstring \
-            --collect-all bitarray \
            --collect-all lnbits \
            --collect-all sqlalchemy \
            --collect-all breez_sdk \
@@ -105,6 +110,11 @@ jobs:
        shell: bash

      - name: Upload Linux Release Asset
+        uses: actions/upload-release-asset@v1
+        with:
+          upload_url: ${{ inputs.upload_url }}
+          asset_path: ${{ env.APPIMAGE_NAME }}
+          asset_name: ${{ env.APPIMAGE_NAME }}
+          asset_content_type: application/octet-stream
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload "${{ inputs.tag_name }}" "${{ env.APPIMAGE_NAME }}" --clobber
@@ -1,33 +0,0 @@
-name: bundle
-on:
-  workflow_call:
-
-jobs:
-  bundle:
-    permissions:
-      contents: write
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || github.event.pull_request.head.sha }}
-      - uses: lnbits/lnbits/.github/actions/prepare@dev
-        with:
-          python-version: "3.10"
-          node-version: "24.x"
-          npm: true
-      - name: Build and commit bundle (same-repo PR)
-        if: github.event.pull_request.head.repo.full_name == github.repository
-        run: |
-          make bundle
-          git config user.name "alan"
-          git config user.email "alan@lnbits.com"
-          git add lnbits/static
-          if git diff --cached --quiet; then
-            exit 0
-          fi
-          git commit -m "chore: make bundle [skip ci]"
-          git push
-      - name: Check bundle is up-to-date (fork PR)
-        if: github.event.pull_request.head.repo.full_name != github.repository
-        run: make checkbundle
@@ -1,9 +1,14 @@
 name: LNbits CI
 on:
+  push:
+    branches:
+      - main
+      - dev
  pull_request:


 jobs:
+
  lint:
    uses: ./.github/workflows/lint.yml

@@ -11,7 +16,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -25,7 +30,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -39,7 +44,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -53,7 +58,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
    uses: ./.github/workflows/migration.yml
    with:
      python-version: ${{ matrix.python-version }}
@@ -69,15 +74,8 @@ jobs:
    uses: ./.github/workflows/regtest.yml
    strategy:
      matrix:
-        python-version: ["3.12"]
-        backend-wallet-class:
-          - BoltzWallet
-          - LndRestWallet
-          - LndWallet
-          - CoreLightningWallet
-          - CoreLightningRestWallet
-          - LNbitsWallet
-          - EclairWallet
+        python-version: ["3.10"]
+        backend-wallet-class: ["LndRestWallet", "LndWallet", "CoreLightningWallet", "CoreLightningRestWallet", "LNbitsWallet", "EclairWallet"]
    with:
      custom-pytest: "uv run pytest tests/regtest"
      python-version: ${{ matrix.python-version }}
@@ -85,15 +83,11 @@ jobs:
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

-  integration:
+  jmeter:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.12"]
-    uses: ./.github/workflows/integration.yml
+        python-version: ["3.10"]
+    uses: ./.github/workflows/jmeter.yml
    with:
      python-version: ${{ matrix.python-version }}
-
-  bundle:
-    needs: [ lint, test-api, test-wallets, test-unit, migration, openapi, regtest, integration ]
-    uses: ./.github/workflows/bundle.yml
@@ -55,21 +55,10 @@ jobs:
      - name: Build and push boltz
        uses: docker/build-push-action@v5
        with:
-            context: docker/boltzclient
+            context: .
+            file: Dockerfile.boltz
            push: true
            tags: ${{ secrets.DOCKER_USERNAME }}/lnbits-boltz:${{ inputs.tag }}
            platforms: linux/amd64,linux/arm64
            cache-from: type=local,src=/tmp/.buildx-cache
            cache-to: type=local,dest=/tmp/.buildx-cache
-            build-args: LNBITS_TAG=${{ inputs.tag }}
-
-      - name: Build and push sparkl2
-        uses: docker/build-push-action@v5
-        with:
-            context: docker/sparkl2
-            push: true
-            tags: ${{ secrets.DOCKER_USERNAME }}/lnbits-sparkl2:${{ inputs.tag }}
-            platforms: linux/amd64,linux/arm64
-            cache-from: type=local,src=/tmp/.buildx-cache
-            cache-to: type=local,dest=/tmp/.buildx-cache
-            build-args: LNBITS_TAG=${{ inputs.tag }}
@@ -1,45 +0,0 @@
-name: Extension Integration Tests
-
-on:
-  workflow_call:
-    inputs:
-      python-version:
-        description: "Python Version"
-        required: true
-        default: "3.10"
-        type: string
-
-jobs:
-  integration:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: ./.github/actions/prepare
-        with:
-          python-version: ${{ inputs.python-version }}
-          npm: "true"
-
-      - name: run Playwright integration tests
-        env:
-          EXTENSIONS_MANIFEST_URL: "https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json"
-          LNBITS_EXTENSIONS_DEFAULT_INSTALL: "watchonly,satspay,tipjar,tpos,lnurlp,withdraw"
-          LNBITS_BACKEND_WALLET_CLASS: FakeWallet
-          AUTH_HTTPS_ONLY: false
-        run: npm run test:integration
-
-      - name: print lnbits log
-        if: ${{ always() }}
-        run: |
-          sleep 1
-          cat tests/data/integration/logs/debug.log || true
-
-      - name: upload integration test results
-        uses: actions/upload-artifact@v4
-        if: ${{ always() }}
-        with:
-          name: extension-integration-test-results
-          path: |
-            playwright-report/integration/
-            test-results/
-            tests/data/integration/logs/
@@ -0,0 +1,64 @@
+name: JMeter Extension Tests
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        description: "Python Version"
+        required: true
+        default: "3.10"
+        type: string
+
+jobs:
+  jmeter:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/prepare
+        with:
+          python-version: ${{ inputs.python-version }}
+
+      - name: run LNbits
+        env:
+          LNBITS_ADMIN_UI: true
+          LNBITS_EXTENSIONS_DEFAULT_INSTALL: "watchonly, satspay, tipjar, tpos, lnurlp, withdraw"
+          LNBITS_BACKEND_WALLET_CLASS: FakeWallet
+        run: |
+          uv run lnbits &
+          sleep 10
+
+      - name: setup java version
+        run: |
+          update-java-alternatives --list
+          sudo update-java-alternatives --set /usr/lib/jvm/temurin-8-jdk-amd64
+          java -version
+
+      - name: clone lnbits-extensions, install jmeter and run tests
+        env:
+          JAVA_HOME: /usr/lib/jvm/temurin-8-jdk-amd64
+          EXTENSIONS_MANIFEST_PATH: "/lnbits/lnbits-extensions/refs/heads/main/extensions.json"
+        run: |
+          git clone https://github.com/lnbits/lnbits-extensions
+          cd lnbits-extensions
+          mkdir logs
+          mkdir reports
+          make install-jmeter
+          make start-mirror-server
+          make test
+
+      - name: print lnbits log
+        if: ${{ always() }}
+        run: |
+          # catch up time for lnbits
+          sleep 1
+          cat data/logs/debug.log
+
+      - name: upload jmeter test results
+        uses: actions/upload-artifact@v4
+        if: ${{ always() }}
+        with:
+          name: jmeter-extension-test-results
+          path: |
+            lnbits-extensions/reports/
+            lnbits-extensions/logs/
@@ -6,30 +6,53 @@ jobs:

  black:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkblack
+      python-version: ${{ matrix.python-version }}

  ruff:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkruff
+      python-version: ${{ matrix.python-version }}

  mypy:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: mypy
+      python-version: ${{ matrix.python-version }}

  pyright:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: pyright
+      python-version: ${{ matrix.python-version }}
      npm: true

+
  prettier:
    uses: ./.github/workflows/make.yml
    with:
      make: checkprettier
      npm: true

+  bundle:
+    uses: ./.github/workflows/make.yml
+    with:
+      make: checkbundle
+      npm: true
+
  poetry:
    uses: ./.github/workflows/poetry.yml
@@ -14,7 +14,7 @@ on:
      python-version:
        description: "python version"
        type: string
-        default: "3.12"
+        default: "3.10"

 jobs:
  make:
@@ -22,7 +22,7 @@ jobs:
    strategy:
      matrix:
        os-version: ["ubuntu-24.04"]
-        node-version: ["24.x"]
+        node-version: ["18.x"]
    runs-on: ${{ matrix.os-version }}
    steps:
      - uses: actions/checkout@v4
@@ -8,7 +8,7 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.12"
+        default: "3.10"
        type: string
      os-version:
        default: "ubuntu-24.04"
@@ -38,9 +38,10 @@ jobs:

      - name: Setup Regtest
        run: |
-          cd docker/regtest
-          chmod +x ./start-regtest
-          ./start-regtest
+          git clone https://github.com/lnbits/legend-regtest-enviroment.git docker
+          cd docker
+          chmod +x ./tests
+          ./tests
          sudo chmod -R a+rwx .

      - name: Run pytest
@@ -49,24 +50,21 @@ jobs:
          LNBITS_DATABASE_URL: ${{ inputs.db-url }}
          LNBITS_BACKEND_WALLET_CLASS: ${{ inputs.backend-wallet-class }}
          LND_REST_ENDPOINT: https://localhost:8081/
-          LND_REST_CERT: ./docker/regtest/data/lnd-3/tls.cert
-          LND_REST_MACAROON: ./docker/regtest/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
+          LND_REST_CERT: ./docker/data/lnd-3/tls.cert
+          LND_REST_MACAROON: ./docker/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
          LND_GRPC_ENDPOINT: localhost
          LND_GRPC_PORT: 10009
-          LND_GRPC_CERT: ./docker/regtest/data/lnd-3/tls.cert
-          LND_GRPC_MACAROON: ./docker/regtest/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
-          CORELIGHTNING_RPC: ./docker/regtest/data/clightning-1/regtest/lightning-rpc
+          LND_GRPC_CERT: docker/data/lnd-3/tls.cert
+          LND_GRPC_MACAROON: docker/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
+          CORELIGHTNING_RPC: ./docker/data/clightning-1/regtest/lightning-rpc
          CORELIGHTNING_REST_URL: https://localhost:3001
-          CORELIGHTNING_REST_MACAROON: ./docker/regtest/data/clightning-2-rest/access.macaroon
-          CORELIGHTNING_REST_CERT: ./docker/regtest/data/clightning-2-rest/certificate.pem
+          CORELIGHTNING_REST_MACAROON: ./docker/data/clightning-2-rest/access.macaroon
+          CORELIGHTNING_REST_CERT: ./docker/data/clightning-2-rest/certificate.pem
          LNBITS_ENDPOINT: http://localhost:5001
          LNBITS_KEY: "d08a3313322a4514af75d488bcc27eee"
          ECLAIR_URL: http://127.0.0.1:8082
-          BOLTZ_CLIENT_ENDPOINT: 127.0.0.1:9002
-          BOLTZ_MNEMONIC: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
          LNBITS_MAX_OUTGOING_PAYMENT_AMOUNT_SATS: 1000000000
          LNBITS_MAX_INCOMING_PAYMENT_AMOUNT_SATS: 1000000000
-          LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS: ${{ inputs.backend-wallet-class == 'CoreLightningRestWallet' && 60 || 5 }}
          ECLAIR_PASS: lnbits
          PYTHONUNBUFFERED: 1
          DEBUG: true
@@ -10,20 +10,7 @@ permissions:

 jobs:

-  release:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Create github pre-release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          tag: ${{ github.ref_name }}
-        run: |
-          gh release create "$tag" --prerelease --generate-notes --draft
-
  docker:
-    if: github.repository == 'lnbits/lnbits'
-    needs: [ release ]
    uses: ./.github/workflows/docker.yml
    with:
      tag: ${{ github.ref_name }}
@@ -31,36 +18,15 @@ jobs:
      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

-  docker-latest-rc:
-    if: github.repository == 'lnbits/lnbits'
-    needs: [ release ]
-    uses: ./.github/workflows/docker.yml
-    with:
-      tag: latest-rc
-    secrets:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-
  pypi:
-    if: github.repository == 'lnbits/lnbits'
    runs-on: ubuntu-24.04
    steps:
+      - name: Install dependencies for building secp256k1
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential automake libtool libffi-dev libgmp-dev
      - uses: actions/checkout@v4
-      - name: Set up Python 3.10
-        uses: actions/setup-python@v5
+      - name: Build and publish to pypi
+        uses: JRubics/poetry-publish@v1.15
        with:
-          python-version: "3.10"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Build the project
-        run: uv build
-      - name: Publish to pypi
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_KEY }}
-        run: uv publish
-
-  appimage:
-    needs: [ release ]
-    uses: ./.github/workflows/appimage.yml
-    with:
-      tag_name: ${{ github.ref_name }}
+          pypi_token: ${{ secrets.PYPI_API_KEY }}
@@ -13,6 +13,8 @@ jobs:

  release:
    runs-on: ubuntu-24.04
+    outputs:
+      upload_url: ${{ steps.create_release.outputs.upload_url }}
    steps:
      - uses: actions/checkout@v4
      - name: Create github release
@@ -20,10 +22,10 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ github.ref_name }}
        run: |
-          gh release create "$tag" --generate-notes --draft
+          upload_url=$(gh release create "$tag" --generate-notes --draft --json upload_url -q '.upload_url')
+          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"

  docker:
-    if: github.repository == 'lnbits/lnbits'
    needs: [ release ]
    uses: ./.github/workflows/docker.yml
    with:
@@ -33,7 +35,6 @@ jobs:
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

  docker-latest:
-    if: github.repository == 'lnbits/lnbits'
    needs: [ release ]
    uses: ./.github/workflows/docker.yml
    with:
@@ -42,36 +43,22 @@ jobs:
      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

-  docker-latest-rc:
-    if: github.repository == 'lnbits/lnbits'
-    needs: [ release ]
-    uses: ./.github/workflows/docker.yml
-    with:
-      tag: latest-rc
-    secrets:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-
  pypi:
-    if: github.repository == 'lnbits/lnbits'
    runs-on: ubuntu-24.04
    steps:
+      - name: Install dependencies for building secp256k1
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential automake libtool libffi-dev libgmp-dev
      - uses: actions/checkout@v4
-      - name: Set up Python 3.10
-        uses: actions/setup-python@v5
+      - name: Build and publish to pypi
+        uses: JRubics/poetry-publish@v1.15
        with:
-          python-version: "3.10"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Build the project
-        run: uv build
-      - name: Publish to pypi
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_KEY }}
-        run: uv publish
+          pypi_token: ${{ secrets.PYPI_API_KEY }}

  appimage:
    needs: [ release ]
    uses: ./.github/workflows/appimage.yml
    with:
      tag_name: ${{ github.ref_name }}
+      upload_url: ${{ needs.release.outputs.upload_url }}
@@ -8,7 +8,7 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.12"
+        default: "3.10"
        type: string
      os-version:
        default: "ubuntu-24.04"
@@ -6,7 +6,6 @@ __pycache__
 *$py.class
 .mypy_cache
 .vscode
-.codex
 *-lock.json
 .python-version

@@ -18,8 +17,6 @@ __pycache__
 .webassets-cache
 htmlcov
 test-reports
-playwright-report
-test-results
 tests/data/*.sqlite3

 *.swo
@@ -45,6 +42,7 @@ lnbits/static/bundle.min.js.old
 lnbits/static/bundle.min.css.old
 lnbits/static/bundle-components.min.js.old
 lnbits/upgrades
+docker

 # Nix
 *result*
@@ -1 +0,0 @@
-min-release-age=7
@@ -14,16 +14,16 @@ repos:
      - id: mixed-line-ending
      - id: check-case-conflict
  - repo: https://github.com/psf/black
-    rev: 26.3.1
+    rev: 25.1.0
    hooks:
      - id: black
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.10
+    rev: v0.12.10
    hooks:
      - id: ruff
        args: [ --fix, --exit-non-zero-on-fix ]
  - repo: https://github.com/rbubley/mirrors-prettier
-    rev: v3.7.4
+    rev: v3.6.2
    hooks:
      - id: prettier
        types_or: [css, javascript, html, json]
@@ -1,60 +0,0 @@
-# AGENTS.md - AI Coding Agent Guide for LNbits
-
-This file guides AI coding agents working on LNbits. Keep changes small, verified, and aligned with existing project patterns.
-
-## Core Behavior
-
- Think before coding. State material assumptions. Ask when ambiguity affects correctness, security, payments, wallets, or data migrations.
- Prefer the simplest implementation that solves the request.
- Make surgical changes. Every changed line should trace back to the task.
- Do not refactor, reformat, rename, or clean adjacent code unless required.
- Remove only dead code or imports created by your own changes.
- Define success criteria for non-trivial work and verify them before reporting done.
-
-## LNbits Architecture
-
- Keep core lean. Prefer/assess extensions for non-core features.
- Preserve compatibility with existing extensions and wallet backends.
- Follow existing patterns in `lnbits/core`, `lnbits/wallets`, `lnbits/extensions`, and frontend code.
- Use existing CRUD, services, settings, and migration patterns.
- Do not edit generated files, bundled vendor files, or unrelated extension code.
-
-## Security-Sensitive Areas
-
-Be extra cautious with payments, wallet balances, admin routes, keys, LNURL, Bolt11, funding sources, migrations, and authentication.
-
-Do not expose raw stack traces or sensitive values. Do not add synchronous blocking work in hot async paths without justification.
-
-## Commands and Verification
-
-Read `Makefile` before running project commands.
-
-Use Makefile targets instead of hand-written commands when available:
-
- `make check` for full checks.
- `make test-unit` for unit tests.
- `make test-api` for API tests.
- `make test-wallets` for wallet tests.
- `make checkbundle` when bundled frontend assets may be affected.
- `make format` only when formatting is intended.
-
-Do not run `make test` by default. Use the targeted tests available in the Makefile that are related to the work done, unless the user explicitly asks for broader test coverage.
-
-## Dependencies
-
-Do not add dependencies without approval. If approved, update the correct project files and explain why the dependency is necessary.
-
-## Maintenance
-
-LNbits maintainers own this file. They should update it when the development workflow, architecture, or verification commands materially change.
-
-Do not edit, commit, push, or include changes to this file in a PR as part of normal feature work unless the user explicitly asks for `AGENTS.md` changes.
-
-## Reporting
-
-When finished, report:
-
- Summary of what changed.
- Files touched.
- Makefile targets or checks run.
- Anything not verified and why.
@@ -43,4 +43,4 @@ ENV LNBITS_HOST="0.0.0.0"

 EXPOSE 5000

-CMD ["sh", "-c", "uv --offline run --no-sync lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
+CMD ["sh", "-c", "uv run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
@@ -1,7 +1,6 @@
-ARG LNBITS_TAG=latest
-
 FROM boltz/boltz-client:latest AS boltz
-FROM lnbits/lnbits:${LNBITS_TAG}
+
+FROM lnbits/lnbits:latest

 COPY --from=boltz /bin/boltzd /bin/boltzcli /usr/local/bin/
 RUN ls -l /usr/local/bin/boltzd
@@ -14,13 +13,11 @@ ENV PATH="/root/.local/bin:$PATH"
 # Reinstall dependencies just in case (needed for CMD usage)
 RUN uv sync --all-extras

-# LNbits
+# LNbits + boltzd configuration
 ENV LNBITS_PORT="5000"
 ENV LNBITS_HOST="0.0.0.0"
 ENV LNBITS_BACKEND_WALLET_CLASS="BoltzWallet"
-ENV FUNDING_SOURCE_MAX_RETRIES="10"
-
-# Boltzd
+ENV FUNDING_SOURCE_MAX_RETRIES=10
 ENV BOLTZ_CLIENT_ENDPOINT="127.0.0.1:9002"
 ENV BOLTZ_CLIENT_MACAROON="/root/.boltz/macaroons/admin.macaroon"
 ENV BOLTZ_CLIENT_CERT="/root/.boltz/tls.cert"
@@ -28,7 +25,8 @@ ENV BOLTZ_CLIENT_WALLET="lnbits"

 EXPOSE 5000

-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
+# Entrypoint to start boltzd and LNbits
+COPY dockerboltz.sh /dockerboltz.sh
+RUN chmod +x /dockerboltz.sh

-CMD ["/entrypoint.sh"]
+CMD ["/dockerboltz.sh"]
@@ -1,4 +1,4 @@
-.PHONY: test test-integration
+.PHONY: test

 all: format check

@@ -66,12 +66,8 @@ test-regtest:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	rm -rf ./tests/data \
 	uv run pytest tests/regtest

-test-integration:
-	npm run test:integration
-
 test-migration:
 	LNBITS_ADMIN_UI=True \
 	make test-api
@@ -1,12 +1,12 @@
 <a href="https://lnbits.com" target="_blank" rel="noopener noreferrer">
  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/logos/lnbits-full-inverse.svg">
-    <img src="docs/logos/lnbits-full.svg" alt="LNbits" style="width:300px">
+    <source media="(prefers-color-scheme: dark)" srcset="https://i.imgur.com/QE6SIrs.png">
+    <img src="https://i.imgur.com/fyKPgVT.png" alt="LNbits" style="width:300px">
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)  
-<img alt="lnbits_head" src="docs/assets/header.jpg" />  
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) [<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)  
+<img width="2000" height="203" alt="lnbits_head" src="https://github.com/user-attachments/assets/77669718-ac10-43c7-ae95-6ce236c77401" />  
 [![tip-hero](https://img.shields.io/badge/TipJar-LNBits%20Hero-9b5cff?labelColor=6b7280&logo=lightning&logoColor=white)](https://demo.lnbits.com/tipjar/DwaUiE4kBX6mUW6pj3X5Kg)

 # LNbits — The most powerful Bitcoin & Lightning toolkit
@@ -46,7 +46,7 @@ Get yourself familiar and test on our demo server [demo.lnbits.com](https://demo

 LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending, export to csv. Each wallet also comes with its own API keys, to help partition the exposure of your funding source.

-<img alt="lnbits_wallet" src="docs/assets/wallet.jpg" />
+<img src="https://i.imgur.com/w8jdGpF.png" style="width:800px">

 ## LNbits extension universe

@@ -54,25 +54,25 @@ Extend YOUR LNbits to meet YOUR needs.

 All non-core features are installed as extensions, reducing your code base and making your LNbits unique to you. Extend your LNbits install in any direction, and even create and share your own extensions.

-<img alt="lnbits_extensions" src="docs/assets/extensions.jpg" />
+<img src="https://i.imgur.com/aEBpwJF.png" style="width:800px">

 ## LNbits API

 LNbits has a powerful API, many projects use LNbits to do the heavy lifting for their bitcoin/lightning services.

-<img alt="lnbits_api" src="docs/assets/api.jpg" />
+<img src="https://i.imgur.com/V742sb9.png" style="width:800px">

 ## LNbits node manager

 LNbits comes packaged with a light node management UI, to make running your node that much easier.

-<img alt="lnbits_api" src="docs/assets/lightning_node.jpg" />
+<img src="https://i.imgur.com/TYqIK60.png" style="width:800px">

-## LNbits merchant tools
+## LNbits across all your devices

-The LNbits stack can process both bitcoin and fiat payments, making it a turnkey, all-in-one solution for merchants. With orders and inventory shared across extensions, and built-in notifications for Nostr, Telegram, and email, LNbits keeps everything in sync, freeing merchants to focus on their business.
+As well as working great in a browser, LNbits has native IoS and Android apps as well as a chrome extension. So you can enjoy the same UI across ALL your devices.

-<img alt="lnbits_merchants" src="docs/assets/merchants_small.webp" />
+<img src="https://i.imgur.com/J96EbRf.png" style="width:800px">

 ## Powered by LNbits

@@ -1,18 +0,0 @@
-!data
-data/*
-
-!data/boltz
-data/boltz/*
-!data/boltz/boltz.conf
-
-!data/boltz-client
-data/boltz-client/*
-!data/boltz-client/boltz.toml
-
-!data/boltz-nginx
-data/boltz-nginx/*
-!data/boltz-nginx/default.conf
-
-!data/eclair
-data/eclair/*
-!data/eclair/eclair.conf
@@ -1,99 +0,0 @@
-![TESTS](https://github.com/lnbits/legend-regtest-enviroment/actions/workflows/ci.yml/badge.svg)
-
-# nodes
-
- lnd-1: for locally testing your current lnbits
- lnd-2: used for boltz backend
- lnd-3: used for lnbits inside docker
- cln-1: for locally testing your current lnbits
- cln-2: used for clightning-REST
- eclair-1: for locally testing your current lnbits
-
-# Installing regtest
-
-get the regtest enviroment ready
-
-```sh
-# Install docker https://docs.docker.com/engine/install/
-# Make sure your user has permission to use docker 'sudo usermod -aG docker ${USER}' then reboot
-# Stop/start docker 'sudo systemctl stop docker' 'sudo systemctl start docker'
-
-sudo apt install jq
-git clone https://github.com/lnbits/lnbits.git
-cd lnbits
-docker build -t lnbits/lnbits .
-mkdir docker
-git clone https://github.com/lnbits/legend-regtest-enviroment.git docker
-cd docker
-chmod +x ./start-regtest
-./start-regtest # start the regtest and also run tests
-sudo chown -R $USER ./data # Give the data file permissions for user
-```
-
-# Running LNbits on regtest
-
-add this ENV variables to your `.env` file
-
-```sh
-DEBUG=true
-
-# LND
-LNBITS_BACKEND_WALLET_CLASS="LndRestWallet"
-LND_REST_ENDPOINT=https://127.0.0.1:8081/
-LND_REST_CERT=/home/user/repos/lnbits/docker/data/lnd-1/tls.cert
-LND_REST_MACAROON=/home/user/repos/lnbits/docker/data/lnd-1/data/chain/bitcoin/regtest/admin.macaroon
-
-# CLN
-LNBITS_BACKEND_WALLET_CLASS="CoreLightningWallet"
-CORELIGHTNING_RPC=./docker/data/clightning-1/regtest/lightning-rpc
-
-
-# Run LNbits
-uv run lnbits
-
-# Run LNbits with hot reload
-make dev
-```
-
-# testing
-
-```sh
-chmod +x ./start-regtest
-./start-regtest
-# short answer :)
-./start-regtest && echo "PASSED" || echo "FAILED" > /dev/null
-```
-
-usage of the `bitcoin-cli-sim`, `lightning-cli-sim` and `lncli-sim` aliases
-
-```sh
-cd ~/lnbits/docker
-source docker-scripts.sh
-# use bitcoin core, mine a block
-bitcoin-cli-sim -generate 1
-
-# use c-lightning nodes
-lightning-cli-sim 1 newaddr | jq -r '.bech32' # use node 1
-lightning-cli-sim 2 getinfo # use node 2
-lightning-cli-sim 3 getinfo # use node 3
-
-# use lnd nodes
-lncli-sim 1 newaddr p2wsh
-lncli-sim 2 listpeers
-```
-
-# urls
-
- mempool: http://localhost:8080/
- boltz api: http://localhost:9001/
- lnd-1 rest: http://localhost:8081/
- lnbits: http://localhost:5001/
-
-# debugging docker logs
-
-```sh
-docker logs lnbits-lnbits-1 -f
-docker logs lnbits-boltz-1 -f
-docker logs lnbits-clightning-1-1 -f
-docker logs lnbits-lnd-2-1 -f
-```
@@ -1,49 +0,0 @@
-standalone = true
-network = "regtest"
-
-# Path the the log file
-logfile = ""
-
-electrumUrl = "electrs:19001"
-electrumLiquidUrl = "electrs-liquid:19002"
-
-[BOLTZ]
-# By default the daemon automatically connects to the official Boltz instance for the network LND is on
-# This value is used to override that
-url = "http://boltz-nginx:9001"
-
-[DATABASE]
-# Path to the SQLite database file
-# path = "/home/michael/test.db"
-
-[RPC]
-# Host of
-host = "0.0.0.0"
-
-# Port of the gRPC interface
-port = 9002
-
-# Whether the REST proxy for the gRPC interface should be disabled
-restDisabled = false
-
-# Host of the REST proxy
-restHost = "0.0.0.0"
-
-# Port of the REST proxy
-restPort = 9003
-
-# Path to the TLS cert for the gRPC and REST interface
-tlsCert = ""
-
-# Path to the TLS private key for the gRPC and REST interface
-tlsKey = ""
-noTls = true
-
-# Whether the macaroon authentication for the gRPC and REST interface should be disabled
-noMacaroons = true
-
-# Path to the admin macaroon for the gRPC and REST interface
-adminMacaroonPath = ""
-
-# Path to the read only macaroon for the gRPC and REST interface
-readOnlyMacaroonPath = ""
@@ -1,49 +0,0 @@
-upstream boltz {
-    server boltz:9001;
-}
-
-upstream boltzr {
-    server boltz:9005;
-}
-
-upstream ws {
-    server boltz:9004;
-}
-
-server {
-    listen 9001;
-    listen [::]:9001;
-    server_name localhost;
-
-    add_header Access-Control-Allow-Origin "*" always;
-    add_header Access-Control-Allow-Methods 'GET, PATCH, DELETE, POST, OPTIONS' always;
-    add_header Access-Control-Allow-Headers "*" always;
-
-    proxy_set_header Host $http_host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-
-    if ($request_method = OPTIONS) {
-        return 204;
-    }
-
-    location /v2/ws {
-        proxy_pass http://ws/;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "Upgrade";
-    }
-
-    location ~ ^/v2/(lightning|swap/rescue|swap/restore) {
-        proxy_pass http://boltzr;
-    }
-
-    location /streamswapstatus {
-        proxy_pass http://boltzr;
-    }
-
-    location / {
-        proxy_pass http://boltz;
-    }
-}
@@ -1,114 +0,0 @@
-[api]
-host = "0.0.0.0"
-port = 9_001
-
-[grpc]
-host = "0.0.0.0"
-port = 9_000
-
-[postgres]
-host = "boltz-postgres"
-port = 5432
-database = "boltz"
-username = "boltz"
-password = "boltz"
-
-[sidecar]
-  [sidecar.grpc]
-  host = "127.0.0.1"
-  port = 9003
-
-  [sidecar.ws]
-  host = "0.0.0.0"
-  port = 9004
-
-  [sidecar.api]
-  host = "0.0.0.0"
-  port = 9005
-
-[swap]
-deferredClaimSymbols = ["BTC", "L-BTC"]
-
-[[pairs]]
-base = "BTC"
-quote = "BTC"
-rate = 1
-fee = 0.5
-swapInFee = 0.1
-maxSwapAmount = 40_294_967
-minSwapAmount = 50_000
-
-  [pairs.timeoutDelta]
-  chain = 1440
-  reverse = 1440
-  swapMinimal = 1440
-  swapMaximal = 2880
-  swapTaproot = 10080
-
-[[pairs]]
-base = "L-BTC"
-quote = "BTC"
-fee = 0.25
-swapInFee = 0.1
-rate = 1
-maxSwapAmount = 40_294_967
-minSwapAmount = 100
-
-  [pairs.submarineSwap]
-  minSwapAmount = 1_000
-  minBatchedAmount = 21
-
-  [pairs.chainSwap]
-  minSwapAmount = 25_000
-
-  [pairs.timeoutDelta]
-  chain = 1440
-  reverse = 1440
-  swapMinimal = 1440
-  swapMaximal = 2880
-  swapTaproot = 10080
-
-[[currencies]]
-symbol = "BTC"
-network = "bitcoinRegtest"
-minWalletBalance = 10_000_000
-minChannelBalance = 10_000_000
-maxSwapAmount = 40_294_967
-minSwapAmount = 10_000
-maxZeroConfAmount = 0
-
-  [currencies.chain]
-  # mempoolSpace = "http://mempool-web:8090/api"
-  host = "bitcoind"
-  zmqpubrawtx = "tcp://bitcoind:29000"
-  zmqpubrawblock = "tcp://bitcoind:29001"
-  port = 18_443
-  cookie = "/root/.bitcoin/regtest/.cookie"
-  feeFloor = 0.2
-
-  wallet = "lnbits"
-
-  [currencies.lnd]
-  host = "lnd-2"
-  port = 10_009
-  certpath = "/data/lnd/tls.cert"
-  macaroonpath = "/data/lnd/data/chain/bitcoin/regtest/admin.macaroon"
-
-
-[liquid]
-symbol = "L-BTC"
-network = "liquidRegtest"
-
-maxSwapAmount = 40_294_967
-minSwapAmount = 10_000
-maxZeroConfAmount = 40_294_967
-
-
-  [liquid.chain]
-  host = "elementsd"
-  port = 18884
-  cookie = "/root/.elements/liquidregtest/.cookie"
-  zmqpubrawtx = "tcp://elementsd:31000"
-  zmqpubhashblock = "tcp://elementsd:31002"
-
-  wallet = "lnbits"
@@ -1,28 +0,0 @@
-eclair {
-  chain = "regtest"
-
-  api {
-    binding-ip = "0.0.0.0"
-    enabled = true
-    port = 8080
-    password = "lnbits"
-  }
-
-  bitcoind {
-    host = "bitcoind"
-    rpcport = 18443
-    auth = "safecookie"
-    cookie = "/root/.bitcoin/regtest/.cookie"
-
-    zmqblock = "tcp://bitcoind:29002"
-    zmqtx = "tcp://bitcoind:29000"
-  }
-
-  channel {
-    max-funding-satoshis = 10000000000
-  }
-
-  features {
-    option_support_large_channel = mandatory
-  }
-}
@@ -1,434 +0,0 @@
-services:
-
-  lnbits:
-    hostname: lnbits
-    depends_on:
-      - lnd-3
-    image: lnbits/lnbits
-    restart: on-failure
-    user: "0:0"
-    environment:
-      LNBITS_PORT: 5001
-      DEBUG: true
-      LNBITS_ADMIN_UI: false
-      LNBITS_BACKEND_WALLET_CLASS: "LndRestWallet"
-      LNBITS_DATA_FOLDER: "./data"
-      LND_REST_ENDPOINT: "https://lnd-3:8081/"
-      LND_REST_CERT: "./lnd/tls.cert"
-      LND_REST_MACAROON: "./lnd/data/chain/bitcoin/regtest/admin.macaroon"
-    ports:
-      - 5001:5001
-    volumes:
-      - lnbits-data:/app/data
-      - ./data/lnd-3:/app/lnd:uid=1000,gid=1000
-
-  boltz:
-    hostname: boltz
-    depends_on:
-      - lnd-2
-      - boltz-postgres
-    restart: always
-    image: boltz/boltz:v3.12.1
-    ports:
-      - 9000:9000
-    entrypoint: "sh -c 'sleep 30; /boltz-backend/bin/boltzd'"
-    volumes:
-      - ./data/lnd-2:/data/lnd/
-      - ./data/boltz/:/root/.boltz/
-      - elements-data:/root/.elements
-      - bitcoin-data:/root/.bitcoin
-
-  boltz-client:
-    hostname: boltz-client
-    depends_on:
-      - boltz
-    restart: always
-    image: boltz/boltz-client:latest
-    ports:
-      - 9002:9002
-      - 9003:9003
-    expose:
-      - 9002
-    healthcheck:
-      test: ['CMD', 'boltzcli', '--host', 'boltz-client', 'getinfo']
-      interval: 5s
-      timeout: 3s
-      retries: 10
-      start_period: 0s
-    volumes:
-      - elements-data:/root/.elements
-      - ./data/boltz-client:/root/.boltz
-
-  boltz-backend-nginx:
-    hostname: boltz-nginx
-    restart: always
-    image: nginx:latest
-    ports:
-      - 9001:9001
-    volumes:
-      - nginx-data:/etc/nginx/conf.d
-    healthcheck:
-      test: ['CMD-SHELL', 'curl http://localhost:9001/version']
-      timeout: 1s
-      retries: 10
-      interval: 1s
-      start_period: 0s
-
-  boltz-postgres:
-    hostname: boltz-postgres
-    restart: always
-    image: postgres:14-alpine
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready --dbname boltz --username boltz"]
-      interval: 5s
-      timeout: 30s
-      retries: 10
-      start_period: 5s
-    environment:
-      - POSTGRES_DB=boltz
-      - POSTGRES_USER=boltz
-      - POSTGRES_PASSWORD=boltz
-    expose:
-      - 5432
-
-  bitcoind:
-    hostname: bitcoind
-    image: boltz/bitcoin-core:25.0
-    command:
-      - -regtest
-      - -fallbackfee=0.00000253
-      - -zmqpubrawtx=tcp://0.0.0.0:29000
-      - -zmqpubrawblock=tcp://0.0.0.0:29001
-      - -zmqpubhashblock=tcp://0.0.0.0:29002
-      - -txindex
-      - -rpcallowip=0.0.0.0/0
-      - -rpcbind=0.0.0.0
-      - -addresstype=bech32
-      - -changetype=bech32
-      - -dbcache=2048
-      - -rpcworkqueue=256
-    volumes:
-      - bitcoin-data:/root/.bitcoin
-    expose:
-      - 29000
-      - 29001
-      - 29002
-      - 18443
-      - 18444
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "bitcoin-cli",
-          "--rpccookiefile=/root/.bitcoin/regtest/.cookie",
-          "-regtest",
-          "getblockchaininfo",
-        ]
-      timeout: 1s
-      retries: 1
-      interval: 1s
-      start_period: 0s
-
-  clightning-1:
-    hostname: clightning-1
-    depends_on:
-      - bitcoind
-    image: boltz/c-lightning:24.11
-    command:
-      - --large-channels
-      - --network=regtest
-      - --grpc-port=9736
-      - --bind-addr=0.0.0.0:9735
-      - --bitcoin-rpcconnect=bitcoind
-      - --bitcoin-rpcport=18443
-      - --clnrest-host=0.0.0.0
-      - --clnrest-port=3010
-    expose:
-      - 9735
-    ports:
-      - 9736:9736
-      - 3010:3010
-    volumes:
-      - ./data/clightning-1:/root/.lightning/
-      - bitcoin-data:/root/.bitcoin
-
-  clightning-2:
-    hostname: clightning-2
-    depends_on:
-      - bitcoind
-    image: boltz/c-lightning:22.11.1
-    command:
-      - --large-channels
-      - --network=regtest
-      - --grpc-port=9737
-      - --bind-addr=0.0.0.0:9735
-      - --bitcoin-rpcconnect=bitcoind
-      - --bitcoin-rpcport=18443
-    expose:
-      - 9735
-    ports:
-      - 9737:9737
-    volumes:
-      - ./data/clightning-2:/root/.lightning/
-      - bitcoin-data:/root/.bitcoin
-
-  clightning-2-rest:
-    hostname: clightning-2-rest
-    depends_on:
-      - clightning-2
-    image: saubyk/c-lightning-rest:0.10.7
-    entrypoint: "sh -c 'sleep 35 && /sbin/tini -g -- ./docker-entrypoint.sh'"
-    ports:
-      - 3001:3001
-    expose:
-      - 3001
-    volumes:
-      - ./data/clightning-2:/root/.lightning/:uid=1000,gid=1000
-      - ./data/clightning-2-rest:/usr/src/app/certs/
-      - bitcoin-data:/root/.bitcoin
-
-  clightning-3:
-    hostname: clightning-3
-    depends_on:
-      - bitcoind
-    image: boltz/c-lightning:24.11
-    command:
-      - --large-channels
-      - --network=regtest
-      - --grpc-port=9738
-      - --bind-addr=0.0.0.0:9735
-      - --bitcoin-rpcconnect=bitcoind
-      - --bitcoin-rpcport=18443
-    expose:
-      - 9735
-    ports:
-      - 9738:9738
-    volumes:
-      - ./data/clightning-3:/root/.lightning/
-      - bitcoin-data:/root/.bitcoin
-
-  lnd-1:
-    hostname: lnd-1
-    depends_on:
-      - bitcoind
-    image: boltz/lnd:0.18.4-beta
-    restart: on-failure
-    command:
-      - --listen=lnd-1:9735
-      - --rpclisten=lnd-1:10009
-      - --restlisten=lnd-1:8081
-      - --bitcoin.active
-      - --bitcoin.regtest
-      - --bitcoin.node=bitcoind
-      - --bitcoind.rpchost=bitcoind
-      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
-      - --bitcoind.zmqpubrawtx=bitcoind:29000
-      - --bitcoind.zmqpubrawblock=bitcoind:29001
-      - --noseedbackup
-      - --protocol.wumbo-channels
-    expose:
-      - 8081
-      - 9735
-      - 10009
-    volumes:
-      - ./data/lnd-1:/root/.lnd/
-      - bitcoin-data:/root/.bitcoin
-
-  lnd-2:
-    hostname: lnd-2
-    depends_on:
-      - bitcoind
-    image: boltz/lnd:0.19.3-beta
-    restart: on-failure
-    command:
-      - --listen=lnd-2:9735
-      - --rpclisten=lnd-2:10009
-      - --restlisten=lnd-2:8081
-      - --bitcoin.active
-      - --bitcoin.regtest
-      - --bitcoin.node=bitcoind
-      - --bitcoind.rpchost=bitcoind
-      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
-      - --bitcoind.zmqpubrawtx=bitcoind:29000
-      - --bitcoind.zmqpubrawblock=bitcoind:29001
-      - --noseedbackup
-      - --protocol.wumbo-channels
-    expose:
-      - 8081
-      - 9735
-      - 10009
-    volumes:
-      - ./data/lnd-2:/root/.lnd/
-      - bitcoin-data:/root/.bitcoin
-
-  lnd-3:
-    hostname: lnd-3
-    depends_on:
-      - bitcoind
-    image: boltz/lnd:0.18.4-beta
-    restart: on-failure
-    command:
-      - --listen=lnd-3:9735
-      - --rpclisten=lnd-3:10009
-      - --restlisten=lnd-3:8081
-      - --bitcoin.active
-      - --bitcoin.regtest
-      - --bitcoin.node=bitcoind
-      - --bitcoind.rpchost=bitcoind
-      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
-      - --bitcoind.zmqpubrawtx=bitcoind:29000
-      - --bitcoind.zmqpubrawblock=bitcoind:29001
-      - --noseedbackup
-      - --protocol.wumbo-channels
-    ports:
-      - 8081:8081
-      - 10009:10009
-    expose:
-      - 8081
-      - 9735
-      - 10009
-    volumes:
-      - ./data/lnd-3:/root/.lnd/
-      - bitcoin-data:/root/.bitcoin
-
-  lnd-4:
-    hostname: lnd-4
-    depends_on:
-      - bitcoind
-    image: boltz/lnd:0.18.4-beta
-    restart: on-failure
-    command:
-      - --listen=lnd-4:9735
-      - --rpclisten=lnd-4:10009
-      - --restlisten=lnd-4:8081
-      - --bitcoin.active
-      - --bitcoin.regtest
-      - --bitcoin.node=bitcoind
-      - --bitcoind.rpchost=bitcoind
-      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
-      - --bitcoind.zmqpubrawtx=bitcoind:29000
-      - --bitcoind.zmqpubrawblock=bitcoind:29001
-      - --noseedbackup
-      - --protocol.wumbo-channels
-    expose:
-      - 8081
-      - 9735
-      - 10009
-    volumes:
-      - ./data/lnd-4:/root/.lnd/
-      - bitcoin-data:/root/.bitcoin
-
-  eclair:
-    hostname: eclair
-    depends_on:
-      - bitcoind
-    image: boltz/eclair:0.8.0
-    restart: on-failure
-    entrypoint: "sh -c 'JAVA_OPTS=-Xmx512m /eclair-node/bin/eclair-node.sh -Declair.datadir=/root/eclair -Declair.printToConsole'"
-    ports:
-      - 8082:8080
-    expose:
-      - 9735
-      - 8080
-    volumes:
-      - ./data/eclair:/root/eclair
-      - bitcoin-data:/root/.bitcoin
-
-  electrs:
-    hostname: electrs
-    restart: always
-    image: boltz/electrs:latest
-    entrypoint: ["electrs-bitcoin"]
-    command:
-      - --electrum-rpc-addr
-      - electrs:19001
-      - --http-addr
-      - electrs:3002
-      - --daemon-rpc-addr
-      - bitcoind:18443
-      - --network
-      - regtest
-      - --jsonrpc-import
-    healthcheck:
-      test: ["CMD-SHELL", "curl -s $(hostname):3002/blocks/tip/height"]
-      timeout: 1s
-      retries: 20
-      interval: 2s
-      start_period: 5s
-    ports:
-      - 19001:19001
-      - 3002:3002
-    volumes:
-      - bitcoin-data:/root/.bitcoin
-
-  elementsd:
-    hostname: elementsd
-    restart: always
-    image: boltz/elements:latest
-    expose:
-      - 31001
-    ports:
-      - 31000:31000
-      - 31002:31002
-      - 18884:18884
-    command:
-    - -chain=liquidregtest
-    - -txindex=1
-    - -rest=1
-    - -server=1
-    - -rpcallowip=0.0.0.0/0
-    - -validatepegin=0
-    - -initialfreecoins=2100000000000000
-    - -fallbackfee=0.000001
-    - -rpcbind=0.0.0.0
-    - -rpcport=18884
-    - -zmqpubrawtx=tcp://0.0.0.0:31000
-    - -zmqpubrawblock=tcp://0.0.0.0:31001
-    - -zmqpubhashblock=tcp://0.0.0.0:31002
-    - -acceptdiscountct=1
-    - -creatediscountct=1
-    volumes:
-      - elements-data:/root/.elements
-
-  electrs-liquid:
-    hostname: electrs-liquid
-    restart: always
-    image: boltz/electrs:latest
-    entrypoint: ["electrs-liquid"]
-    command:
-      - --electrum-rpc-addr
-      - electrs-liquid:19002
-      - --http-addr
-      - electrs-liquid:3003
-      - --daemon-rpc-addr
-      - elementsd:18884
-      - --daemon-dir
-      - /root/.elements
-      - --network
-      - liquidregtest
-      - --parent-network
-      - regtest
-      - --jsonrpc-import
-    healthcheck:
-      test: ["CMD-SHELL", "curl -s $(hostname):3003/blocks/tip/height"]
-      timeout: 15s
-      retries: 20
-      interval: 2s
-      start_period: 5s
-    ports:
-      - 19002:19002
-      - 3003:3003
-    volumes:
-      - elements-data:/root/.elements
-
-volumes:
-  lnbits-data:
-  bitcoin-data:
-  elements-data:
-  nginx-data:
-    name: nginx-data
-    driver: local
-    driver_opts:
-      type: none
-      o: bind
-      device: ./data/boltz-nginx/
@@ -1,322 +0,0 @@
-#!/bin/sh
-export COMPOSE_PROJECT_NAME=lnbits
-
-boltzcli-sim() {
-  docker exec -it lnbits-boltz-client-1 boltzcli "$@"
-}
-
-bitcoin-cli-sim() {
-  docker exec lnbits-bitcoind-1 bitcoin-cli -regtest "$@"
-}
-
-elements-cli-sim() {
-  docker exec lnbits-elementsd-1 elements-cli -rpcport=18884 -chain=liquidregtest "$@"
-}
-
-# args(i, cmd)
-lightning-cli-sim() {
-  i=$1
-  shift # shift first argument so we can use $@
-  docker exec lnbits-clightning-$i-1 lightning-cli --network regtest "$@"
-}
-
-# args(i, cmd)
-lncli-sim() {
-  i=$1
-  shift # shift first argument so we can use $@
-  docker exec lnbits-lnd-$i-1 lncli --network regtest --rpcserver=lnd-$i:10009 "$@"
-}
-
-get-eclair-pubkey() {
-  while true; do
-    pubkey=$(docker exec lnbits-eclair-1 curl http://localhost:8080/getinfo -X POST -s -u :lnbits | jq -r .nodeId 2> /dev/null)
-    pubkeyPrefix=$(echo $pubkey | cut -c1,2)
-    if [[ "$pubkeyPrefix" == "02" || "$pubkeyPrefix" == "03" ]]; then
-      echo $pubkey
-      break
-    fi
-    sleep 1
-  done
-}
-
-wait-for-eclair-channel() {
-  while true; do
-    state=$(docker exec lnbits-eclair-1 curl http://localhost:8080/channels -X POST -s -u :lnbits | jq -r ".[0].state")
-    pending=$(docker exec lnbits-eclair-1 curl -s http://localhost:8080/channels -X POST -u :lnbits| jq '. | length')
-    echo "eclair-1 pendingchannels: $pending, current state: $state"
-    if [[ "$state" == "NORMAL" ]]; then
-      break
-    fi
-    sleep 1
-  done
-}
-
-# args(i)
-fund_boltz_client() {
-  # first address of seed: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
-  address="el1qq2xvpcvfup5j8zscjq05u2wxxjcyewk7979f3mmz5l7uw5pqmx6xf5xy50hsn6vhkm5euwt72x878eq6zxx2z0z676mna6kdq"
-  echo "funding: $address on boltz-client"
-  elements-cli-sim -named sendtoaddress address=$address amount=30 fee_rate=100 > /dev/null
-}
-
-
-# args(i)
-fund_clightning_node() {
-  address=$(lightning-cli-sim $1 newaddr | jq -r .bech32)
-  echo "funding: $address on clightning-node: $1"
-  bitcoin-cli-sim -named sendtoaddress address=$address amount=30 fee_rate=100 > /dev/null
-}
-
-# args(i)
-fund_lnd_node() {
-  address=$(lncli-sim $1 newaddress p2wkh | jq -r .address)
-  echo "funding: $address on lnd-node: $1"
-  bitcoin-cli-sim -named sendtoaddress address=$address amount=30 fee_rate=100 > /dev/null
-}
-
-# args(i, j)
-connect_clightning_node() {
-  pubkey=$(lightning-cli-sim $2 getinfo | jq -r '.id')
-  lightning-cli-sim $1 connect $pubkey@lnbits-clightning-$2-1:9735 | jq -r '.id'
-}
-
-lnbits-regtest-start(){
-  if ! command -v jq &> /dev/null
-  then
-      echo "jq is not installed"
-      exit
-  fi
-  if ! command -v docker &> /dev/null
-  then
-      echo "docker is not installed"
-      exit
-  fi
-  if ! command -v docker version &> /dev/null
-  then
-      echo "dockerd is not running"
-      exit
-  fi
-  lnbits-regtest-stop
-  docker compose up -d --remove-orphans
-  lnbits-regtest-init
-}
-
-lnbits-regtest-start-log(){
-  lnbits-regtest-stop
-  docker compose up --remove-orphans
-  lnbits-regtest-init
-}
-
-lnbits-regtest-stop(){
-  docker compose down --volumes
-  # clean up lightning node data
-  sudo rm -rf ./data/clightning-1 ./data/clightning-2 ./data/clightning-3 ./data/lnd-1  ./data/lnd-2 ./data/lnd-3 ./data/lnd-4 ./data/boltz/boltz.db ./data/eclair/regtest ./data/boltz-client/liquid-wallet ./data/boltz-client/bitcoin-wallet ./data/boltz-client/wallet ./data/boltz-client/boltz.db
-  # recreate lightning node data folders preventing permission errors
-  mkdir ./data/clightning-1 ./data/clightning-2 ./data/clightning-3 ./data/lnd-1 ./data/lnd-2 ./data/lnd-3 ./data/lnd-4
-}
-
-lnbits-regtest-restart(){
-  lnbits-regtest-stop
-  lnbits-regtest-start
-}
-
-boltz-client-init(){
-  for i in 0 1 2; do
-    fund_boltz_client
-  done
-  elements-cli-sim -generate 3 > /dev/null
-}
-
-lnbits-bitcoin-init(){
-  echo "init_bitcoin_wallet..."
-  bitcoin-cli-sim createwallet lnbits || bitcoin-cli-sim loadwallet lnbits
-  echo "mining 150 blocks..."
-  bitcoin-cli-sim -generate 150 > /dev/null
-}
-
-lnbits-elements-init(){
-  echo "init_elements_wallet..."
-  elements-cli-sim createwallet lnbits || elements-cli-sim loadwallet lnbits
-  echo "mining 150 blocks..."
-  elements-cli-sim -generate 150 > /dev/null
-  elements-cli-sim rescanblockchain
-}
-
-lnbits-init(){
-  echo "init_lnbits..."
-  docker exec lnbits-lnbits-1 uv run python tools/create_fake_admin.py
-}
-
-lnbits-regtest-init(){
-  lnbits-bitcoin-init
-  lnbits-elements-init
-  lnbits-lightning-sync
-  lnbits-lightning-init
-  boltz-client-init
-  lnbits-init
-}
-
-lnbits-lightning-sync(){
-  wait-for-clightning-sync 1
-  wait-for-clightning-sync 2
-  wait-for-clightning-sync 3
-  wait-for-lnd-sync 1
-  wait-for-lnd-sync 2
-  wait-for-lnd-sync 3
-  wait-for-lnd-sync 4
-}
-
-lnbits-lightning-init(){
-
-  # create 10 UTXOs for each node
-  for i in 0 1 2; do
-    fund_clightning_node 1
-    fund_clightning_node 2
-    fund_clightning_node 3
-    fund_lnd_node 1
-    fund_lnd_node 2
-    fund_lnd_node 3
-    fund_lnd_node 4
-  done
-
-  echo "mining 3 blocks..."
-  bitcoin-cli-sim -generate 3 > /dev/null
-
-  lnbits-lightning-sync
-
-  channel_confirms=6
-  channel_size=24000000 # 0.024 btc
-  balance_size=12000000 # 0.12 btc
-  balance_size_msat=12000000000 # 0.12 btc
-
-  # lnd-1 -> lnd-2
-  lncli-sim 1 connect $(lncli-sim 2 getinfo | jq -r '.identity_pubkey')@lnbits-lnd-2-1 > /dev/null
-  echo "open channel from lnd-1 to lnd-2"
-  lncli-sim 1 openchannel $(lncli-sim 2 getinfo | jq -r '.identity_pubkey') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 1
-
-  # lnd-1 -> lnd-3
-  lncli-sim 1 connect $(lncli-sim 3 getinfo | jq -r '.identity_pubkey')@lnbits-lnd-3-1 > /dev/null
-  echo "open channel from lnd-1 to lnd-3"
-  lncli-sim 1 openchannel $(lncli-sim 3 getinfo | jq -r '.identity_pubkey') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 1
-
-  # lnd-1 -> cln-1
-  lncli-sim 1 connect $(lightning-cli-sim 1 getinfo | jq -r '.id')@lnbits-clightning-1-1 > /dev/null
-  echo "open channel from lnd-1 to cln-1"
-  lncli-sim 1 openchannel $(lightning-cli-sim 1 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 1
-
-  # lnd-1 -> cln-2
-  lncli-sim 1 connect $(lightning-cli-sim 2 getinfo | jq -r '.id')@lnbits-clightning-2-1 > /dev/null
-  echo "open channel from lnd-1 to cln-2"
-  lncli-sim 1 openchannel $(lightning-cli-sim 2 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 1
-
-  # lnd-1 -> cln-3
-  lncli-sim 1 connect $(lightning-cli-sim 3 getinfo | jq -r '.id')@lnbits-clightning-3-1 > /dev/null
-  echo "open channel from lnd-1 to cln-3"
-  lncli-sim 1 openchannel $(lightning-cli-sim 3 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 1
-
-  # lnd-2 -> cln-2
-  lncli-sim 2 connect $(lightning-cli-sim 2 getinfo | jq -r '.id')@lnbits-clightning-2-1 > /dev/null
-  echo "open channel from lnd-2 to cln-2"
-  lncli-sim 2 openchannel $(lightning-cli-sim 2 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 2
-
-  # lnd-3 -> cln-3
-  lncli-sim 3 connect $(lightning-cli-sim 3 getinfo | jq -r '.id')@lnbits-clightning-3-1 > /dev/null
-  echo "open channel from lnd-3 to cln-1"
-  lncli-sim 3 openchannel $(lightning-cli-sim 3 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 3
-
-  # lnd-3 -> cln-1
-  lncli-sim 3 connect $(lightning-cli-sim 1 getinfo | jq -r '.id')@lnbits-clightning-1-1 > /dev/null
-  echo "open channel from lnd-3 to cln-1"
-  lncli-sim 3 openchannel $(lightning-cli-sim 1 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 3
-
-  # lnd-1 -> eclair-1
-  lncli-sim 1 connect $(get-eclair-pubkey)@lnbits-eclair-1 > /dev/null
-  echo "open channel from lnd-2 to eclair-1"
-  lncli-sim 1 openchannel $(get-eclair-pubkey) $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 1
-
-  # lnd-2 -> eclair-1
-  lncli-sim 2 connect $(get-eclair-pubkey)@lnbits-eclair-1 > /dev/null
-  echo "open channel from lnd-2 to eclair-1"
-  lncli-sim 2 openchannel $(get-eclair-pubkey) $channel_size $balance_size > /dev/null
-  bitcoin-cli-sim -generate $channel_confirms > /dev/null
-  wait-for-lnd-channel 2
-
-  wait-for-clightning-channel 1
-  wait-for-clightning-channel 2
-  wait-for-clightning-channel 3
-
-  wait-for-eclair-channel
-
-  lnbits-lightning-sync
-
-}
-
-wait-for-lnd-channel(){
-  while true; do
-    pending=$(lncli-sim $1 pendingchannels | jq -r '.pending_open_channels | length')
-    echo "lnd-$1 pendingchannels: $pending"
-    if [[ "$pending" == "0" ]]; then
-      break
-    fi
-    sleep 1
-  done
-}
-
-wait-for-lnd-sync(){
-  while true; do
-    if [[ "$(lncli-sim $1 getinfo 2>&1 | jq -r '.synced_to_chain' 2> /dev/null)" == "true" ]]; then
-      echo "lnd-$1 is synced!"
-      break
-    fi
-    echo "waiting for lnd-$1 to sync..."
-    sleep 1
-  done
-}
-
-wait-for-clightning-channel(){
-  while true; do
-    pending=$(lightning-cli-sim $1 getinfo | jq -r '.num_pending_channels | length')
-    echo "cln-$1 pendingchannels: $pending"
-    if [[ "$pending" == "0" ]]; then
-      if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_bitcoind_sync' 2> /dev/null)" == "null" ]]; then
-        if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_lightningd_sync' 2> /dev/null)" == "null" ]]; then
-          break
-        fi
-      fi
-    fi
-    sleep 1
-  done
-}
-
-wait-for-clightning-sync(){
-  while true; do
-    if [[ ! "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.id' 2> /dev/null)" == "null" ]]; then
-      if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_bitcoind_sync' 2> /dev/null)" == "null" ]]; then
-        if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_lightningd_sync' 2> /dev/null)" == "null" ]]; then
-          echo "cln-$1 is synced!"
-          break
-        fi
-      fi
-    fi
-    echo "waiting for cln-$1 to sync..."
-    sleep 1
-  done
-}
@@ -1,74 +0,0 @@
-#!/bin/bash
-print_success() {
-  printf "\033[;1;32mPASSED\033[;0m $1\n"
-}
-
-print_error() {
-  printf "\033[;1;31mFAILED\033[;0m $1\n"
-}
-
-run(){
-  label=$1
-  value=$2
-  cmd=$3
-  if [[ "$cmd" == "$value" ]]; then
-    print_success "$label is $cmd"
-  else
-    print_error "$label is $cmd, should be $value"
-    failed="true"
-  fi
-}
-
-failed="false"
-blockheight=213
-utxos=3
-channel_size=24000000 # 0.024 btc
-balance_size=12000000 # 0.012 btc
-
-source $(pwd)/docker-scripts.sh
-lnbits-regtest-start
-echo "=================================="
-printf "\033[;1;36mregtest started! starting tests...\033[;0m\n"
-echo "=================================="
-echo ""
-
-for i in 1 2 3; do
-  run "lnd-$i .synced_to_chain" "true" $(lncli-sim $i getinfo | jq -r ".synced_to_chain")
-  run "lnd-$i utxo count" $utxos $(lncli-sim $i listunspent | jq -r ".utxos | length")
-  run "lnd-$i .block_height" $blockheight $(lncli-sim $i getinfo | jq -r ".block_height")
-  if [[ "$i" == "1" ]]; then
-    channel_count=6
-  else
-    channel_count=3
-  fi
-  run "lnd-$i openchannels" $channel_count $(lncli-sim $i listchannels | jq -r ".channels | length")
-  run "lnd-$i .channels[0].capacity" $channel_size $(lncli-sim $i listchannels | jq -r ".channels[0].capacity")
-  run "lnd-$i .channels[0].push_amount_sat" $balance_size $(lncli-sim $i listchannels | jq -r ".channels[0].push_amount_sat")
-done
-for i in 1 2 3; do
-  # run "cln-$i blockheight" $blockheight $(lightning-cli-sim $i getinfo | jq -r ".blockheight")
-  run "cln-$i utxo count" $utxos $(lightning-cli-sim $i listfunds | jq -r ".outputs | length")
-  run "cln-$i openchannels" 2 $(lightning-cli-sim $i getinfo | jq -r ".num_active_channels")
-  run "cln-$i channel[0].state" "CHANNELD_NORMAL" $(lightning-cli-sim $i listfunds | jq -r ".channels[0].state")
-  run "cln-$i channel[0].amount_msat" $(($channel_size * 1000)) $(lightning-cli-sim $i listfunds | jq -r ".channels[0].amount_msat" | sed 's/msat//g')
-  run "cln-$i channel[0].our_amount_msat" $(($balance_size * 1000)) $(lightning-cli-sim $i listfunds | jq -r ".channels[0].our_amount_msat" | sed 's/msat//g')
-done
-
-run "eclair-1 openchannels" 2 $(docker exec lnbits-eclair-1 curl -s http://localhost:8080/channels -X POST -u :lnbits| jq '. | length')
-run "eclair-1 blockHeight" $blockheight $(docker exec lnbits-eclair-1 curl -s http://localhost:8080/getinfo -X POST -u :lnbits| jq '.blockHeight')
-run "lnbits service status" "200" $(curl -s -o /dev/null -w "%{http_code}" "http://localhost:5001/")
-run "boltz service status" "200" $(curl -s -o /dev/null --head -w "%{http_code}" "http://localhost:9001/version")
-
-# return non-zero exit code if a test fails
-if [[ "$failed" == "true" ]]; then
-  echo ""
-  echo "=================================="
-  print_error "one more more tests failed"
-  echo "=================================="
-  exit 1
-else
-  echo ""
-  echo "=================================="
-  print_success "all tests passed! yay!"
-  echo "=================================="
-fi
@@ -1,41 +0,0 @@
-ARG LNBITS_TAG=latest
-
-FROM lnbits/lnbits:${LNBITS_TAG}
-
-RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
-
-RUN apt-get update && apt-get -y upgrade
-RUN apt-get install -y ca-certificates curl gnupg netcat-openbsd git nodejs
-
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh
-ENV PATH="/root/.local/bin:$PATH"
-
-# install sparksidecar
-RUN git clone https://github.com/lnbits/spark_sidecar
-RUN cd spark_sidecar && npm ci
-
-# Reinstall dependencies for lnbits just in case (needed for CMD usage)
-RUN uv sync --all-extras
-
-# LNBITS
-ENV LNBITS_PORT="5000"
-ENV LNBITS_HOST="0.0.0.0"
-ENV LNBITS_BACKEND_WALLET_CLASS="SparkL2Wallet"
-ENV LNBITS_RESERVE_FEE_MIN="20000"
-ENV LNBITS_RESERVE_FEE_PERCENT="1"
-ENV LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS="20"
-ENV FUNDING_SOURCE_MAX_RETRIES="10"
-
-# spark sidecar
-ENV SPARK_NETWORK="MAINNET"
-ENV SPARK_SIDECAR_PORT="8765"
-ENV SPARK_PAY_WAIT_MS="20000"
-ENV SPARK_MULTIPLICITY="3"
-
-EXPOSE 5000
-
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-# Entrypoint to start sparksidebar and LNbits
-CMD ["/entrypoint.sh"]
@@ -1,25 +0,0 @@
-#!/bin/bash
-set -e
-
-node spark_sidecar/server.mjs &
-
-SIDECAR_PID=$!
-
-# Wait for startup
-for i in {1..10}; do
-  if nc -z localhost $SPARK_SIDECAR_PORT; then
-    echo "sparksidebar is up!"
-    break
-  fi
-  echo "Waiting for sparksidebar to start..."
-  sleep 1
-done
-
-# Optional: check if still not up
-if ! nc -z localhost $SPARK_SIDECAR_PORT; then
-  echo "sparksidebar did not start successfully."
-  exit 1
-fi
-
-echo "Starting LNbits on $LNBITS_HOST:$LNBITS_PORT..."
-exec uv run lnbits --port "$LNBITS_PORT" --host "$LNBITS_HOST" --forwarded-allow-ips='*'
@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNBits Admin UI

@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend Wallet Comparison Table

@@ -49,7 +50,6 @@ Below is a side-by-side comparison of Lightning funding sources you can use with
 | **Blink**                      | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; focuses on mobile integrations.                                       |
 | **ZBD**                        | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Gaming-focused payment platform.                                                           |
 | **Spark (CLN)**                | Self-custodial           | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | Web interface for CLN; requires Spark server setup.                                        |
-| **Spark (L2)**                 | Self-custodial           | ❌                  | Medium                         | ❌                        | High              | Automatic                | Easy              | Low                    | Minimal fees                                 | Medium          | Runs via Spark sidecar; seed-based self-custody.                                           |
 | **Cliche Wallet**              | Self-custodial           | ❌                  | Medium                         | ❌                        | Medium            | Manual                   | Moderate          | Moderate               | Minimal fees                                 | Medium          | Lightweight wallet; suitable for embedded systems.                                         |
 | **Strike**                     | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                                            |
 | **LNPay**                      | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                                            |
@@ -57,9 +57,7 @@ Below is a side-by-side comparison of Lightning funding sources you can use with
 | **LN.tips**                    | Custodial/Self-Custodial | Depends on provider | Medium                         | ❌                        | Low               | Provider-managed         | Moderate          | Low                    | Transaction fees may apply                   | Medium          | Simple hosted service; use LN.tips API as your backend.                                    |
 | **Fake Wallet**                | Testing (simulated)      | ❌                  | Low                            | ❌                        | N/A               | N/A                      | Easy              | Low                    | None (test only)                             | N/A             | For testing only; mints accounting units in LNbits (no real sats, unit name configurable). |

-## Spark (L2)
-
-Spark L2 uses a local Node.js sidecar to expose an HTTP API that LNbits can use as a funding source. It is self-custodial and secured by a standard mnemonic seed. Sidecar repo `https://github.com/lnbits/spark_sidecar`.
+---

 ### Notes for readers

@@ -11,7 +11,7 @@ nav_order: 1
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) <img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">

 # Basic installation

@@ -51,7 +51,7 @@ nav_order: 1
 sudo apt-get install jq libfuse2
 wget $(curl -s https://api.github.com/repos/lnbits/lnbits/releases/latest | jq -r '.assets[] | select(.name | endswith(".AppImage")) | .browser_download_url') -O LNbits-latest.AppImage
 chmod +x LNbits-latest.AppImage
-LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 AUTH_HTTPS_ONLY=false ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
+LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
 ```

 - LNbits will create a folder for DB and extension files **in the same directory** as the AppImage.
@@ -285,7 +285,10 @@ but you can also set the env variables or pass command line arguments:

 ```sh
 # .env variables are currently passed when running, but LNbits can be managed with the admin UI.
-LNBITS_ADMIN_UI=true AUTH_HTTPS_ONLY=false ./result/bin/lnbits --port 9000 --host 0.0.0.0
+LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000 --host 0.0.0.0
+
+# Once you have created a user, you can set as the super_user
+SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
 ```

 > ![NOTE](https://img.shields.io/badge/NOTE-3b82f6?labelColor=494949)
@@ -1,139 +0,0 @@
-# Generic OIDC Authentication Configuration
-
-This document explains how to configure generic OIDC authentication for LNbits, which allows integration with various OIDC-compliant authentication providers such as Zitadel, Authentik, and others.
-
-## Overview
-
-The generic OIDC provider (`oidc`) complements the existing Keycloak provider and allows you to integrate any OIDC-compliant authentication service. You can customize the login button with your own organization name and icon.
-
-## Configuration
-
-Add the following environment variables to your `.env` file or system environment:
-
-### Required Settings
-
-```bash
-# Enable OIDC authentication
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-
-# OIDC Discovery URL (well-known endpoint)
-LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
-
-# Client credentials from your OIDC provider
-LNBITS_OIDC_CLIENT_ID=your-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-client-secret
-```
-
-### Optional Settings - Customize the Login Button
-
-You can customize how the OIDC login button appears to your users:
-
-```bash
-# Custom organization name (displayed on the login button)
-# Example: "Login via Zitadel" or "Login via Authentik"
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
-
-# Custom icon URL (displayed on the login button)
-# Can be a full URL or a path to a local image
-LNBITS_OIDC_CLIENT_CUSTOM_ICON=https://zitadel.com/favicon.svg
-```
-
-If not set, the button will display "Login via OIDC" with a generic lock icon.
-
-## Zitadel Configuration Example
-
-For Zitadel, configure as follows:
-
-1. Create a new application in Zitadel
-2. Choose "Web" application type
-3. Configure the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-4. Save the Client ID and Client Secret
-5. Use these environment variables:
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
-LNBITS_OIDC_CLIENT_ID=your-zitadel-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-zitadel-client-secret
-# Customize the button to show "Login via Zitadel" with Zitadel's logo
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
-LNBITS_OIDC_CLIENT_CUSTOM_ICON="https://zitadel.com/favicon.svg"
-```
-
-**Result**: The login page will display a button with the text "Login via Zitadel" and the Zitadel logo.
-
-## Authentik Configuration Example
-
-For Authentik:
-
-1. Create a new OAuth2/OpenID Provider
-2. Set the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-3. Configure scopes: `openid`, `email`, `profile`
-4. Get the Client ID and Client Secret
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-LNBITS_OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/your-app/.well-known/openid-configuration
-LNBITS_OIDC_CLIENT_ID=your-authentik-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-authentik-client-secret
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Authentik"
-```
-
-## Multiple Auth Methods
-
-You can enable multiple authentication methods simultaneously:
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=username-password,oidc-auth,keycloak-auth
-```
-
-## Discovery Endpoint Requirements
-
-Your OIDC provider must expose a standard discovery endpoint (`.well-known/openid-configuration`) that includes:
-
- `authorization_endpoint`
- `token_endpoint`
- `userinfo_endpoint`
- `jwks_uri` (JSON Web Key Set)
-
-The OIDC implementation will automatically fetch these endpoints from the discovery URL.
-
-## User Mapping
-
-The OIDC provider maps user information from the OIDC userinfo endpoint:
-
- `sub` → User ID
- `email` → Email address
- `given_name` → First name
- `family_name` → Last name
- `name` or `preferred_username` → Display name
- `picture` → Profile picture URL
-
-## Troubleshooting
-
-### Authentication fails
-
-1. Verify the discovery URL is accessible
-2. Check that Client ID and Client Secret are correct
-3. Ensure redirect URI in your OIDC provider matches: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-4. Check LNbits logs for detailed error messages
-
-### User info not populated
-
-Some OIDC providers may use different claim names. If user information is not correctly populated, check your provider's userinfo endpoint response format and adjust the provider class if needed.
-
-## Security Considerations
-
- Always use HTTPS in production
- Keep client secrets secure and never commit them to version control
- Use environment variables or secure configuration management
- Regularly rotate client secrets
- Review OIDC provider's security best practices
-
-## Implementation Details
-
-The OIDC provider is implemented in `lnbits/core/models/sso/oidc.py` and extends the `fastapi_sso` library's `SSOBase` class. It uses the standard OpenID Connect flow with:
-
- Scopes: `openid`, `email`, `profile`
- Response type: `code` (authorization code flow)
- Discovery document for automatic endpoint resolution
@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Super User (SU)

@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Roles: A Quick Overview

@@ -14,6 +14,7 @@ nav_order: 3
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend wallets

@@ -40,8 +41,7 @@ A backend wallet is selected and configured entirely through LNbits environment
 | [CoreLightning](#corelightning)                 | [LND (gRPC)](#lnd-grpc)               | [Blink](#blink)                                   |
 | [CoreLightning REST](#corelightning-rest)       | [LNbits](#lnbits)                     | [Alby](#alby)                                     |
 | [Spark (Core Lightning)](#spark-core-lightning) | [LNPay](#lnpay)                       | [Boltz](#boltz)                                   |
-| [Spark L2](#spark-l2)                           | [ZBD](#zbd)                           | [Phoenixd](#phoenixd)                             |
-| [Cliche Wallet](#cliche-wallet)                 |                                       |                                                   |
+| [Cliche Wallet](#cliche-wallet)                 | [ZBD](#zbd)                           | [Phoenixd](#phoenixd)                             |
 | [Breez SDK](#breez-sdk)                         | [Breez Liquid SDK](#breez-liquid-sdk) | [Nostr Wallet Connect](#nostr-wallet-connect-nwc) |
 | [Strike](#strike)                               | [Eclair (ACINQ)](#eclair-acinq)       | [LN.tips](#lntips)                                |
 | [Fake Wallet](#fake-wallet)                     |                                       |                                                   |
@@ -52,7 +52,7 @@ A backend wallet is selected and configured entirely through LNbits environment

 ### CLNRest (using [runes](https://docs.corelightning.org/reference/lightning-createrune))

-[Core Lightning REST API docs](https://docs.corelightning.org/docs/rest)
+[Core Lightning REST API docs](https://docs.corelightning.org/docs/rest)  
 Should also work with the [Rust version of CLNRest](https://github.com/daywalker90/clnrest-rs)

 **Environment variables**
@@ -127,33 +127,6 @@ Old REST interface using [RTL c-lightning-REST](https://github.com/Ride-The-Ligh
 - `SPARK_URL`: `http://10.147.17.230:9737/rpc`
 - `SPARK_TOKEN`: `secret_access_key`

-## Spark L2
-
-Self-custodial funding source using the [Spark L2](https://docs.spark.money/start/overview) network. Requires a Node.js [sidecar](https://github.com/lnbits/spark_sidecar) that bridges lnbits talking to Spark. Works in addition with any Spark-compatible seed (Wallet of Satoshi, BuhoGO, BlitzWallet).
-If the sidecar is started with a `mnemonic` then that mnemonic will be used. Otherwhise if a mnemonic is set for the `Spark L2` LNbits funding source then that mnemonic will be used.
-
-### Optional tuning
-
- `SPARK_L2_PAY_WAIT_MS`: `4000` _(payment timeout in ms)_
- `SPARK_L2_PAY_POLL_MS`: `500` _(polling interval in ms)_
- `SPARK_L2_STREAM_KEEPALIVE_MS`: `15000` _(SSE keepalive in ms)_
-
-### Example: run the sidecar
-
-```bash
-git clone https://github.com/lnbits/spark_sidecar.git
-cd spark_sidecar
-npm install
-
-SPARK_MNEMONIC="bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom" \
-SPARK_NETWORK=MAINNET \
-SPARK_SIDECAR_PORT=8765 \
-SPARK_PAY_WAIT_MS=20000 \
-node server.mjs
-```
-
-For testing, you can generate a 12-word mnemonic at https://iancoleman.io/bip39/. Store it securely — it controls your funds. Then select Spark (L2) as the funding source in LNbits.
-
 ## LND (REST)

 **Required env vars**
@@ -1,6 +1,5 @@
 from .core.services import create_invoice, pay_invoice
 from .decorators import (
-    check_account_exists,
    check_admin,
    check_super_user,
    check_user_exists,
@@ -12,7 +11,6 @@ from .exceptions import InvoiceError, PaymentError
 __all__ = [
    "InvoiceError",
    "PaymentError",
-    "check_account_exists",
    "check_admin",
    "check_super_user",
    "check_user_exists",
@@ -23,40 +23,29 @@ from lnbits.core.crud import (
    get_installed_extensions,
    update_installed_extension_state,
 )
-from lnbits.core.crud.audit import delete_expired_audit_entries
 from lnbits.core.crud.extensions import create_installed_extension
 from lnbits.core.helpers import migrate_extension_database
 from lnbits.core.models.notifications import NotificationType
 from lnbits.core.services.extensions import deactivate_extension, get_valid_extensions
-from lnbits.core.services.funding_source import (
-    check_balance_delta_changed,
-    check_server_balance_against_node,
-)
-from lnbits.core.services.notifications import (
-    dispatch_payment_notification,
-    enqueue_admin_notification,
-    process_next_notification,
-)
-from lnbits.core.services.payments import (
-    check_pending_payments,
-    fundingsource_invoice_producer,
-)
+from lnbits.core.services.notifications import enqueue_admin_notification
+from lnbits.core.services.payments import check_pending_payments
 from lnbits.core.tasks import (
    audit_queue,
    collect_exchange_rates_data,
-    notify_server_status,
-    process_next_audit_entry,
-    refresh_extension_cache,
-)
-from lnbits.core.wasm_ext.routes.register import register_wasm_extension
-from lnbits.core.wasm_ext.wasm.events import dispatch_wasm_invoice_paid
-from lnbits.core.wasm_ext.wasm.loader import (
-    is_wasm_extension_id,
+    purge_audit_data,
+    run_by_the_minute_tasks,
+    wait_for_audit_data,
+    wait_for_paid_invoices,
+    wait_notification_messages,
 )
 from lnbits.exceptions import register_exception_handlers
 from lnbits.helpers import version_parse
-from lnbits.llms_txt import create_llms_txt_route
 from lnbits.settings import settings
+from lnbits.tasks import (
+    cancel_all_tasks,
+    create_permanent_task,
+    register_invoice_listener,
+)
 from lnbits.utils.cache import cache
 from lnbits.utils.logger import (
    configure_logger,
@@ -76,10 +65,9 @@ from .middleware import (
    InstalledExtensionMiddleware,
    add_first_install_middleware,
    add_ip_block_middleware,
-    add_profiler_middleware,
    add_ratelimit_middleware,
 )
-from .task_manager import task_manager
+from .tasks import internal_invoice_listener, invoice_listener, run_interval


 async def startup(app: FastAPI):
@@ -113,9 +101,6 @@ async def startup(app: FastAPI):
    # register core routes
    init_core_routers(app)

-    # register llms.txt endpoint for AI agents
-    create_llms_txt_route(app)
-
    # initialize tasks
    register_async_tasks()

@@ -143,7 +128,7 @@ async def shutdown():
    settings.lnbits_running = False

    # shutdown event
-    task_manager.cancel_all_tasks()
+    cancel_all_tasks()

    # wait a bit to allow them to finish, so that cleanup can run without problems
    await asyncio.sleep(0.1)
@@ -176,7 +161,6 @@ def create_app() -> FastAPI:

    # Allow registering new extensions routes without direct access to the `app` object
    core_app_extra.register_new_ext_routes = register_new_ext_routes(app)
-    core_app_extra.register_new_wasm_ext_routes = register_new_wasm_ext_routes(app)
    core_app_extra.register_new_ratelimiter = register_new_ratelimiter(app)

    # register static files
@@ -212,9 +196,6 @@ def create_app() -> FastAPI:

    register_exception_handlers(app)

-    if settings.profiler:
-        add_profiler_middleware(app)
-
    return app


@@ -423,13 +404,6 @@ def register_new_ext_routes(app: FastAPI) -> Callable:
    return register_new_ext_routes_fn


-def register_new_wasm_ext_routes(app: FastAPI) -> Callable:
-    def register_new_wasm_ext_routes_fn(ext_id: str):
-        register_wasm_extension(app, ext_id)
-
-    return register_new_wasm_ext_routes_fn
-
-
 def register_new_ratelimiter(app: FastAPI) -> Callable:
    def register_new_ratelimiter_fn():
        limiter = Limiter(
@@ -483,59 +457,32 @@ async def check_and_register_extensions(app: FastAPI) -> None:
    await check_installed_extensions(app)
    for ext in await get_valid_extensions(False):
        try:
-            if is_wasm_extension_id(ext.code):
-                register_wasm_extension(app, ext.code)
-                continue
            register_ext_routes(app, ext)
            register_ext_tasks(ext)
        except Exception as exc:
            logger.error(f"Could not load extension `{ext.code}`: {exc!s}")
-            await update_installed_extension_state(ext_id=ext.code, active=False)


 def register_async_tasks() -> None:

-    task_manager.init()
+    create_permanent_task(wait_for_audit_data)
+    create_permanent_task(wait_notification_messages)

-    # listen to all incoming payments and dispatch payment notifications
-    # note: should be the first in task list for a bit quicker notifications
-    task_manager.register_invoice_listener(dispatch_payment_notification, "core")
+    create_permanent_task(run_interval(30 * 60, check_pending_payments))
+    create_permanent_task(invoice_listener)
+    create_permanent_task(internal_invoice_listener)
+    create_permanent_task(cache.invalidate_forever)

-    # periodic tasks
-    task_manager.create_permanent_task(cache.invalidate_cache, interval=10)
-    task_manager.create_permanent_task(delete_expired_audit_entries, interval=60 * 60)
-    task_manager.create_permanent_task(
-        check_pending_payments,
-        interval=settings.lnbits_funding_source_pending_interval_seconds,
-    )
-    task_manager.create_permanent_task(
-        collect_exchange_rates_data,
-        interval=max(60, settings.lnbits_exchange_history_refresh_interval_seconds),
-    )
-    task_manager.create_permanent_task(check_balance_delta_changed, interval=60)
-    task_manager.create_permanent_task(
-        check_server_balance_against_node,
-        interval=60 * settings.lnbits_watchdog_interval_minutes,
-    )
-    task_manager.create_permanent_task(
-        notify_server_status,
-        interval=60 * 60 * settings.lnbits_notification_server_status_hours,
-    )
-    task_manager.create_permanent_task(refresh_extension_cache, interval=60)
+    # core invoice listener
+    invoice_queue: asyncio.Queue = asyncio.Queue()
+    register_invoice_listener(invoice_queue, "core")
+    create_permanent_task(lambda: wait_for_paid_invoices(invoice_queue))

-    # permanent tasks run in a loop, will be restarted if they fail
-    task_manager.create_permanent_task(fundingsource_invoice_producer)
-    task_manager.create_permanent_task(process_next_notification)
-    task_manager.create_permanent_task(process_next_audit_entry)
-
-    async def dispatch_extension_invoice_paid(payment) -> None:
-        await dispatch_wasm_invoice_paid(payment)
-
-    task_manager.register_invoice_listener(dispatch_extension_invoice_paid, "core_wasm")
+    create_permanent_task(run_by_the_minute_tasks)
+    create_permanent_task(purge_audit_data)
+    create_permanent_task(collect_exchange_rates_data)

    # server logs for websocket
    if settings.lnbits_admin_ui:
        server_log_task = initialize_server_websocket_logger()
-        task_manager.create_permanent_task(
-            server_log_task, name="server_websocket_logger"
-        )
+        create_permanent_task(server_log_task)
@@ -12,13 +12,11 @@ from .extensions import (
    drop_extension_db,
    get_installed_extension,
    get_installed_extensions,
-    get_installed_extensions_count,
    get_user_active_extensions_ids,
    get_user_extension,
    get_user_extensions,
    update_installed_extension,
    update_installed_extension_state,
-    update_installed_extension_wasm_runtime_limits,
    update_user_extension,
 )
 from .payments import (
@@ -60,7 +58,6 @@ from .users import (
    get_account_by_username,
    get_account_by_username_or_email,
    get_accounts,
-    get_accounts_count,
    get_user,
    get_user_access_control_lists,
    get_user_from_account,
@@ -120,13 +117,11 @@ __all__ = [
    "get_account_by_username",
    "get_account_by_username_or_email",
    "get_accounts",
-    "get_accounts_count",
    "get_admin_settings",
    "get_db_version",
    "get_db_versions",
    "get_installed_extension",
    "get_installed_extensions",
-    "get_installed_extensions_count",
    "get_latest_payments_by_extension",
    "get_payment",
    "get_payments",
@@ -157,7 +152,6 @@ __all__ = [
    "update_admin_settings",
    "update_installed_extension",
    "update_installed_extension_state",
-    "update_installed_extension_wasm_runtime_limits",
    "update_migration_version",
    "update_payment",
    "update_payment_checking_id",
@@ -1,12 +1,7 @@
-import json
-from datetime import datetime, timedelta, timezone
-
 from lnbits.core.db import db
 from lnbits.core.models.extensions import (
    InstallableExtension,
    UserExtension,
-    WasmInvocation,
-    WasmInvocationStats,
 )
 from lnbits.db import Connection, Database

@@ -16,11 +11,6 @@ async def create_installed_extension(
    conn: Connection | None = None,
 ) -> None:
    await (conn or db).insert("installed_extensions", ext)
-    await update_installed_extension_wasm_runtime_limits(
-        ext_id=ext.id,
-        limits=ext.wasm_runtime_limits,
-        conn=conn,
-    )


 async def update_installed_extension(
@@ -28,11 +18,6 @@ async def update_installed_extension(
    conn: Connection | None = None,
 ) -> None:
    await (conn or db).update("installed_extensions", ext)
-    await update_installed_extension_wasm_runtime_limits(
-        ext_id=ext.id,
-        limits=ext.wasm_runtime_limits,
-        conn=conn,
-    )


 async def update_installed_extension_state(
@@ -46,33 +31,6 @@ async def update_installed_extension_state(
    )


-async def update_installed_extension_wasm_runtime_limits(
-    *, ext_id: str, limits: dict, conn: Connection | None = None
-) -> None:
-    if not await _has_installed_extension_wasm_runtime_limits_column(conn=conn):
-        return
-
-    await (conn or db).execute(
-        """
-        UPDATE installed_extensions
-        SET wasm_runtime_limits = :limits
-        WHERE id = :id
-        """,
-        {"id": ext_id, "limits": json.dumps(limits)},
-    )
-
-
-async def _has_installed_extension_wasm_runtime_limits_column(
-    conn: Connection | None = None,
-) -> bool:
-    row: dict | None = await (conn or db).fetchone(
-        "SELECT version FROM dbversions WHERE db = 'core'"
-    )
-    if not row:
-        return False
-    return int(row["version"] or 0) >= 48
-
-
 async def delete_installed_extension(
    *, ext_id: str, conn: Connection | None = None
 ) -> None:
@@ -132,13 +90,6 @@ async def get_installed_extensions(
    return all_extensions


-async def get_installed_extensions_count(conn: Connection | None = None) -> int:
-    row: dict | None = await (conn or db).fetchone(
-        "SELECT COUNT(*) as count FROM installed_extensions"
-    )
-    return int(row["count"]) if row else 0
-
-
 async def get_user_extension(
    user_id: str, extension: str, conn: Connection | None = None
 ) -> UserExtension | None:
@@ -186,158 +137,3 @@ async def get_user_active_extensions_ids(
        UserExtension,
    )
    return [ext.extension for ext in exts]
-
-
-async def create_wasm_invocation(
-    invocation: WasmInvocation,
-    conn: Connection | None = None,
-) -> None:
-    await (conn or db).insert("wasm_invocations", invocation)
-
-
-async def update_wasm_invocation(
-    invocation: WasmInvocation,
-    conn: Connection | None = None,
-) -> None:
-    await (conn or db).update("wasm_invocations", invocation)
-
-
-async def get_wasm_invocation(
-    invocation_id: str,
-    conn: Connection | None = None,
-) -> WasmInvocation | None:
-    return await (conn or db).fetchone(
-        "SELECT * FROM wasm_invocations WHERE id = :id",
-        {"id": invocation_id},
-        model=WasmInvocation,
-    )
-
-
-async def get_wasm_invocations(
-    *,
-    extension_id: str | None = None,
-    status: str | None = None,
-    limit: int = 100,
-    offset: int = 0,
-    conn: Connection | None = None,
-) -> list[WasmInvocation]:
-    where: list[str] = []
-    values: dict = {
-        "limit": max(1, min(limit, 500)),
-        "offset": max(offset, 0),
-    }
-    if extension_id:
-        where.append("extension_id = :extension_id")
-        values["extension_id"] = extension_id
-    if status:
-        where.append("status = :status")
-        values["status"] = status
-
-    query = "SELECT * FROM wasm_invocations"
-    if where:
-        query += f" WHERE {' AND '.join(where)}"
-    query += " ORDER BY started_at DESC LIMIT :limit OFFSET :offset"
-
-    return await (conn or db).fetchall(query, values, model=WasmInvocation)
-
-
-async def get_running_wasm_invocations(
-    conn: Connection | None = None,
-) -> list[WasmInvocation]:
-    return await get_wasm_invocations(status="running", conn=conn)
-
-
-async def get_wasm_invocation_stats(
-    *,
-    extension_id: str | None = None,
-    since: datetime | None = None,
-    conn: Connection | None = None,
-) -> WasmInvocationStats:
-    database = conn or db
-    where: list[str] = []
-    values: dict = {}
-    if extension_id:
-        where.append("extension_id = :extension_id")
-        values["extension_id"] = extension_id
-    if since:
-        where.append(f"started_at >= {database.timestamp_placeholder('since')}")
-        values["since"] = since
-
-    query = """
-        SELECT
-            COUNT(*) AS total,
-            COALESCE(SUM(CASE WHEN status = 'running' THEN 1 ELSE 0 END), 0)
-                AS running,
-            COALESCE(SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END), 0)
-                AS completed,
-            COALESCE(SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END), 0)
-                AS failed,
-            COALESCE(SUM(CASE WHEN status = 'stopped' THEN 1 ELSE 0 END), 0)
-                AS stopped,
-            COALESCE(SUM(CASE WHEN status = 'timeout' THEN 1 ELSE 0 END), 0)
-                AS timeout,
-            COALESCE(AVG(duration_ms), 0) AS avg_duration_ms,
-            COALESCE(MAX(duration_ms), 0) AS max_duration_ms,
-            COALESCE(SUM(host_call_count), 0) AS host_call_count,
-            COALESCE(SUM(http_call_count), 0) AS http_call_count,
-            COALESCE(SUM(storage_call_count), 0) AS storage_call_count,
-            COALESCE(SUM(wallet_call_count), 0) AS wallet_call_count
-        FROM wasm_invocations
-    """
-    if where:
-        query += f" WHERE {' AND '.join(where)}"
-
-    row: dict | None = await (conn or db).fetchone(query, values)
-    if not row:
-        return WasmInvocationStats()
-
-    return WasmInvocationStats(
-        total=int(row["total"] or 0),
-        running=int(row["running"] or 0),
-        completed=int(row["completed"] or 0),
-        failed=int(row["failed"] or 0),
-        stopped=int(row["stopped"] or 0),
-        timeout=int(row["timeout"] or 0),
-        avg_duration_ms=float(row["avg_duration_ms"] or 0),
-        max_duration_ms=int(row["max_duration_ms"] or 0),
-        host_call_count=int(row["host_call_count"] or 0),
-        http_call_count=int(row["http_call_count"] or 0),
-        storage_call_count=int(row["storage_call_count"] or 0),
-        wallet_call_count=int(row["wallet_call_count"] or 0),
-    )
-
-
-async def delete_old_wasm_invocations(
-    retention_days: int,
-    conn: Connection | None = None,
-) -> int:
-    if retention_days <= 0:
-        return 0
-
-    cutoff = datetime.now(timezone.utc) - timedelta(days=retention_days)
-    database = conn or db
-    result = await database.execute(
-        f"""
-        DELETE FROM wasm_invocations
-        WHERE status != 'running'
-            AND started_at < {database.timestamp_placeholder("cutoff")}
-        """,  # noqa: S608
-        {"cutoff": cutoff},
-    )
-    return int(result.rowcount or 0)
-
-
-async def mark_stale_wasm_invocations(
-    conn: Connection | None = None,
-) -> None:
-    database = conn or db
-    await database.execute(
-        f"""
-        UPDATE wasm_invocations
-        SET status = 'abandoned',
-            finished_at = {database.timestamp_placeholder("finished_at")},
-            stop_reason = 'Server restarted before invocation finished.'
-        WHERE status = 'running'
-        """,  # noqa: S608
-        {"finished_at": datetime.now(timezone.utc)},
-    )
@@ -1,4 +1,3 @@
-from datetime import datetime, timezone
 from time import time
 from typing import Any

@@ -34,9 +33,9 @@ async def get_payment(checking_id: str, conn: Connection | None = None) -> Payme

 async def get_standalone_payment(
    checking_id_or_hash: str,
+    conn: Connection | None = None,
    incoming: bool | None = False,
    wallet_id: str | None = None,
-    conn: Connection | None = None,
 ) -> Payment | None:
    clause: str = "checking_id = :checking_id OR payment_hash = :hash"
    values = {
@@ -47,7 +46,7 @@ async def get_standalone_payment(
        clause = f"({clause}) AND amount > 0"

    if wallet_id:
-        wallet = await get_wallet(wallet_id, conn=conn)
+        wallet = await get_wallet(wallet_id)
        if not wallet or not wallet.can_view_payments:
            return None
        values["wallet_id"] = wallet.source_wallet_id
@@ -70,7 +69,7 @@ async def get_standalone_payment(
 async def get_wallet_payment(
    wallet_id: str, payment_hash: str, conn: Connection | None = None
 ) -> Payment | None:
-    wallet = await get_wallet(wallet_id, conn=conn)
+    wallet = await get_wallet(wallet_id)
    if not wallet or not wallet.can_view_payments:
        return None
    payment = await (conn or db).fetchone(
@@ -125,6 +124,7 @@ async def get_payments_paginated(  # noqa: C901
    Filters payments to be returned by:
      - complete | pending | failed | outgoing | incoming.
    """
+
    values: dict[str, Any] = {
        "time": since,
    }
@@ -134,7 +134,7 @@ async def get_payments_paginated(  # noqa: C901
        clause.append(f"time > {db.timestamp_placeholder('time')}")

    if wallet_id:
-        wallet = await get_wallet(wallet_id, conn=conn)
+        wallet = await get_wallet(wallet_id)
        if not wallet or not wallet.can_view_payments:
            return Page(data=[], total=0)

@@ -149,12 +149,14 @@ async def get_payments_paginated(  # noqa: C901
            f"(status = '{PaymentState.SUCCESS}' OR status = '{PaymentState.PENDING}')"
        )
    elif complete:
-        clause.append(f"""
+        clause.append(
+            f"""
            (
                status = '{PaymentState.SUCCESS}'
                OR (amount < 0 AND status = '{PaymentState.PENDING}')
            )
-            """)
+            """
+        )
    elif pending:
        clause.append(f"status = '{PaymentState.PENDING}'")
    elif failed:
@@ -290,10 +292,8 @@ async def create_payment(
        webhook=data.webhook,
        fee=-abs(data.fee),
        tag=extra.get("tag", None),
-        extension=data.extension,
        extra=extra,
        labels=data.labels or [],
-        external_id=data.external_id,
    )

    await (conn or db).insert("apipayments", payment)
@@ -305,16 +305,8 @@ async def update_payment_checking_id(
    checking_id: str, new_checking_id: str, conn: Connection | None = None
 ) -> None:
    await (conn or db).execute(
-        f"""
-            UPDATE apipayments
-            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder("now")}
-            WHERE checking_id = :old_id
-        """,  # noqa: S608
-        {
-            "new_id": new_checking_id,
-            "old_id": checking_id,
-            "now": int(time()),
-        },
+        "UPDATE apipayments SET checking_id = :new_id WHERE checking_id = :old_id",
+        {"new_id": new_checking_id, "old_id": checking_id},
    )


@@ -322,22 +314,18 @@ async def update_payment(
    payment: Payment,
    new_checking_id: str | None = None,
    conn: Connection | None = None,
-) -> Payment:
-    payment.updated_at = datetime.now(timezone.utc)
+) -> None:
    await (conn or db).update(
        "apipayments", payment, "WHERE checking_id = :checking_id"
    )
    if new_checking_id and new_checking_id != payment.checking_id:
        await update_payment_checking_id(payment.checking_id, new_checking_id, conn)
-        payment.checking_id = new_checking_id
-    return payment


 async def get_payments_history(
    wallet_id: str | None = None,
    group: DateTrunc = "day",
    filters: Filters | None = None,
-    conn: Connection | None = None,
 ) -> list[PaymentHistoryPoint]:
    if not filters:
        filters = Filters()
@@ -348,12 +336,14 @@ async def get_payments_history(
        "wallet_id": wallet_id,
    }
    # count outgoing payments if they are still pending
-    where = [f"""
+    where = [
+        f"""
        wallet_id = :wallet_id AND (
            status = '{PaymentState.SUCCESS}'
            OR (amount < 0 AND status = '{PaymentState.PENDING}')
        )
-        """]
+        """
+    ]
    clause = filters.where(where)
    transactions: list[dict] = await db.fetchall(
        # This query is safe from SQL injection:
@@ -371,13 +361,13 @@ async def get_payments_history(
        filters.values(values),
    )
    if wallet_id:
-        wallet = await get_wallet(wallet_id, conn=conn)
+        wallet = await get_wallet(wallet_id)
        if not wallet or not wallet.can_view_payments:
            return []
        balance = wallet.balance_msat
        values["wallet_id"] = wallet.source_wallet_id
    else:
-        balance = await get_total_balance(conn=conn)
+        balance = await get_total_balance()

    # since we dont know the balance at the starting point,
    # we take the current balance and walk backwards
@@ -402,6 +392,7 @@ async def get_payment_count_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> list[PaymentCountStat]:
+
    if not filters:
        filters = Filters()
    extra_stmts = []
@@ -434,6 +425,7 @@ async def get_daily_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> tuple[list[PaymentDailyStats], list[PaymentDailyStats]]:
+
    if not filters:
        filters = Filters()

@@ -483,6 +475,7 @@ async def get_wallets_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> list[PaymentWalletStats]:
+
    if not filters:
        filters = Filters()

@@ -8,18 +8,11 @@ from lnbits.db import dict_to_model
 from lnbits.settings import (
    AdminSettings,
    EditableSettings,
-    FundingSourcesSettings,
    SettingsField,
    SuperSettings,
    settings,
 )

-RESET_PRESERVED_SETTINGS = (
-    "lnbits_webpush_pubkey",
-    "lnbits_webpush_privkey",
-    *FundingSourcesSettings.__fields__,
-)
-

 async def get_super_settings() -> SuperSettings | None:
    data = await get_settings_by_tag("core")
@@ -76,14 +69,16 @@ async def delete_admin_settings(tag: str | None = "core") -> None:


 async def reset_core_settings() -> None:
-    core_settings = await get_settings_by_tag("core") or {}
-    super_user = await get_settings_field("super_user")
-    await delete_admin_settings()
-    if super_user:
-        await set_settings_field("super_user", super_user.value)
-    for field in RESET_PRESERVED_SETTINGS:
-        if field in core_settings:
-            await set_settings_field(field, core_settings[field])
+    await db.execute(
+        """
+        DELETE FROM system_settings WHERE tag = 'core'
+        AND id NOT IN (
+            'super_user',
+            'lnbits_webpush_pubkey',
+            'lnbits_webpush_privkey'
+        )
+        """,
+    )


 async def create_admin_settings(super_user: str, new_settings: dict) -> SuperSettings:
@@ -110,8 +105,7 @@ async def get_settings_field(
    )
    if not row:
        return None
-    value = json.loads(row["value"]) if row["value"] else None
-    return SettingsField(id=row["id"], value=value, tag=row["tag"])
+    return SettingsField(id=row["id"], value=json.loads(row["value"]), tag=row["tag"])


 async def set_settings_field(id_: str, value: Any | None, tag: str | None = "core"):
@@ -4,17 +4,10 @@ from typing import Any
 from uuid import uuid4

 from lnbits.core.crud.extensions import get_user_active_extensions_ids
-from lnbits.core.crud.wallets import (
-    clear_wallet_cache,
-    create_wallet,
-    get_standalone_wallet,
-    get_wallets,
-)
+from lnbits.core.crud.wallets import create_wallet, get_wallets
 from lnbits.core.db import db
 from lnbits.core.models import UserAcls
 from lnbits.db import Connection, Filters, Page
-from lnbits.helpers import sha256s
-from lnbits.utils.cache import cache

 from ..models import (
    Account,
@@ -37,16 +30,9 @@ async def create_account(
    return account


-async def get_accounts_count(conn: Connection | None = None) -> int:
-    row: dict | None = await (conn or db).fetchone(
-        "SELECT COUNT(*) as count FROM accounts"
-    )
-    return int(row["count"]) if row else 0
-
-
-async def update_account(account: Account, conn: Connection | None = None) -> Account:
+async def update_account(account: Account) -> Account:
    account.updated_at = datetime.now(timezone.utc)
-    await (conn or db).update("accounts", account)
+    await db.update("accounts", account)
    return account


@@ -55,7 +41,6 @@ async def delete_account(user_id: str, conn: Connection | None = None) -> None:
        "DELETE from accounts WHERE id = :user",
        {"user": user_id},
    )
-    await clear_user_id_cache(user_id)


 async def get_accounts(
@@ -64,22 +49,17 @@ async def get_accounts(
 ) -> Page[AccountOverview]:
    where_clauses = []
    values: dict[str, Any] = {}
-    filters = filters or Filters()

-    wallet_filter = filters.get_filter_by_field("wallet_id")
-
-    if wallet_filter and wallet_filter.values:
-        wallet_id_value = next(iter(wallet_filter.values.values()), None)
-        wallet = (
-            await get_standalone_wallet(wallet_id_value, deleted=None, conn=conn)
-            if wallet_id_value
-            else None
-        )
-        if not wallet:
-            return Page(data=[], total=0)
-        where_clauses.append("accounts.id = :account_id")
-        values = {**values, "account_id": wallet.user}
-        filters.remove_filter_by_field("wallet_id")
+    # Make wallet filter explicit
+    wallet_filter = (
+        next((f for f in filters.filters if f.field == "wallet_id"), None)
+        if filters
+        else None
+    )
+    if filters and wallet_filter and wallet_filter.values:
+        where_clauses.append("wallets.id = :wallet_id")
+        values = {**values, "wallet_id": next(iter(wallet_filter.values.values()))}
+        filters.filters = [f for f in filters.filters if f.field != "wallet_id"]

    return await (conn or db).fetch_page(
        """
@@ -89,7 +69,6 @@ async def get_accounts(
            accounts.email,
            accounts.pubkey,
            accounts.external_id,
-            accounts.activated,
            SUM(COALESCE((
                SELECT balance FROM balances WHERE wallet_id = wallets.id
            ), 0)) as balance_msat,
@@ -114,18 +93,12 @@ async def get_accounts(
    )


-async def get_account(
-    user_id: str, active_only: bool = True, conn: Connection | None = None
-) -> Account | None:
+async def get_account(user_id: str, conn: Connection | None = None) -> Account | None:
    if len(user_id) == 0:
        return None
-
    return await (conn or db).fetchone(
-        """
-            SELECT * FROM accounts
-            WHERE id = :id AND (activated = true OR activated = :activated)
-        """,
-        {"id": user_id, "activated": active_only},
+        "SELECT * FROM accounts WHERE id = :id",
+        {"id": user_id},
        Account,
    )

@@ -151,98 +124,71 @@ async def delete_accounts_no_wallets(


 async def get_account_by_username(
-    username: str, active_only: bool = True, conn: Connection | None = None
+    username: str, conn: Connection | None = None
 ) -> Account | None:
    if len(username) == 0:
        return None
-
    return await (conn or db).fetchone(
-        """
-            SELECT * FROM accounts
-            WHERE
-                LOWER(username) = :username
-                AND (activated = true OR activated = :activated)
-        """,
-        {"username": username.lower(), "activated": active_only},
+        "SELECT * FROM accounts WHERE LOWER(username) = :username",
+        {"username": username.lower()},
        Account,
    )


 async def get_account_by_pubkey(
-    pubkey: str, active_only: bool = True, conn: Connection | None = None
+    pubkey: str, conn: Connection | None = None
 ) -> Account | None:
    return await (conn or db).fetchone(
-        """
-            SELECT * FROM accounts
-            WHERE
-                LOWER(pubkey) = :pubkey
-                AND (activated = true OR activated = :activated)
-        """,
-        {"pubkey": pubkey.lower(), "activated": active_only},
+        "SELECT * FROM accounts WHERE LOWER(pubkey) = :pubkey",
+        {"pubkey": pubkey.lower()},
        Account,
    )


 async def get_account_by_email(
-    email: str, active_only: bool = True, conn: Connection | None = None
+    email: str, conn: Connection | None = None
 ) -> Account | None:
    if len(email) == 0:
        return None
-
    return await (conn or db).fetchone(
-        """
-            SELECT * FROM accounts
-            WHERE
-                LOWER(email) = :email
-                AND (activated = true OR activated = :activated)
-        """,
-        {"email": email.lower(), "activated": active_only},
+        "SELECT * FROM accounts WHERE LOWER(email) = :email",
+        {"email": email.lower()},
        Account,
    )


 async def get_account_by_username_or_email(
-    username_or_email: str,
-    active_only: bool = True,
-    conn: Connection | None = None,
+    username_or_email: str, conn: Connection | None = None
 ) -> Account | None:
-
    return await (conn or db).fetchone(
        """
            SELECT * FROM accounts
-            WHERE
-                (LOWER(email) = :value or LOWER(username) = :value)
-                AND (activated = true OR activated = :activated)
+            WHERE LOWER(email) = :value or LOWER(username) = :value
        """,
-        {"value": username_or_email.lower(), "activated": active_only},
+        {"value": username_or_email.lower()},
        Account,
    )


-async def get_user(
-    user_id: str, active_only: bool = True, conn: Connection | None = None
-) -> User | None:
-    async with db.reuse_conn(conn) if conn else db.connect() as conn:
-        account = await get_account(user_id, active_only, conn=conn)
-        if not account:
-            return None
-        return await get_user_from_account(account, conn=conn)
+async def get_user(user_id: str, conn: Connection | None = None) -> User | None:
+    account = await get_account(user_id, conn)
+    if not account:
+        return None
+    return await get_user_from_account(account, conn)


 async def get_user_from_account(
    account: Account, conn: Connection | None = None
 ) -> User | None:
-    async with db.reuse_conn(conn) if conn else db.connect() as conn:
-        extensions = await get_user_active_extensions_ids(account.id, conn=conn)
-        wallets = await get_wallets(account.id, deleted=False, conn=conn)
+    extensions = await get_user_active_extensions_ids(account.id, conn=conn)
+    wallets = await get_wallets(account.id, deleted=False, conn=conn)

-        if len(wallets) == 0:
-            wallet = await create_wallet(user_id=account.id, conn=conn)
-            wallets.append(wallet)
+    if len(wallets) == 0:
+        wallet = await create_wallet(user_id=account.id, conn=conn)
+        wallets.append(wallet)

    return User(
        id=account.id,
-        activated=account.activated,
        email=account.email,
        username=account.username,
        pubkey=account.pubkey,
@@ -256,43 +202,21 @@ async def get_user_from_account(
        super_user=account.is_super_user,
        fiat_providers=account.fiat_providers,
        has_password=account.password_hash is not None,
-        ui_customization=account.ui_customization or {},
    )


-async def update_user_access_control_list(
-    user_acls: UserAcls, conn: Connection | None = None
-):
+async def update_user_access_control_list(user_acls: UserAcls):
    user_acls.updated_at = datetime.now(timezone.utc)
-    await (conn or db).update("accounts", user_acls)
+    await db.update("accounts", user_acls)


 async def get_user_access_control_lists(
-    user_id: str, active_only: bool = True, conn: Connection | None = None
+    user_id: str, conn: Connection | None = None
 ) -> UserAcls:
    user_acls = await (conn or db).fetchone(
-        """
-            SELECT id, access_control_list FROM accounts
-            WHERE id = :user_id AND (activated = true OR activated = :activated)
-        """,
-        {"user_id": user_id, "activated": active_only},
+        "SELECT id, access_control_list FROM accounts WHERE id = :id",
+        {"id": user_id},
        UserAcls,
    )

    return user_acls or UserAcls(id=user_id)
-
-
-async def clear_user_id_cache(user_id: str):
-    user = await get_user(user_id, active_only=True)
-    if user:
-        clear_user_cache(user)
-
-
-def clear_user_cache(user: User):
-    user_cache_key: str | None = cache.pop(
-        f"auth:user:cache_key:{sha256s(user.id)}", None
-    )
-    if user_cache_key:
-        cache.pop(user_cache_key)
-    for wallet in user.wallets:
-        clear_wallet_cache(wallet)
@@ -3,10 +3,9 @@ from time import time
 from uuid import uuid4

 from lnbits.core.db import db
-from lnbits.core.models.wallets import BaseWallet, WalletsFilters, WalletType
+from lnbits.core.models.wallets import WalletsFilters, WalletType
 from lnbits.db import Connection, Filters, Page
 from lnbits.settings import settings
-from lnbits.utils.cache import cache

 from ..models import Wallet

@@ -45,14 +44,13 @@ async def update_wallet(


 async def delete_wallet(
+    *,
    user_id: str,
    wallet_id: str,
    deleted: bool = True,
    conn: Connection | None = None,
 ) -> None:
-    clear_wallet_id_cache(wallet_id)
    now = int(time())
-
    await (conn or db).execute(
        # Timestamp placeholder is safe from SQL injection (not user input)
        f"""
@@ -65,7 +63,6 @@ async def delete_wallet(


 async def force_delete_wallet(wallet_id: str, conn: Connection | None = None) -> None:
-    clear_wallet_id_cache(wallet_id)
    await (conn or db).execute(
        "DELETE FROM wallets WHERE id = :wallet",
        {"wallet": wallet_id},
@@ -75,7 +72,6 @@ async def force_delete_wallet(wallet_id: str, conn: Connection | None = None) ->
 async def delete_wallet_by_id(
    wallet_id: str, conn: Connection | None = None
 ) -> int | None:
-    clear_wallet_id_cache(wallet_id)
    now = int(time())
    result = await (conn or db).execute(
        # Timestamp placeholder is safe from SQL injection (not user input)
@@ -226,14 +222,11 @@ async def get_wallet_for_key(
 ) -> Wallet | None:
    wallet = await (conn or db).fetchone(
        """
-        SELECT wallets.*, COALESCE((
+        SELECT *, COALESCE((
            SELECT balance FROM balances WHERE wallet_id = wallets.id
        ), 0)
        AS balance_msat FROM wallets
-        INNER JOIN accounts ON wallets.user = accounts.id
-        WHERE (adminkey = :key OR inkey = :key)
-            AND deleted = false
-            AND accounts.activated = true
+        WHERE (adminkey = :key OR inkey = :key) AND deleted = false
        """,
        {"key": key},
        Wallet,
@@ -247,27 +240,6 @@ async def get_wallet_for_key(
    return wallet


-async def get_base_wallet_for_key(
-    key: str,
-    conn: Connection | None = None,
-) -> BaseWallet | None:
-    wallet = await (conn or db).fetchone(
-        """
-        SELECT wallets.id, "user", wallet_type, adminkey, inkey FROM wallets
-        INNER JOIN accounts ON wallets.user = accounts.id
-        WHERE (adminkey = :key OR inkey = :key)
-            AND deleted = false
-            AND accounts.activated = true
-        """,
-        {"key": key},
-        BaseWallet,
-    )
-    if not wallet:
-        return None
-
-    return wallet
-
-
 async def get_source_wallet(
    wallet: Wallet, conn: Connection | None = None
 ) -> Wallet | None:
@@ -298,16 +270,3 @@ async def get_total_balance(conn: Connection | None = None):
    result = await (conn or db).execute("SELECT SUM(balance) as balance FROM balances")
    row = result.mappings().first()
    return row.get("balance", 0) or 0
-
-
-def clear_wallet_id_cache(wallet_id: str):
-    cached_wallet: BaseWallet | None = cache.pop(f"auth:wallet:{wallet_id}")
-    if cached_wallet:
-        cache.pop(f"auth:x-api-key:{cached_wallet.adminkey}")
-        cache.pop(f"auth:x-api-key:{cached_wallet.inkey}")
-
-
-def clear_wallet_cache(wallet: Wallet):
-    cache.pop(f"auth:wallet:{wallet.id}")
-    cache.pop(f"auth:x-api-key:{wallet.adminkey}")
-    cache.pop(f"auth:x-api-key:{wallet.inkey}")
@@ -15,8 +15,6 @@ from lnbits.core.crud import (
 from lnbits.core.db import db as core_db
 from lnbits.core.models import DbVersion
 from lnbits.core.models.extensions import InstallableExtension
-from lnbits.core.wasm_ext.storage.crud import migrate_wasm_extension_database
-from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
 from lnbits.db import COCKROACH, POSTGRES, SQLITE, Connection
 from lnbits.settings import settings

@@ -24,16 +22,7 @@ from lnbits.settings import settings
 async def migrate_extension_database(
    ext: InstallableExtension, current_version: DbVersion | None = None
 ):
-    if is_wasm_extension_id(ext.id):
-        await migrate_wasm_extension_database(ext, current_version)
-        return
-    else:
-        await migrate_py_extension_database(ext, current_version)

-
-async def migrate_py_extension_database(
-    ext: InstallableExtension, current_version: DbVersion | None = None
-):
    try:
        ext_migrations = importlib.import_module(f"{ext.module_name}.migrations")
        ext_db = importlib.import_module(ext.module_name).db
@@ -10,26 +10,31 @@ from lnbits.db import Connection


 async def m000_create_migrations_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
    CREATE TABLE IF NOT EXISTS dbversions (
        db TEXT PRIMARY KEY,
        version INT NOT NULL
    )
-    """)
+    """
+    )


 async def m001_initial(db: Connection):
    """
    Initial LNbits tables.
    """
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS accounts (
            id TEXT PRIMARY KEY,
            email TEXT,
            pass TEXT
        );
-    """)
-    await db.execute("""
+    """
+    )
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS extensions (
            "user" TEXT NOT NULL,
            extension TEXT NOT NULL,
@@ -37,8 +42,10 @@ async def m001_initial(db: Connection):

            UNIQUE ("user", extension)
        );
-    """)
-    await db.execute("""
+    """
+    )
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS wallets (
            id TEXT PRIMARY KEY,
            name TEXT NOT NULL,
@@ -46,8 +53,10 @@ async def m001_initial(db: Connection):
            adminkey TEXT NOT NULL,
            inkey TEXT
        );
-    """)
-    await db.execute(f"""
+    """
+    )
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS apipayments (
            payhash TEXT NOT NULL,
            amount {db.big_int} NOT NULL,
@@ -58,9 +67,11 @@ async def m001_initial(db: Connection):
            time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
            UNIQUE (wallet, payhash)
        );
-    """)
+    """
+    )

-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
            SELECT wallet, SUM(amount) AS s  -- incoming
@@ -74,7 +85,8 @@ async def m001_initial(db: Connection):
            GROUP BY wallet
        )x
        GROUP BY wallet;
-    """)
+    """
+    )


 async def m002_add_fields_to_apipayments(db: Connection):
@@ -137,7 +149,8 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
    """

    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
            SELECT wallet, SUM(amount) AS s  -- incoming
@@ -151,7 +164,8 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
            GROUP BY wallet
        )x
        GROUP BY wallet;
-    """)
+    """
+    )


 async def m005_balance_check_balance_notify(db: Connection):
@@ -160,7 +174,8 @@ async def m005_balance_check_balance_notify(db: Connection):
    LNbits wallet and of balanceNotify URLs supplied by users to empty their wallets.
    """

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS balance_check (
          wallet TEXT NOT NULL REFERENCES wallets (id),
          service TEXT NOT NULL,
@@ -168,16 +183,19 @@ async def m005_balance_check_balance_notify(db: Connection):

          UNIQUE(wallet, service)
        );
-    """)
+    """
+    )

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS balance_notify (
          wallet TEXT NOT NULL REFERENCES wallets (id),
          url TEXT NOT NULL,

          UNIQUE(wallet, url)
        );
-    """)
+    """
+    )


 async def m006_add_invoice_expiry_to_apipayments(db: Connection):
@@ -244,16 +262,19 @@ async def m007_set_invoice_expiries(db: Connection):


 async def m008_create_admin_settings_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS settings (
            super_user TEXT,
            editable_settings TEXT NOT NULL DEFAULT '{}'
        );
-    """)
+    """
+    )


 async def m009_create_tinyurl_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS tiny_url (
          id TEXT PRIMARY KEY,
          url TEXT,
@@ -261,11 +282,13 @@ async def m009_create_tinyurl_table(db: Connection):
          wallet TEXT,
          time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-    """)
+    """
+    )


 async def m010_create_installed_extensions_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS installed_extensions (
            id TEXT PRIMARY KEY,
            version TEXT NOT NULL,
@@ -276,7 +299,8 @@ async def m010_create_installed_extensions_table(db: Connection):
            active BOOLEAN DEFAULT false,
            meta TEXT NOT NULL DEFAULT '{}'
        );
-    """)
+    """
+    )


 async def m011_optimize_balances_view(db: Connection):
@@ -285,19 +309,23 @@ async def m011_optimize_balances_view(db: Connection):
    over the payments table instead of 2.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, SUM(amount - abs(fee)) AS balance
        FROM apipayments
        WHERE (pending = false AND amount > 0) OR amount < 0
        GROUP BY wallet
-    """)
+    """
+    )


 async def m012_add_currency_to_wallet(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN currency TEXT
-        """)
+        """
+    )


 async def m013_add_deleted_to_wallets(db: Connection):
@@ -317,13 +345,15 @@ async def m014_set_deleted_wallets(db: Connection):
    Sets deleted column to wallets.
    """
    try:
-        result = await db.execute("""
+        result = await db.execute(
+            """
            SELECT *
            FROM wallets
            WHERE user LIKE 'del:%'
            AND adminkey LIKE 'del:%'
            AND inkey LIKE 'del:%'
-            """)
+            """
+        )
        rows = result.mappings().all()

        for row in rows:
@@ -356,7 +386,8 @@ async def m014_set_deleted_wallets(db: Connection):


 async def m015_create_push_notification_subscriptions_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS webpush_subscriptions (
            endpoint TEXT NOT NULL,
            "user" TEXT NOT NULL,
@@ -365,7 +396,8 @@ async def m015_create_push_notification_subscriptions_table(db: Connection):
            timestamp TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
            PRIMARY KEY (endpoint, "user")
        );
-    """)
+    """
+    )


 async def m016_add_username_column_to_accounts(db: Connection):
@@ -452,7 +484,8 @@ async def m018_balances_view_exclude_deleted(db: Connection):
    Make deleted wallets not show up in the balances view.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -462,7 +495,8 @@ async def m018_balances_view_exclude_deleted(db: Connection):
              AND ((apipayments.pending = false AND apipayments.amount > 0)
              OR apipayments.amount < 0)
        GROUP BY wallet
-    """)
+    """
+    )


 async def m019_balances_view_based_on_wallets(db: Connection):
@@ -471,7 +505,8 @@ async def m019_balances_view_based_on_wallets(db: Connection):
    Important for querying whole lnbits balances.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -481,7 +516,8 @@ async def m019_balances_view_based_on_wallets(db: Connection):
              AND ((apipayments.pending = false AND apipayments.amount > 0)
              OR apipayments.amount < 0)
        GROUP BY apipayments.wallet
-    """)
+    """
+    )


 async def m020_add_column_column_to_user_extensions(db: Connection):
@@ -500,7 +536,8 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
    await db.execute("UPDATE apipayments SET status = 'success' WHERE NOT pending")

    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -512,7 +549,8 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
            OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
        )
        GROUP BY apipayments.wallet
-    """)
+    """
+    )


 async def m022_add_pubkey_to_accounts(db: Connection):
@@ -543,7 +581,8 @@ async def m024_drop_pending(db: Connection):

 async def m025_refresh_view(db: Connection):
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet_id,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -555,7 +594,8 @@ async def m025_refresh_view(db: Connection):
            OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
        )
        GROUP BY apipayments.wallet_id
-    """)
+    """
+    )


 async def m026_update_payment_table(db: Connection):
@@ -618,7 +658,8 @@ async def m027_update_apipayments_data(db: Connection):

 async def m028_update_settings(db: Connection):

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS system_settings (
            id TEXT PRIMARY KEY,
            value TEXT,
@@ -626,7 +667,8 @@ async def m028_update_settings(db: Connection):

            UNIQUE (id, tag)
        );
-    """)
+    """
+    )

    async def _insert_key_value(id_: str, value: Any):
        await db.execute(
@@ -649,7 +691,8 @@ async def m028_update_settings(db: Connection):


 async def m029_create_audit_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS audit (
            component TEXT,
            ip_address TEXT,
@@ -663,13 +706,16 @@ async def m029_create_audit_table(db: Connection):
            delete_at TIMESTAMP,
            created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-        """)
+        """
+    )


 async def m030_add_user_api_tokens_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE accounts ADD COLUMN access_control_list TEXT
-        """)
+        """
+    )


 async def m031_add_color_and_icon_to_wallets(db: Connection):
@@ -692,25 +738,32 @@ async def m033_update_payment_table(db: Connection):


 async def m034_add_stored_paylinks_to_wallet(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN stored_paylinks TEXT
-        """)
+        """
+    )


 async def m035_add_wallet_type_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN wallet_type TEXT DEFAULT 'lightning'
-        """)
+        """
+    )


 async def m036_add_shared_wallet_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN shared_wallet_id TEXT
-        """)
+        """
+    )


 async def m037_create_assets_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS assets (
            id TEXT PRIMARY KEY,
            user_id TEXT NOT NULL,
@@ -723,170 +776,13 @@ async def m037_create_assets_table(db: Connection):
            data {db.blob} NOT NULL,
            created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-        """)
+        """
+    )


 async def m038_add_labels_for_payments(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE apipayments ADD COLUMN labels TEXT
-        """)
-
-
-async def m039_index_payments(db: Connection):
-    indexes = [
-        "wallet_id",
-        "checking_id",
-        "payment_hash",
-        "amount",
-        "fee",
-        "labels",
-        "time",
-        "status",
-        "memo",
-        "created_at",
-        "updated_at",
-    ]
-    for index in indexes:
-        logger.debug(f"Creating index idx_payments_{index}...")
-        await db.execute(f"""
-            CREATE INDEX IF NOT EXISTS idx_payments_{index} ON apipayments ({index});
-            """)
-
-
-async def m040_index_wallets(db: Connection):
-    indexes = [
-        "id",
-        "user",
-        "deleted",
-        "adminkey",
-        "inkey",
-        "wallet_type",
-        "created_at",
-        "updated_at",
-    ]
-
-    for index in indexes:
-        logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(f"""
-            CREATE INDEX IF NOT EXISTS idx_wallets_{index} ON wallets ("{index}");
-            """)
-
-
-async def m042_index_accounts(db: Connection):
-    indexes = [
-        "id",
-        "email",
-        "username",
-        "pubkey",
-        "external_id",
-    ]
-
-    for index in indexes:
-        logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(f"""
-            CREATE INDEX IF NOT EXISTS idx_accounts_{index} ON accounts ("{index}");
-            """)
-
-
-async def m043_add_ui_customization_to_accounts(db: Connection):
-    """
-    Adds ui_customization column to accounts.
-    Used for server side persistence of UI customization settings.
-    """
-    await db.execute("ALTER TABLE accounts ADD COLUMN ui_customization TEXT")
-
-
-async def m044_add_activated_to_accounts(db: Connection):
-    """
-    Adds activated column to accounts.
-    Used for account activation status.
-    """
-    await db.execute("ALTER TABLE accounts ADD COLUMN activated BOOLEAN DEFAULT true")
-
-
-async def m045_add_external_id_to_payments(db: Connection):
-    """
-    Adds external_id column to apipayments.
-    Used for external payment references.
-    """
-    await db.execute("ALTER TABLE apipayments ADD COLUMN external_id TEXT")
-    logger.debug("Creating index idx_payments_external_id...")
-    await db.execute("""
-        CREATE INDEX IF NOT EXISTS idx_payments_external_id
-        ON apipayments (external_id);
-        """)
-
-
-async def m046_add_permissions_to_installed_extensions(db: Connection):
-    """
-    Adds granted permissions to installed extensions.
-    """
-    await db.execute(
-        "ALTER TABLE installed_extensions ADD COLUMN permissions TEXT DEFAULT '[]'"
+        """
    )
-
-
-async def m047_create_wasm_invocations_table(db: Connection):
-    """
-    Tracks WASM extension invocations for runtime monitoring and controls.
-    """
-    await db.execute(f"""
-        CREATE TABLE IF NOT EXISTS wasm_invocations (
-            id TEXT PRIMARY KEY,
-            extension_id TEXT NOT NULL,
-            export_name TEXT NOT NULL,
-            trigger_type TEXT NOT NULL DEFAULT 'unknown',
-            status TEXT NOT NULL DEFAULT 'running',
-            started_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
-            finished_at TIMESTAMP,
-            duration_ms INT,
-            user_id TEXT,
-            wallet_id TEXT,
-            request_id TEXT,
-            method TEXT,
-            path TEXT,
-            event_type TEXT,
-            payment_hash TEXT,
-            checking_id TEXT,
-            memory_peak_bytes INT,
-            request_bytes INT,
-            response_bytes INT,
-            host_call_count INT NOT NULL DEFAULT 0,
-            http_call_count INT NOT NULL DEFAULT 0,
-            storage_call_count INT NOT NULL DEFAULT 0,
-            wallet_call_count INT NOT NULL DEFAULT 0,
-            error_type TEXT,
-            error_message TEXT,
-            stop_reason TEXT,
-            "context" TEXT NOT NULL DEFAULT '{{}}'
-        );
-        """)
-    await db.execute("""
-        CREATE INDEX IF NOT EXISTS idx_wasm_invocations_extension_started
-        ON wasm_invocations (extension_id, started_at);
-        """)
-    await db.execute("""
-        CREATE INDEX IF NOT EXISTS idx_wasm_invocations_status
-        ON wasm_invocations (status);
-        """)
-    await db.execute("""
-        CREATE INDEX IF NOT EXISTS idx_wasm_invocations_started
-        ON wasm_invocations (started_at);
-        """)
-
-
-async def m048_add_wasm_runtime_limits_to_installed_extensions(db: Connection):
-    """
-    Adds per-extension WASM runtime limit overrides.
-    """
-    await db.execute(
-        "ALTER TABLE installed_extensions "
-        "ADD COLUMN wasm_runtime_limits TEXT DEFAULT '{}'"
-    )
-
-
-async def m049_add_permissions_to_user_extensions(db: Connection):
-    """
-    Adds user-level extension permission grants.
-    """
-    await db.execute("ALTER TABLE extensions ADD COLUMN permissions TEXT DEFAULT '{}'")
@@ -25,7 +25,6 @@ from .payments import (
    PaymentState,
    PaymentWalletStats,
    SettleInvoice,
-    UpdatePaymentExtra,
 )
 from .tinyurl import TinyURL
 from .users import (
@@ -47,7 +46,7 @@ from .users import (
    UserAcls,
    UserExtra,
 )
-from .wallets import CreateWallet, KeyType, Wallet, WalletInfo, WalletTypeInfo
+from .wallets import BaseWallet, CreateWallet, KeyType, Wallet, WalletTypeInfo
 from .webpush import CreateWebPushSubscription, WebPushSubscription

 __all__ = [
@@ -58,6 +57,7 @@ __all__ = [
    "AuditEntry",
    "AuditFilters",
    "BalanceDelta",
+    "BaseWallet",
    "Callback",
    "CancelInvoice",
    "ConversionData",
@@ -91,7 +91,6 @@ __all__ = [
    "SimpleStatus",
    "TinyURL",
    "UpdateBalance",
-    "UpdatePaymentExtra",
    "UpdateSuperuserPassword",
    "UpdateUser",
    "UpdateUserPassword",
@@ -100,7 +99,6 @@ __all__ = [
    "UserAcls",
    "UserExtra",
    "Wallet",
-    "WalletInfo",
    "WalletTypeInfo",
    "WebPushSubscription",
 ]
@@ -6,16 +6,12 @@ import json
 import os
 import shutil
 import zipfile
-from collections.abc import Mapping
-from datetime import datetime, timezone
-from enum import Enum
-from pathlib import Path, PurePosixPath
+from pathlib import Path
 from typing import Any
-from uuid import uuid4

 import httpx
 from loguru import logger
-from pydantic import BaseModel, Field, StrictStr
+from pydantic import BaseModel

 from lnbits.helpers import (
    download_url,
@@ -24,8 +20,6 @@ from lnbits.helpers import (
    version_parse,
 )
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
-from lnbits.utils.cache import cache


 class ExplicitRelease(BaseModel):
@@ -59,10 +53,9 @@ class GitHubRelease(BaseModel):


 class Manifest(BaseModel):
+    featured: list[str] = []
    extensions: list[ExplicitRelease] = []
    repos: list[GitHubRelease] = []
-    featured: list[str] = []
-    categories: dict[str, list[str]] = {}


 class GitHubRepoRelease(BaseModel):
@@ -81,23 +74,6 @@ class GitHubRepo(BaseModel):
    default_branch: str


-class ExtensionPermission(BaseModel):
-    id: StrictStr
-    description: StrictStr | None = None
-    policies: list[Any] | None = None
-
-    class Config:
-        extra = "ignore"
-
-    @staticmethod
-    def list_from_config(config_json: Mapping[str, Any]) -> list[ExtensionPermission]:
-        return [
-            ExtensionPermission.parse_obj(permission)
-            for permission in config_json.get("permissions") or []
-            if isinstance(permission, dict) and permission.get("id")
-        ]
-
-
 class ExtensionConfig(BaseModel):
    name: str
    short_description: str
@@ -105,8 +81,6 @@ class ExtensionConfig(BaseModel):
    warning: str | None = ""
    min_lnbits_version: str | None
    max_lnbits_version: str | None
-    extension_type: str | None = None
-    permissions: list[ExtensionPermission] = []

    def is_version_compatible(self) -> bool:
        return is_lnbits_version_ok(self.min_lnbits_version, self.max_lnbits_version)
@@ -141,83 +115,11 @@ class UserExtensionInfo(BaseModel):
    payment_hash_to_enable: str | None = None


-class ExtensionBackgroundPaymentDestinationPolicy(str, Enum):
-    OWN_WALLETS_ONLY = "own_wallets_only"
-    EXTERNAL_ALLOWED = "external_allowed"
-
-
-class ExtensionBackgroundPaymentGrant(BaseModel):
-    id: StrictStr = Field(..., min_length=1, max_length=128)
-    wallet_id: str = Field(..., min_length=1, max_length=128)
-    enabled: bool = True
-    max_amount: int = Field(..., gt=0)
-    destination_policy: ExtensionBackgroundPaymentDestinationPolicy
-
-
-class ExtensionBackgroundPaymentGrantRequest(BaseModel):
-    wallet_id: str = Field(..., min_length=1, max_length=128)
-    max_amount: int = Field(..., gt=0)
-    destination_policy: ExtensionBackgroundPaymentDestinationPolicy
-
-    def to_grant(self, grant_id: str | None = None) -> ExtensionBackgroundPaymentGrant:
-        return ExtensionBackgroundPaymentGrant(
-            id=grant_id or str(uuid4()),
-            wallet_id=self.wallet_id,
-            enabled=True,
-            max_amount=self.max_amount,
-            destination_policy=self.destination_policy,
-        )
-
-
-class ExtensionWalletPaymentsWatchGrant(BaseModel):
-    id: StrictStr = Field(..., min_length=1, max_length=128)
-    wallet_id: str = Field(..., min_length=1, max_length=128)
-    enabled: bool = True
-
-
-class ExtensionWalletPaymentsWatchGrantRequest(BaseModel):
-    wallet_id: str = Field(..., min_length=1, max_length=128)
-
-    def to_grant(
-        self, grant_id: str | None = None
-    ) -> ExtensionWalletPaymentsWatchGrant:
-        return ExtensionWalletPaymentsWatchGrant(
-            id=grant_id or str(uuid4()),
-            wallet_id=self.wallet_id,
-            enabled=True,
-        )
-
-
-class ExtensionPermissionCheckItem(BaseModel):
-    id: StrictStr
-    grant: dict[str, Any] = Field(default_factory=dict)
-
-
-class ExtensionPermissionCheckRequest(BaseModel):
-    permissions: list[ExtensionPermissionCheckItem] = Field(default_factory=list)
-
-
-class ExtensionPermissionCheckResult(BaseModel):
-    id: StrictStr
-    approved: bool
-    grant: dict[str, Any] = Field(default_factory=dict)
-
-
-class ExtensionPermissionCheckResponse(BaseModel):
-    permissions: list[ExtensionPermissionCheckResult] = Field(default_factory=list)
-
-
-class ExtensionPermissionsResponse(BaseModel):
-    extension_permissions: list[ExtensionPermission] = Field(default_factory=list)
-    user_permissions: dict[str, list[dict[str, Any]]] = Field(default_factory=dict)
-
-
 class UserExtension(BaseModel):
    user: str
    extension: str
    active: bool
    extra: UserExtensionInfo | None = None
-    permissions: dict = Field(default_factory=dict)

    @property
    def is_paid(self) -> bool:
@@ -239,7 +141,6 @@ class UserExtension(BaseModel):
 class Extension(BaseModel):
    code: str
    is_valid: bool
-    is_wasm: bool = False
    name: str | None = None
    short_description: str | None = None
    tile: str | None = None
@@ -256,8 +157,6 @@ class Extension(BaseModel):

    @property
    def is_upgrade_extension(self) -> bool:
-        if self.is_wasm:
-            return False
        return self.upgrade_hash != ""

    @classmethod
@@ -265,71 +164,13 @@ class Extension(BaseModel):
        return Extension(
            code=ext_info.id,
            is_valid=True,
-            is_wasm=ext_info.is_wasm,
            name=ext_info.name,
            short_description=ext_info.short_description,
-            tile=_extension_tile(ext_info),
+            tile=ext_info.icon,
            upgrade_hash=ext_info.hash if ext_info.ext_upgrade_dir.is_dir() else "",
        )


-class WasmInvocation(BaseModel):
-    id: str
-    extension_id: str
-    export_name: str
-    trigger_type: str = "unknown"
-    status: str = "running"
-    started_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
-    finished_at: datetime | None = None
-    duration_ms: int | None = None
-    user_id: str | None = None
-    wallet_id: str | None = None
-    request_id: str | None = None
-    method: str | None = None
-    path: str | None = None
-    event_type: str | None = None
-    payment_hash: str | None = None
-    checking_id: str | None = None
-    memory_peak_bytes: int | None = None
-    request_bytes: int | None = None
-    response_bytes: int | None = None
-    host_call_count: int = 0
-    http_call_count: int = 0
-    storage_call_count: int = 0
-    wallet_call_count: int = 0
-    error_type: str | None = None
-    error_message: str | None = None
-    stop_reason: str | None = None
-    context: dict = Field(default_factory=dict)
-
-
-class WasmInvocationStats(BaseModel):
-    total: int = 0
-    running: int = 0
-    completed: int = 0
-    failed: int = 0
-    stopped: int = 0
-    timeout: int = 0
-    avg_duration_ms: float = 0
-    max_duration_ms: int = 0
-    host_call_count: int = 0
-    http_call_count: int = 0
-    storage_call_count: int = 0
-    wallet_call_count: int = 0
-
-
-class WasmRuntimeLimitsUpdate(BaseModel):
-    limits: dict[str, Any] = Field(default_factory=dict)
-
-
-class WasmRuntimeLimitsInfo(BaseModel):
-    id: str
-    name: str
-    active: bool | None = False
-    wasm_runtime_limits: dict[str, int] = Field(default_factory=dict)
-    effective_wasm_runtime_limits: dict[str, int] = Field(default_factory=dict)
-
-
 class ExtensionRelease(BaseModel):
    name: str
    version: str
@@ -426,30 +267,10 @@ class ExtensionRelease(BaseModel):
    async def get_github_releases(cls, org: str, repo: str) -> list[ExtensionRelease]:
        try:
            github_releases = await cls.fetch_github_releases(org, repo)
-            extension_releases = [
+            return [
                ExtensionRelease.from_github_release(f"{org}/{repo}", r)
                for r in github_releases
            ]
-            for release in extension_releases:
-                if not release.details_link:
-                    continue
-                try:
-                    config = await ExtensionConfig.fetch_github_release_config(
-                        org, repo, release.version
-                    )
-                except Exception as e:
-                    logger.warning(e)
-                    config = None
-                if not config:
-                    continue
-
-                release.min_lnbits_version = config.min_lnbits_version
-                release.max_lnbits_version = config.max_lnbits_version
-                release.is_version_compatible = config.is_version_compatible()
-
-                release.icon = icon_to_github_url(f"{org}/{repo}", config.tile)
-
-            return extension_releases
        except Exception as e:
            logger.warning(e)
            return []
@@ -465,6 +286,7 @@ class ExtensionRelease(BaseModel):

    @classmethod
    async def fetch_release_details(cls, details_link: str) -> dict | None:
+
        try:
            async with httpx.AsyncClient() as client:
                resp = await client.get(details_link)
@@ -489,7 +311,6 @@ class ExtensionMeta(BaseModel):
    dependencies: list[str] = []
    archive: str | None = None
    featured: bool = False
-    categories: list[str] = []
    paid_features: str | None = None
    has_paid_release: bool = False
    has_free_release: bool = False
@@ -504,8 +325,6 @@ class InstallableExtension(BaseModel):
    icon: str | None = None
    stars: int = 0
    meta: ExtensionMeta | None = None
-    permissions: list[ExtensionPermission] = []
-    wasm_runtime_limits: dict = Field(default_factory=dict, no_database=True)

    @property
    def hash(self) -> str:
@@ -558,18 +377,6 @@ class InstallableExtension(BaseModel):
            return False
        return self.meta.pay_to_enable.required is True

-    @property
-    def is_wasm(self) -> bool:
-        config_path = Path(self.ext_dir, "config.json")
-        if not config_path.is_file():
-            return False
-        try:
-            with open(config_path, encoding="utf-8") as json_file:
-                config_json = json.load(json_file)
-        except Exception:
-            return False
-        return config_json.get("extension_type") == "wasm"
-
    async def download_archive(self):
        logger.info(f"Downloading extension {self.name} ({self.installed_version}).")
        ext_zip_file = self.zip_path
@@ -602,22 +409,6 @@ class InstallableExtension(BaseModel):
                os.remove(ext_zip_file)
            raise AssertionError("File hash missmatch. Will not install.")

-    def load_archive_config(self) -> dict[str, Any]:
-        if not self.zip_path.is_file():
-            return {}
-
-        try:
-            with zipfile.ZipFile(self.zip_path, "r") as archive:
-                config_name = _archive_config_name(archive.namelist())
-                if not config_name:
-                    return {}
-                with archive.open(config_name) as config_file:
-                    config = json.load(config_file)
-        except Exception as exc:
-            raise ValueError(f"Cannot read extension config for '{self.id}'.") from exc
-
-        return config if isinstance(config, dict) else {}
-
    def extract_archive(self):
        logger.info(f"Extracting extension {self.name} ({self.installed_version}).")
        Path(settings.lnbits_extensions_upgrade_path).mkdir(parents=True, exist_ok=True)
@@ -796,7 +587,6 @@ class InstallableExtension(BaseModel):
                    version=version,
                    short_description=config_json.get("short_description"),
                    icon=config_json.get("tile"),
-                    permissions=ExtensionPermission.list_from_config(config_json),
                    meta=ExtensionMeta(
                        installed_release=ExtensionRelease(
                            name=ext_id,
@@ -816,40 +606,6 @@ class InstallableExtension(BaseModel):

    @classmethod
    async def get_installable_extensions(
-        cls, post_refresh_cache: bool = False
-    ) -> list[InstallableExtension]:
-        extension_list: list[InstallableExtension] = []
-
-        cache_key = "extensions:installable"
-        cache_value = cache.value(cache_key)
-        if not cache_value:
-            extension_list = await cls._get_installable_extensions()
-            cache.set(cache_key, extension_list, expiry=3600)  # one hour
-            return extension_list
-
-        if cache_value.older_than(10 * 60) or post_refresh_cache:
-            # refresh cache in background if older than 10 minutes or requested
-            task_manager.create_task(
-                cls._refresh_installable_extensions_cache(),
-                "refresh_installable_extensions_cache",
-            )
-
-        extension_list = cache_value.value  # type: ignore
-        return extension_list
-
-    @classmethod
-    async def _refresh_installable_extensions_cache(
-        cls,
-    ) -> None:
-        cache_key = "extensions:installable"
-        extension_list: list[InstallableExtension] = (
-            await cls._get_installable_extensions()
-        )
-
-        cache.set(cache_key, extension_list, expiry=3600)
-
-    @classmethod
-    async def _get_installable_extensions(
        cls,
    ) -> list[InstallableExtension]:
        extension_list: list[InstallableExtension] = []
@@ -871,11 +627,6 @@ class InstallableExtension(BaseModel):

                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
-                    meta.categories = [
-                        category
-                        for category, ext_ids in manifest.categories.items()
-                        if ext.id in ext_ids
-                    ]
                    ext.meta = meta
                    extension_list += [ext]

@@ -891,11 +642,6 @@ class InstallableExtension(BaseModel):
                    ext.check_release_updates(release)
                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
-                    meta.categories = [
-                        category
-                        for category, ext_ids in manifest.categories.items()
-                        if ext.id in ext_ids
-                    ]
                    ext.meta = meta
                    extension_list += [ext]
            except Exception as e:
@@ -990,7 +736,6 @@ class CreateExtension(BaseModel):
    version: str
    cost_sats: int | None = 0
    payment_hash: str | None = None
-    permissions: list[ExtensionPermission] = []


 class ExtensionDetailsRequest(BaseModel):
@@ -999,32 +744,6 @@ class ExtensionDetailsRequest(BaseModel):
    version: str


-class ExtensionReviewsStatus(BaseModel):
-    tag: str
-    avg_rating: float
-    review_count: int
-
-
-class CreateExtensionReview(BaseModel):
-    tag: str
-    name: str | None = Field(None)
-    rating: int = Field(..., ge=0, le=1000)
-    comment: str | None = Field(None)
-
-
-class ExtensionReviewPaymentRequest(BaseModel):
-    payment_hash: str
-    payment_request: str
-
-
-class ExtensionReview(BaseModel):
-    id: str
-    name: str | None = Field(default=None)
-    tag: str | None = Field(default=None)
-    rating: int = Field(default=0, ge=0, le=1000)
-    comment: str | None = Field(default=None)
-
-
 async def github_api_get(url: str, error_msg: str | None) -> Any:
    headers = {"User-Agent": settings.user_agent}
    if settings.lnbits_ext_github_token:
@@ -1043,21 +762,3 @@ def icon_to_github_url(source_repo: str, path: str | None) -> str:
    _, _, *rest = path.split("/")
    tail = "/".join(rest)
    return f"https://github.com/{source_repo}/raw/main/{tail}"
-
-
-def wasm_extension_icon_url(ext_id: str) -> str:
-    return f"/ext-assets/{ext_id}/assets/icon.png"
-
-
-def _extension_tile(ext_info: InstallableExtension) -> str | None:
-    if ext_info.is_wasm:
-        return wasm_extension_icon_url(ext_info.id)
-    return ext_info.icon
-
-
-def _archive_config_name(names: list[str]) -> str | None:
-    for name in names:
-        path = PurePosixPath(name)
-        if len(path.parts) == 2 and path.name == "config.json":
-            return name
-    return None
@@ -1,8 +1,6 @@
 from __future__ import annotations

 import json
-import random
-import uuid
 from datetime import datetime, timedelta, timezone
 from typing import Any, Literal

@@ -57,29 +55,6 @@ class DataField(BaseModel):
            field_type += ' = "sat"'
        return f"{field_name}: {field_type}"

-    def field_to_random_value(self) -> str:
-        field_name = camel_to_snake(self.name)
-        field_value: Any = f'"{self.type}"'
-        if self.type == "json":
-            field_value = '"{}"'
-        elif self.type == "wallet":
-            field_value = f'"{uuid.uuid4()}"'
-        elif self.type == "currency":
-            field_value = '"sat"'
-        elif self.type in ["str", "text"]:
-            field_value = f'"{field_name}_{urlsafe_short_hash()}"'
-        elif self.type == "int":
-            field_value = random.randint(1, 100)  # noqa: S311
-        elif self.type == "float":
-            field_value = random.uniform(1.0, 100.0)  # noqa: S311
-        elif self.type == "bool":
-            field_value = random.choice([True, False])  # noqa: S311
-        elif self.type == "datetime":
-            random_days = random.randint(-30, 30)  # noqa: S311
-            random_date = datetime.now(timezone.utc) - timedelta(days=random_days)
-            field_value = f"""datetime.fromisoformat("{random_date.isoformat()}")"""
-        return f"{field_name} = {field_value},"
-
    def field_to_js(self) -> str:
        field_name = camel_to_snake(self.name)
        default_value = "null"
@@ -1,8 +1,6 @@
 from __future__ import annotations

 from collections.abc import Callable
-from pathlib import Path
-from typing import Any

 from pydantic import BaseModel

@@ -13,41 +11,8 @@ def _do_nothing(*_):

 class CoreAppExtra:
    register_new_ext_routes: Callable = _do_nothing
-    register_new_wasm_ext_routes: Callable = _do_nothing
    register_new_ratelimiter: Callable

-    def __init__(self) -> None:
-        self.wasm_extension_registry = WasmExtensionRegistry()
-
-
-class WasmExtensionRegistry:
-    def __init__(self) -> None:
-        self._extensions: dict[str, Any] = {}
-
-    def register(self, extension: Any) -> None:
-        self.require_available(extension)
-        self._extensions[extension.id] = extension
-
-    def require_available(self, extension: Any) -> None:
-        existing = self._extensions.get(extension.id)
-        if existing and not _same_wasm_extension_registration(existing, extension):
-            raise ValueError(
-                f"WASM extension id '{extension.id}' is already registered."
-            )
-
-    def get(self, ext_id: str) -> Any | None:
-        return self._extensions.get(ext_id)
-
-    def list(self) -> list[Any]:
-        return list(self._extensions.values())
-
-
-def _same_wasm_extension_registration(left: Any, right: Any) -> bool:
-    try:
-        return Path(left.root_path).resolve() == Path(right.root_path).resolve()
-    except (AttributeError, TypeError):
-        return left is right
-

 class ConversionData(BaseModel):
    from_: str = "sat"
@@ -6,17 +6,23 @@ from typing import Literal

 from fastapi import Query
 from lnurl import LnurlWithdrawResponse
-from loguru import logger
 from pydantic import BaseModel, Field, validator

 from lnbits.db import FilterModel
+from lnbits.fiat import get_fiat_provider
 from lnbits.fiat.base import (
+    FiatPaymentFailedStatus,
+    FiatPaymentPendingStatus,
    FiatPaymentStatus,
+    FiatPaymentSuccessStatus,
 )
-from lnbits.helpers import is_valid_external_id
 from lnbits.utils.exchange_rates import allowed_currencies
+from lnbits.wallets import get_funding_source
 from lnbits.wallets.base import (
+    PaymentFailedStatus,
+    PaymentPendingStatus,
    PaymentStatus,
+    PaymentSuccessStatus,
 )


@@ -35,11 +41,6 @@ class PaymentExtra(BaseModel):
    lnurl_response: str | None = None


-class UpdatePaymentExtra(BaseModel):
-    payment_hash: str
-    extra: dict = Field(default_factory=dict)
-
-
 class PayInvoice(BaseModel):
    payment_request: str
    description: str | None = None
@@ -54,17 +55,11 @@ class CreatePayment(BaseModel):
    amount_msat: int
    memo: str
    extra: dict | None = {}
-    extension: str | None = None
    preimage: str | None = None
    expiry: datetime | None = None
    webhook: str | None = None
    fee: int = 0
    labels: list[str] | None = None
-    external_id: str | None = None
-
-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)


 class Payment(BaseModel):
@@ -89,11 +84,6 @@ class Payment(BaseModel):
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    labels: list[str] = []
    extra: dict = {}
-    external_id: str | None = None
-
-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)

    def __init__(self, **data):
        super().__init__(**data)
@@ -140,19 +130,59 @@ class Payment(BaseModel):
            "fiat_"
        )

-    # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_status(self) -> PaymentStatus:
-        logger.warning("payment.check_status() is deprecated.")
-        from lnbits.core.services.payments import check_payment_status
+    async def check_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> PaymentStatus:
+        if self.is_internal:
+            if self.success:
+                return PaymentSuccessStatus()
+            if self.failed:
+                return PaymentFailedStatus()
+            if self.is_in and self.fiat_provider:
+                fiat_status = await self.check_fiat_status(
+                    skip_internal_payment_notifications
+                )
+                return PaymentStatus(paid=fiat_status.paid)
+            return PaymentPendingStatus()
+        funding_source = get_funding_source()
+        if self.is_out:
+            status = await funding_source.get_payment_status(self.checking_id)
+        else:
+            status = await funding_source.get_invoice_status(self.checking_id)
+        return status

-        return await check_payment_status(self)
+    async def check_fiat_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> FiatPaymentStatus:
+        if not self.is_internal:
+            return FiatPaymentPendingStatus()
+        if self.success:
+            return FiatPaymentSuccessStatus()
+        if self.failed:
+            return FiatPaymentFailedStatus()

-    # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_fiat_status(self) -> FiatPaymentStatus:
-        logger.warning("payment.check_fiat_status() is deprecated.")
-        from lnbits.core.services.fiat_providers import check_fiat_status
+        if not self.fiat_provider:
+            return FiatPaymentPendingStatus()

-        return await check_fiat_status(self)
+        checking_id = self.extra.get("fiat_checking_id")
+        if not checking_id:
+            return FiatPaymentPendingStatus()
+
+        fiat_provider = await get_fiat_provider(self.fiat_provider)
+        if not fiat_provider:
+            return FiatPaymentPendingStatus()
+        fiat_status = await fiat_provider.get_invoice_status(checking_id)
+
+        if skip_internal_payment_notifications:
+            return fiat_status
+
+        if fiat_status.success:
+            # notify receivers asynchronously
+            from lnbits.tasks import internal_invoice_queue
+
+            await internal_invoice_queue.put(self.checking_id)
+
+        return fiat_status


 class PaymentFilters(FilterModel):
@@ -164,24 +194,13 @@ class PaymentFilters(FilterModel):
        "status",
        "time",
        "labels",
-        "external_id",
    ]

-    __sort_fields__ = [
-        "created_at",
-        "updated_at",
-        "amount",
-        "fee",
-        "memo",
-        "time",
-        "tag",
-        "external_id",
-    ]
+    __sort_fields__ = ["created_at", "amount", "fee", "memo", "time", "tag"]

    status: str | None
    tag: str | None
    checking_id: str | None
-    external_id: str | None
    amount: int
    fee: int
    memo: str | None
@@ -260,13 +279,11 @@ class CreateInvoice(BaseModel):
    )
    expiry: int | None = None
    extra: dict | None = None
-    extension: str | None = None
    webhook: str | None = None
    bolt11: str | None = None
    lnurl_withdraw: LnurlWithdrawResponse | None = None
    fiat_provider: str | None = None
    labels: list[str] = []
-    external_id: str | None = Query(default=None, max_length=256)

    @validator("payment_hash")
    def check_hex(cls, v):
@@ -281,10 +298,6 @@ class CreateInvoice(BaseModel):
            raise ValueError("The provided unit is not supported")
        return v

-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)
-

 class PaymentsStatusCount(BaseModel):
    incoming: int = 0
@@ -323,12 +336,3 @@ class CancelInvoice(BaseModel):

 class UpdatePaymentLabels(BaseModel):
    labels: list[str] = []
-
-
-def _validate_external_id(external_id: str | None) -> str | None:
-    if external_id and not is_valid_external_id(external_id):
-        raise ValueError(
-            "Invalid external id. Max length is 256 characters. "
-            "Space and newlines are not allowed."
-        )
-    return external_id
@@ -1 +0,0 @@
-"""SSO authentication providers for LNbits"""
@@ -1,36 +0,0 @@
-"""Generic OIDC SSO Login Helper"""
-
-from typing import Optional
-
-import httpx
-from fastapi_sso.sso.base import DiscoveryDocument, OpenID, SSOBase
-
-
-class OidcSSO(SSOBase):
-    """Class providing login via Generic OIDC OAuth (e.g., Zitadel, Authentik, etc.)"""
-
-    provider = "oidc"
-    scope = ["openid", "email", "profile"]
-    discovery_url = ""
-
-    async def openid_from_response(
-        self, response: dict, session: Optional["httpx.AsyncClient"] = None
-    ) -> OpenID:
-        """Return OpenID from user information provided by OIDC provider"""
-        return OpenID(
-            email=response.get("email", ""),
-            provider=self.provider,
-            id=response.get("sub"),
-            first_name=response.get("given_name"),
-            last_name=response.get("family_name"),
-            display_name=response.get("name") or response.get("preferred_username"),
-            picture=response.get("picture"),
-        )
-
-    async def get_discovery_document(self) -> DiscoveryDocument:
-        """Get document containing handy urls"""
-        async with httpx.AsyncClient() as session:
-            response = await session.get(self.discovery_url)
-            content = response.json()
-
-            return content
@@ -1,6 +1,4 @@
-from datetime import datetime, timezone
-
-from pydantic import BaseModel, Field
+from pydantic import BaseModel


 class TinyURL(BaseModel):
@@ -8,4 +6,4 @@ class TinyURL(BaseModel):
    url: str
    endless: bool
    wallet: str
-    time: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+    time: float
@@ -172,23 +172,14 @@ class UserAcls(BaseModel):
        return None


-class AccountId(BaseModel):
+class Account(BaseModel):
    id: str
-
-    @property
-    def is_admin_id(self) -> bool:
-        return settings.is_admin_user(self.id)
-
-
-class Account(AccountId):
-    activated: bool = True
    external_id: str | None = None  # for external account linking
    username: str | None = None
    password_hash: str | None = None
    pubkey: str | None = None
    email: str | None = None
    extra: UserExtra = UserExtra()
-    ui_customization: dict = Field(default_factory=dict)

    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
@@ -203,10 +194,6 @@ class Account(AccountId):
        self.is_admin = settings.is_admin_user(self.id)
        self.fiat_providers = settings.get_fiat_providers_for_user(self.id)

-    @property
-    def has_password(self) -> bool:
-        return self.password_hash is not None
-
    def hash_password(self, password: str) -> str:
        """sets and returns the hashed password"""
        salt = gensalt()
@@ -242,7 +229,6 @@ class Account(AccountId):


 class AccountOverview(Account):
-    activated: bool = True
    transaction_count: int | None = 0
    wallet_count: int | None = 0
    balance_msat: int | None = 0
@@ -278,7 +264,6 @@ class AccountFilters(FilterModel):

 class User(BaseModel):
    id: str
-    activated: bool = True
    created_at: datetime
    updated_at: datetime
    email: str | None = None
@@ -292,7 +277,6 @@ class User(BaseModel):
    fiat_providers: list[str] = []
    has_password: bool = False
    extra: UserExtra = UserExtra()
-    ui_customization: dict = Field(default_factory=dict)

    @property
    def wallet_ids(self) -> list[str]:
@@ -318,7 +302,6 @@ class RegisterUser(BaseModel):
    username: str = Query(default=..., min_length=2, max_length=20)
    password: str = Query(default=..., min_length=8, max_length=50)
    password_repeat: str = Query(default=..., min_length=8, max_length=50)
-    invitation_code: str | None = Query(default=None, max_length=256)


 class CreateUser(BaseModel):
@@ -362,7 +345,6 @@ class UpdateSuperuserPassword(BaseModel):
    username: str = Query(default=..., min_length=2, max_length=20)
    password: str = Query(default=..., min_length=8, max_length=50)
    password_repeat: str = Query(default=..., min_length=8, max_length=50)
-    first_install_token: str | None = Query(None)


 class LoginUsr(BaseModel):
@@ -11,7 +11,7 @@ from lnbits.db import FilterModel
 from lnbits.settings import settings


-class WalletInfo(BaseModel):
+class BaseWallet(BaseModel):
    id: str
    name: str
    adminkey: str
@@ -110,16 +110,13 @@ class WalletExtra(BaseModel):
        ]


-class BaseWallet(BaseModel):
+class Wallet(BaseModel):
    id: str
    user: str
-    wallet_type: str = WalletType.LIGHTNING.value
+    name: str
    adminkey: str
    inkey: str
-
-
-class Wallet(BaseWallet):
-    name: str
+    wallet_type: str = WalletType.LIGHTNING.value
    # Must be set only for shared wallets
    shared_wallet_id: str | None = None
    deleted: bool = False
@@ -233,12 +230,6 @@ class WalletTypeInfo:
    wallet: Wallet


-@dataclass
-class BaseWalletTypeInfo:
-    key_type: KeyType
-    wallet: BaseWallet
-
-
 class WalletsFilters(FilterModel):
    __search_fields__ = ["id", "name", "currency"]

@@ -1,4 +1,3 @@
-from .fiat_providers import check_fiat_status
 from .funding_source import (
    get_balance_delta,
    switch_to_voidwallet,
@@ -8,7 +7,6 @@ from .notifications import enqueue_admin_notification, send_payment_notification
 from .payments import (
    calculate_fiat_amounts,
    cancel_hold_invoice,
-    check_payment_status,
    check_transaction_status,
    check_wallet_limits,
    create_fiat_invoice,
@@ -42,8 +40,6 @@ __all__ = [
    "calculate_fiat_amounts",
    "cancel_hold_invoice",
    "check_admin_settings",
-    "check_fiat_status",
-    "check_payment_status",
    "check_transaction_status",
    "check_wallet_limits",
    "check_webpush_settings",
@@ -1,62 +1,22 @@
 import base64
 import io
-from urllib.parse import quote
 from uuid import uuid4

-import filetype
 from fastapi import UploadFile
-from loguru import logger
 from PIL import Image

 from lnbits.core.crud.assets import create_asset, get_user_assets_count
 from lnbits.core.models.assets import Asset
 from lnbits.settings import settings

-IMAGE_MIME_TYPE_ALIASES = {
-    "heic": "image/heic",
-    "heics": "image/heics",
-    "heif": "image/heif",
-    "image/jpg": "image/jpeg",
-    "jpeg": "image/jpeg",
-    "jpg": "image/jpeg",
-    "png": "image/png",
-}
-PIL_IMAGE_FORMAT_MIME_TYPES = {
-    "JPEG": "image/jpeg",
-    "PNG": "image/png",
-}
-INLINE_ASSET_MIME_TYPES = {
-    "image/heic",
-    "image/heics",
-    "image/heif",
-    "image/jpeg",
-    "image/png",
-}
-ASSET_SECURITY_HEADERS = {
-    "X-Content-Type-Options": "nosniff",
-    "Content-Security-Policy": (
-        "sandbox; default-src 'none'; script-src 'none'; "
-        "object-src 'none'; base-uri 'none'"
-    ),
-}
-THUMBNAIL_FORMAT_MIME_TYPES = {
-    "jpg": "image/jpeg",
-    "jpeg": "image/jpeg",
-    "png": "image/png",
-}
-

 async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) -> Asset:
    if not file.content_type:
        raise ValueError("File must have a content type.")
-
-    content_type = normalize_asset_mime_type(file.content_type)
-    filename = file.filename or "unnamed"
-
-    if content_type not in allowed_asset_mime_types():
+    if file.content_type.lower() not in settings.lnbits_assets_allowed_mime_types:
        raise ValueError(f"File type '{file.content_type}' not allowed.")

-    if not settings.is_unlimited_assets_user(user_id):
+    if user_id not in settings.lnbits_assets_no_limit_users:
        user_assets_count = await get_user_assets_count(user_id)
        if user_assets_count >= settings.lnbits_max_assets_per_user:
            raise ValueError(
@@ -69,126 +29,28 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
            f"File limit of {settings.lnbits_max_asset_size_mb}MB exceeded."
        )

-    stored_mime_type = detect_image_mime_type(contents)
-    if stored_mime_type != content_type:
-        logger.warning(
-            "Image MIME type mismatch: declared={}, detected={}",
-            content_type,
-            stored_mime_type,
-        )
-        raise ValueError(
-            "Image file content does not match declared file type. "
-            f"Declared: '{content_type}', detected: '{stored_mime_type}'."
-        )
+    image = Image.open(io.BytesIO(contents))

-    thumb_buffer = thumbnail_from_bytes(contents)
+    thumbnail_width = min(256, settings.lnbits_asset_thumbnail_width)
+    thumbnail_height = min(256, settings.lnbits_asset_thumbnail_height)
+    image.thumbnail((thumbnail_width, thumbnail_height))
+
+    # Save thumbnail to an in-memory buffer
+    thumb_buffer = io.BytesIO()
+    thumbnail_format = settings.lnbits_asset_thumbnail_format or "PNG"
+    image.save(thumb_buffer, format=thumbnail_format)
+    thumb_buffer.seek(0)

    asset = Asset(
        id=uuid4().hex,
        user_id=user_id,
-        mime_type=stored_mime_type,
+        mime_type=file.content_type,
        is_public=is_public,
-        name=filename,
+        name=file.filename or "unnamed",
        size_bytes=len(contents),
-        thumbnail_base64=(
-            base64.b64encode(thumb_buffer.getvalue()).decode("utf-8")
-            if thumb_buffer
-            else None
-        ),
+        thumbnail_base64=base64.b64encode(thumb_buffer.getvalue()).decode("utf-8"),
        data=contents,
    )

    await create_asset(asset)
    return asset
-
-
-def normalize_asset_mime_type(content_type: str) -> str:
-    content_type = content_type.split(";", 1)[0].strip().lower()
-    return IMAGE_MIME_TYPE_ALIASES.get(content_type, content_type)
-
-
-def normalize_media_type(media_type: str) -> str:
-    return media_type.split(";", 1)[0].strip().lower() or "application/octet-stream"
-
-
-def thumbnail_media_type() -> str:
-    thumbnail_format = (settings.lnbits_asset_thumbnail_format or "png").strip().lower()
-    return THUMBNAIL_FORMAT_MIME_TYPES.get(thumbnail_format, "application/octet-stream")
-
-
-def content_disposition(disposition: str, filename: str) -> str:
-    safe_filename = filename or "unnamed"
-    quoted_filename = quote(safe_filename, safe="")
-    if quoted_filename == safe_filename:
-        return f'{disposition}; filename="{safe_filename}"'
-    return f"{disposition}; filename*=utf-8''{quoted_filename}"
-
-
-def allowed_asset_mime_types() -> set[str]:
-    return {
-        mime_type
-        for mime_type in (
-            normalize_asset_mime_type(mime_type)
-            for mime_type in settings.lnbits_assets_allowed_mime_types
-        )
-        if mime_type.startswith("image/")
-    }
-
-
-def detect_image_mime_type(contents: bytes) -> str:
-    kind = filetype.guess(contents)
-    mime_type = normalize_asset_mime_type(kind.mime) if kind else None
-
-    if mime_type and mime_type in PIL_IMAGE_FORMAT_MIME_TYPES.values():
-        verify_pil_image(contents, mime_type)
-        return mime_type
-
-    if mime_type and mime_type.startswith("image/"):
-        return mime_type
-
-    try:
-        with Image.open(io.BytesIO(contents)) as image:
-            image.verify()
-            mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
-    except Exception as exc:
-        raise ValueError(
-            "Image file content does not match declared file type."
-        ) from exc
-
-    if not mime_type:
-        raise ValueError("Image file content does not match declared file type.")
-
-    return mime_type
-
-
-def verify_pil_image(contents: bytes, mime_type: str) -> None:
-    try:
-        with Image.open(io.BytesIO(contents)) as image:
-            image.verify()
-            detected_mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
-    except Exception as exc:
-        raise ValueError(
-            "Image file content does not match declared file type."
-        ) from exc
-
-    if detected_mime_type != mime_type:
-        raise ValueError("Image file content does not match declared file type.")
-
-
-def thumbnail_from_bytes(contents: bytes) -> io.BytesIO | None:
-    try:
-        image = Image.open(io.BytesIO(contents))
-
-        thumbnail_width = min(256, settings.lnbits_asset_thumbnail_width)
-        thumbnail_height = min(256, settings.lnbits_asset_thumbnail_height)
-        image.thumbnail((thumbnail_width, thumbnail_height))
-
-        # Save thumbnail to an in-memory buffer
-        thumb_buffer = io.BytesIO()
-        thumbnail_format = settings.lnbits_asset_thumbnail_format or "PNG"
-        image.save(thumb_buffer, format=thumbnail_format)
-        thumb_buffer.seek(0)
-        return thumb_buffer
-    except Exception as exc:
-        logger.warning(f"Failed to create thumbnail: {exc}")
-        return None
@@ -1,12 +1,5 @@
 import asyncio
 import importlib
-import re
-from collections.abc import Mapping
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from threading import RLock
-from typing import Any
-from uuid import uuid4

 from loguru import logger

@@ -16,177 +9,20 @@ from lnbits.core.crud import (
    delete_installed_extension,
    get_db_version,
    get_installed_extension,
-    get_installed_extensions_count,
    update_installed_extension_state,
 )
 from lnbits.core.crud.extensions import (
-    create_wasm_invocation,
-    delete_old_wasm_invocations,
    get_installed_extensions,
-    get_wasm_invocation,
-    mark_stale_wasm_invocations,
    update_installed_extension,
-    update_installed_extension_wasm_runtime_limits,
-    update_wasm_invocation,
-)
-from lnbits.core.crud.extensions import (
-    get_wasm_invocation_stats as get_wasm_invocation_stats_crud,
-)
-from lnbits.core.crud.extensions import (
-    get_wasm_invocations as get_wasm_invocations_crud,
 )
 from lnbits.core.helpers import migrate_extension_database
-from lnbits.core.wasm_ext.api.permissions import validate_wasm_extension_permissions
-from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
-from lnbits.db import Connection
-from lnbits.settings import WasmRuntimeLimits, settings
+from lnbits.settings import settings

-from ..models.extensions import (
-    Extension,
-    ExtensionMeta,
-    ExtensionPermission,
-    InstallableExtension,
-    WasmInvocation,
-    WasmInvocationStats,
-)
-
-_WASM_INVOCATION_CLEANUP_INTERVAL = timedelta(hours=1)
-WASM_RUNTIME_LIMIT_FIELDS = tuple(WasmRuntimeLimits.__fields__.keys())
-
-
-@dataclass
-class WasmInvocationHandle:
-    invocation: WasmInvocation
-    engine: Any | None = None
-    store: Any | None = None
-    runtime_limits: dict[str, int] | None = None
-    stop_requested: bool = False
-    stop_reason: str | None = None
-
-
-_wasm_invocation_lock = RLock()
-_wasm_invocation_ready_lock = asyncio.Lock()
-_wasm_invocation_handles: dict[str, WasmInvocationHandle] = {}
-_wasm_invocations_marked_stale = False
-_wasm_invocations_last_cleanup_at: datetime | None = None
-
-
-def wasm_runtime_limit_defaults() -> dict[str, int]:
-    return {field: int(getattr(settings, field)) for field in WASM_RUNTIME_LIMIT_FIELDS}
-
-
-def validate_wasm_runtime_limit_overrides(
-    limits: Mapping[str, Any] | None,
-    *,
-    strict: bool = True,
-) -> dict[str, int]:
-    if not limits:
-        return {}
-
-    validated: dict[str, int] = {}
-    for field, raw_value in limits.items():
-        if field not in WASM_RUNTIME_LIMIT_FIELDS:
-            if strict:
-                raise ValueError(f"Unknown WASM runtime limit field '{field}'.")
-            continue
-
-        value = _validate_wasm_runtime_limit_value(field, raw_value, strict=strict)
-        if value is None:
-            continue
-        validated[field] = value
-
-    return validated
-
-
-def _validate_wasm_runtime_limit_value(
-    field: str,
-    raw_value: Any,
-    *,
-    strict: bool,
-) -> int | None:
-    if raw_value is None or raw_value == "":
-        return None
-    if isinstance(raw_value, bool):
-        return _invalid_wasm_runtime_limit(field, strict, "must be an integer")
-    if isinstance(raw_value, str):
-        raw_value = raw_value.strip()
-        if raw_value == "":
-            return None
-        if not raw_value.isdecimal():
-            return _invalid_wasm_runtime_limit(field, strict, "must be an integer")
-    if isinstance(raw_value, float) and not raw_value.is_integer():
-        return _invalid_wasm_runtime_limit(field, strict, "must be an integer")
-
-    try:
-        value = int(raw_value)
-    except (TypeError, ValueError) as exc:
-        return _invalid_wasm_runtime_limit(
-            field,
-            strict,
-            "must be an integer",
-            exc=exc,
-        )
-    if value < 0:
-        return _invalid_wasm_runtime_limit(field, strict, "cannot be negative")
-    return value
-
-
-def _invalid_wasm_runtime_limit(
-    field: str,
-    strict: bool,
-    message: str,
-    *,
-    exc: Exception | None = None,
-) -> int | None:
-    if not strict:
-        return None
-    error = ValueError(f"WASM runtime limit '{field}' {message}.")
-    if exc:
-        raise error from exc
-    raise error
-
-
-def resolve_wasm_runtime_limits(
-    installed_extension: InstallableExtension | None = None,
-) -> dict[str, int]:
-    limits = wasm_runtime_limit_defaults()
-    if installed_extension:
-        limits.update(
-            validate_wasm_runtime_limit_overrides(
-                installed_extension.wasm_runtime_limits,
-                strict=False,
-            )
-        )
-    return limits
-
-
-async def get_wasm_runtime_limits_for_extension(ext_id: str) -> dict[str, int]:
-    installed_extension = await get_installed_extension(ext_id)
-    return resolve_wasm_runtime_limits(installed_extension)
-
-
-async def update_wasm_extension_runtime_limits(
-    ext_id: str,
-    limits: Mapping[str, Any] | None,
-) -> dict[str, int]:
-    installed_extension = await get_installed_extension(ext_id)
-    if not installed_extension:
-        raise ValueError(f"Extension '{ext_id}' is not installed.")
-    if not installed_extension.is_wasm:
-        raise ValueError(f"Extension '{ext_id}' is not a WASM extension.")
-
-    validated_limits = validate_wasm_runtime_limit_overrides(limits)
-    await update_installed_extension_wasm_runtime_limits(
-        ext_id=ext_id,
-        limits=validated_limits,
-    )
-    return validated_limits
+from ..models.extensions import Extension, ExtensionMeta, InstallableExtension


 async def install_extension(
-    ext_info: InstallableExtension,
-    skip_download: bool | None = False,
-    granted_permissions: list[ExtensionPermission] | None = None,
+    ext_info: InstallableExtension, skip_download: bool | None = False
 ) -> Extension:

    ext_info.meta = ext_info.meta or ExtensionMeta()
@@ -200,19 +36,10 @@ async def install_extension(
    installed_ext = await get_installed_extension(ext_info.id)
    if installed_ext and installed_ext.meta:
        ext_info.meta.payments = installed_ext.meta.payments
-    if installed_ext:
-        ext_info.wasm_runtime_limits = installed_ext.wasm_runtime_limits
-
-    await check_extensions_limit(installed_ext)

    if not skip_download:
        await ext_info.download_archive()

-    extension_config = ext_info.load_archive_config()
-    ext_info.permissions = validate_wasm_extension_permissions(
-        ext_info, granted_permissions, extension_config
-    )
-
    ext_info.extract_archive()

    db_version = await get_db_version(ext_info.id)
@@ -230,409 +57,11 @@ async def install_extension(
        # call stop while the old routes are still active
        await stop_extension_background_work(ext_info.id)

-    if not extension.is_wasm:
-        await start_extension_background_work(ext_info.id)
+    await start_extension_background_work(ext_info.id)

    return extension


-async def check_extensions_limit(installed_ext: InstallableExtension | None = None):
-    if settings.lnbits_max_extensions == 0 or installed_ext:
-        return
-
-    extensions_count = await get_installed_extensions_count()
-    if extensions_count >= settings.lnbits_max_extensions:
-        raise ValueError("Max amount of extensions have been installed")
-
-
-async def ensure_wasm_invocation_monitoring_ready() -> None:
-    global _wasm_invocations_last_cleanup_at, _wasm_invocations_marked_stale
-
-    async with _wasm_invocation_ready_lock:
-        now = _now()
-        if not _wasm_invocations_marked_stale:
-            await mark_stale_wasm_invocations()
-            _wasm_invocations_marked_stale = True
-
-        if (
-            _wasm_invocations_last_cleanup_at is None
-            or now - _wasm_invocations_last_cleanup_at
-            >= _WASM_INVOCATION_CLEANUP_INTERVAL
-        ):
-            _wasm_invocations_last_cleanup_at = now
-            await delete_old_wasm_invocations(
-                settings.lnbits_wasm_invocation_retention_days
-            )
-
-
-async def start_wasm_invocation(
-    *,
-    extension_id: str,
-    export_name: str,
-    trigger_type: str = "unknown",
-    user_id: str | None = None,
-    wallet_id: str | None = None,
-    request_id: str | None = None,
-    method: str | None = None,
-    path: str | None = None,
-    event_type: str | None = None,
-    payment_hash: str | None = None,
-    checking_id: str | None = None,
-    request_bytes: int | None = None,
-    context: dict | None = None,
-    runtime_limits: dict[str, int] | None = None,
-) -> WasmInvocation:
-    await ensure_wasm_invocation_monitoring_ready()
-    _check_wasm_invocation_concurrency(
-        extension_id=extension_id,
-        user_id=user_id,
-        limits=runtime_limits,
-    )
-
-    invocation = WasmInvocation(
-        id=uuid4().hex,
-        extension_id=extension_id,
-        export_name=export_name,
-        trigger_type=trigger_type,
-        user_id=user_id,
-        wallet_id=wallet_id,
-        request_id=request_id,
-        method=method,
-        path=path,
-        event_type=event_type,
-        payment_hash=payment_hash,
-        checking_id=checking_id,
-        request_bytes=request_bytes,
-        context=_safe_wasm_invocation_context(context or {}),
-    )
-    await create_wasm_invocation(invocation)
-
-    with _wasm_invocation_lock:
-        _wasm_invocation_handles[invocation.id] = WasmInvocationHandle(
-            invocation,
-            runtime_limits=runtime_limits,
-        )
-
-    return invocation
-
-
-def attach_wasm_invocation_runtime(
-    invocation_id: str,
-    *,
-    engine: Any,
-    store: Any,
-) -> None:
-    with _wasm_invocation_lock:
-        handle = _wasm_invocation_handles.get(invocation_id)
-        if not handle:
-            return
-        handle.engine = engine
-        handle.store = store
-        if handle.stop_requested:
-            _interrupt_wasm_invocation(handle)
-
-
-def record_wasm_invocation_host_call(
-    invocation_id: str | None,
-    method_id: str,
-) -> None:
-    if not invocation_id:
-        return
-
-    with _wasm_invocation_lock:
-        handle = _wasm_invocation_handles.get(invocation_id)
-        if not handle:
-            return
-
-        invocation = handle.invocation
-        invocation.host_call_count += 1
-        category = _wasm_host_call_category(method_id)
-        if category == "http":
-            invocation.http_call_count += 1
-        elif category == "storage":
-            invocation.storage_call_count += 1
-        elif category == "wallet":
-            invocation.wallet_call_count += 1
-
-        _check_wasm_host_call_limit(invocation, category, handle.runtime_limits)
-
-
-async def stop_wasm_invocation(
-    invocation_id: str,
-    *,
-    reason: str = "Stopped by admin.",
-) -> bool:
-    interrupted = False
-    with _wasm_invocation_lock:
-        handle = _wasm_invocation_handles.get(invocation_id)
-        if handle:
-            handle.stop_requested = True
-            handle.stop_reason = reason
-            handle.invocation.stop_reason = reason
-            interrupted = _interrupt_wasm_invocation(handle)
-
-    invocation = await get_wasm_invocation(invocation_id)
-    if invocation and invocation.status == "running":
-        invocation.stop_reason = reason
-        await update_wasm_invocation(invocation)
-
-    return interrupted
-
-
-async def stop_wasm_extension_invocations(
-    extension_id: str,
-    *,
-    reason: str = "Extension deactivated.",
-) -> int:
-    with _wasm_invocation_lock:
-        invocation_ids = [
-            invocation_id
-            for invocation_id, handle in _wasm_invocation_handles.items()
-            if handle.invocation.extension_id == extension_id
-        ]
-
-    for invocation_id in invocation_ids:
-        await stop_wasm_invocation(invocation_id, reason=reason)
-
-    return len(invocation_ids)
-
-
-def wasm_invocation_stop_requested(invocation_id: str) -> bool:
-    with _wasm_invocation_lock:
-        handle = _wasm_invocation_handles.get(invocation_id)
-        return bool(handle and handle.stop_requested)
-
-
-def get_wasm_invocation_stop_reason(invocation_id: str) -> str | None:
-    with _wasm_invocation_lock:
-        handle = _wasm_invocation_handles.get(invocation_id)
-        return handle.stop_reason if handle else None
-
-
-async def finish_wasm_invocation(
-    invocation_id: str,
-    *,
-    status: str,
-    response_bytes: int | None = None,
-    memory_peak_bytes: int | None = None,
-    error_type: str | None = None,
-    error_message: str | None = None,
-    stop_reason: str | None = None,
-) -> None:
-    with _wasm_invocation_lock:
-        handle = _wasm_invocation_handles.pop(invocation_id, None)
-
-    invocation = (
-        handle.invocation if handle else await get_wasm_invocation(invocation_id)
-    )
-    if not invocation:
-        return
-
-    reason = stop_reason or (handle.stop_reason if handle else None)
-    if handle and handle.stop_requested and status == "failed":
-        status = "stopped"
-        reason = reason or "Stopped by admin."
-
-    finished_at = _now()
-    invocation.status = status
-    invocation.finished_at = finished_at
-    invocation.duration_ms = max(
-        0, int((finished_at - invocation.started_at).total_seconds() * 1000)
-    )
-    invocation.response_bytes = response_bytes
-    invocation.memory_peak_bytes = memory_peak_bytes
-    invocation.error_type = error_type
-    invocation.error_message = _safe_wasm_error_message(error_message)
-    invocation.stop_reason = reason
-
-    await update_wasm_invocation(invocation)
-
-
-def get_current_wasm_invocations(
-    extension_id: str | None = None,
-) -> list[WasmInvocation]:
-    with _wasm_invocation_lock:
-        invocations = []
-        for handle in _wasm_invocation_handles.values():
-            if extension_id and handle.invocation.extension_id != extension_id:
-                continue
-            invocation = handle.invocation.copy(deep=True)
-            if handle.stop_requested and invocation.status == "running":
-                invocation.status = "stopping"
-                invocation.stop_reason = handle.stop_reason
-            invocations.append(invocation)
-
-    return sorted(
-        invocations, key=lambda invocation: invocation.started_at, reverse=True
-    )
-
-
-def _check_wasm_invocation_concurrency(
-    *,
-    extension_id: str,
-    user_id: str | None,
-    limits: dict[str, int] | None,
-) -> None:
-    if not limits:
-        return
-
-    with _wasm_invocation_lock:
-        handles = list(_wasm_invocation_handles.values())
-        if _wasm_limit_exceeded(
-            limits["wasm_runtime_max_concurrent_invocations"],
-            len(handles) + 1,
-        ):
-            raise ValueError("WASM runtime has too many active invocations.")
-
-        extension_invocations = sum(
-            1 for handle in handles if handle.invocation.extension_id == extension_id
-        )
-        if _wasm_limit_exceeded(
-            limits["wasm_runtime_max_concurrent_invocations_per_extension"],
-            extension_invocations + 1,
-        ):
-            raise ValueError(
-                f"WASM extension '{extension_id}' has too many active invocations."
-            )
-
-        if not user_id:
-            return
-
-        user_invocations = sum(
-            1 for handle in handles if handle.invocation.user_id == user_id
-        )
-        if _wasm_limit_exceeded(
-            limits["wasm_runtime_max_concurrent_invocations_per_user"],
-            user_invocations + 1,
-        ):
-            raise ValueError("WASM user has too many active invocations.")
-
-
-def _check_wasm_host_call_limit(
-    invocation: WasmInvocation,
-    category: str,
-    limits: dict[str, int] | None,
-) -> None:
-    if not limits:
-        return
-
-    if _wasm_limit_exceeded(
-        limits["wasm_runtime_max_host_calls"],
-        invocation.host_call_count,
-    ):
-        raise ValueError("WASM host call limit exceeded.")
-
-    category_limits = {
-        "http": (
-            limits["wasm_runtime_max_http_calls"],
-            invocation.http_call_count,
-        ),
-        "storage": (
-            limits["wasm_runtime_max_storage_calls"],
-            invocation.storage_call_count,
-        ),
-        "wallet": (
-            limits["wasm_runtime_max_wallet_calls"],
-            invocation.wallet_call_count,
-        ),
-    }
-    category_limit = category_limits.get(category)
-    if category_limit and _wasm_limit_exceeded(*category_limit):
-        raise ValueError(f"WASM {category} host call limit exceeded.")
-
-
-def _wasm_limit_exceeded(limit: int, value: int) -> bool:
-    return limit > 0 and value > limit
-
-
-async def get_wasm_invocation_history(
-    *,
-    extension_id: str | None = None,
-    status: str | None = None,
-    limit: int = 100,
-    offset: int = 0,
-) -> list[WasmInvocation]:
-    await ensure_wasm_invocation_monitoring_ready()
-    return await get_wasm_invocations_crud(
-        extension_id=extension_id,
-        status=status,
-        limit=limit,
-        offset=offset,
-    )
-
-
-async def get_wasm_invocation_summary(
-    *,
-    extension_id: str | None = None,
-    hours: int = 24,
-) -> WasmInvocationStats:
-    await ensure_wasm_invocation_monitoring_ready()
-    since = _now() - timedelta(hours=max(1, min(hours, 24 * 30)))
-    return await get_wasm_invocation_stats_crud(
-        extension_id=extension_id,
-        since=since,
-    )
-
-
-def _interrupt_wasm_invocation(handle: WasmInvocationHandle) -> bool:
-    if not handle.store or not handle.engine:
-        return False
-    try:
-        handle.store.set_epoch_deadline(1)
-        handle.engine.increment_epoch()
-        return True
-    except Exception as exc:
-        logger.warning(
-            f"Failed to interrupt WASM invocation '{handle.invocation.id}': {exc}"
-        )
-        return False
-
-
-def _wasm_host_call_category(method_id: str) -> str:
-    if method_id.startswith("http.") or method_id.startswith("extension.api."):
-        return "http"
-    if method_id.startswith("storage."):
-        return "storage"
-    if method_id.startswith("wallet."):
-        return "wallet"
-    return "host"
-
-
-def _safe_wasm_invocation_context(context: dict) -> dict:
-    safe_context: dict = {}
-    for key, value in context.items():
-        if not isinstance(key, str):
-            continue
-        if value is None or isinstance(value, (bool, int, float)):
-            safe_context[key[:64]] = value
-        elif isinstance(value, str):
-            safe_context[key[:64]] = value[:256]
-    return safe_context
-
-
-def _safe_wasm_error_message(message: str | None) -> str | None:
-    if not message:
-        return None
-
-    safe_message = message[:500]
-    redactions = [
-        (
-            r"(?i)(api[-_ ]?key|token|authorization|password|secret|preimage)"
-            r"\s*[:=]\s*[^\s,;]+",
-            r"\1=[redacted]",
-        ),
-        (r"(?i)bearer\s+[A-Za-z0-9._~+/=-]+", "Bearer [redacted]"),
-        (r"\b[a-fA-F0-9]{64}\b", "[redacted-hex]"),
-    ]
-    for pattern, replacement in redactions:
-        safe_message = re.sub(pattern, replacement, safe_message)
-    return safe_message
-
-
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
 async def uninstall_extension(ext_id: str):
    await stop_extension_background_work(ext_id)

@@ -645,19 +74,12 @@ async def uninstall_extension(ext_id: str):


 async def activate_extension(ext: Extension):
-    if ext.is_wasm:
-        core_app_extra.register_new_wasm_ext_routes(ext.code)
-        await update_installed_extension_state(ext_id=ext.code, active=True)
-        return
-
    core_app_extra.register_new_ext_routes(ext)
    await update_installed_extension_state(ext_id=ext.code, active=True)
    await start_extension_background_work(ext.code)


 async def deactivate_extension(ext_id: str):
-    if is_wasm_extension_id(ext_id):
-        await stop_wasm_extension_invocations(ext_id, reason="Extension deactivated.")
    settings.deactivate_extension_paths(ext_id)
    await update_installed_extension_state(ext_id=ext_id, active=False)
    await stop_extension_background_work(ext_id)
@@ -668,9 +90,6 @@ async def stop_extension_background_work(ext_id: str) -> bool:
    Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
    Extension must expose a `myextension_stop()` function if it is starting tasks.
    """
-    if is_wasm_extension_id(ext_id):
-        return True
-
    upgrade_hash = settings.extension_upgrade_hash(ext_id)
    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)

@@ -703,9 +122,6 @@ async def start_extension_background_work(ext_id: str) -> bool:
    Extension CAN expose a `myextension_start()` function if it is starting tasks.
    Extension MUST expose a `myextension_stop()` in that case.
    """
-    if is_wasm_extension_id(ext_id):
-        return False
-
    upgrade_hash = settings.extension_upgrade_hash(ext_id)
    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)

@@ -733,9 +149,9 @@ async def start_extension_background_work(ext_id: str) -> bool:


 async def get_valid_extensions(
-    include_deactivated: bool | None = True, conn: Connection | None = None
+    include_deactivated: bool | None = True,
 ) -> list[Extension]:
-    installed_extensions = await get_installed_extensions(conn=conn)
+    installed_extensions = await get_installed_extensions()
    valid_extensions = [Extension.from_installable_ext(e) for e in installed_extensions]

    if include_deactivated:
@@ -20,7 +20,6 @@ from lnbits.helpers import (
    camel_to_words,
    download_url,
    lowercase_first_letter,
-    snake_to_camel,
 )
 from lnbits.settings import settings

@@ -196,29 +195,13 @@ def _copy_ext_stub_to_build_dir(
    ext_build_dir = Path(working_dir, new_ext_id, working_dir_name, new_ext_id)
    shutil.rmtree(ext_build_dir, True)

-    shutil.copytree(
-        ext_stub_cache_dir,
-        ext_build_dir,
-        ignore=shutil.ignore_patterns(
-            "__pycache__",
-            ".git",
-            ".env",
-            ".venv",
-            "*.env",
-            "*.log",
-            "node_modules",
-            ".mypy_cache",
-            ".pytest_cache",
-            ".ruff_cache",
-        ),
-    )
+    shutil.copytree(ext_stub_cache_dir, ext_build_dir)
    return ext_build_dir


 def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None:
    parsed_data = _parse_extension_data(data)
-    test_files = [f"tests/{p.name}" for p in Path(ext_stub_dir, "tests").glob("*.py")]
-    for py_file in py_files + test_files:
+    for py_file in py_files:
        template_path = Path(ext_stub_dir, py_file).as_posix()
        rederer = _render_file(template_path, parsed_data)
        with open(template_path, "w", encoding="utf-8") as f:
@@ -226,7 +209,7 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None

        _remove_lines_with_string(template_path, remove_line_marker)

-    template_path = Path(ext_stub_dir, "static", "index.js").as_posix()
+    template_path = Path(ext_stub_dir, "static", "js", "index.js").as_posix()
    rederer = _render_file(
        template_path, {"preview": data.preview_action, **parsed_data}
    )
@@ -251,7 +234,9 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
        "settingsFormDialog.data",
        ext_stub_dir,
    )
-    template_path = Path(ext_stub_dir, "static", "index.vue").as_posix()
+    template_path = Path(
+        ext_stub_dir, "templates", "extension_builder_stub", "index.html"
+    ).as_posix()
    rederer = _render_file(
        template_path,
        {
@@ -278,12 +263,12 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
        "publicClientData",
        ext_stub_dir,
    )
-    public_template_path = Path(ext_stub_dir, "static", "public_page.vue")
-    public_component_path = Path(ext_stub_dir, "static", "public_page.js")
+    public_template_path = Path(
+        ext_stub_dir, "templates", "extension_builder_stub", "public_page.html"
+    )
    template_path = public_template_path.as_posix()
    if not data.public_page.has_public_page:
        public_template_path.unlink(missing_ok=True)
-        public_component_path.unlink(missing_ok=True)
    else:
        rederer = _render_file(
            template_path,
@@ -323,10 +308,8 @@ def zip_directory(source_dir, zip_path):

 def _rename_extension_builder_stub(data: ExtensionData, extension_dir: Path) -> None:
    extension_dir_path = extension_dir.as_posix()
-    # the order of fields is important, do not chage
    rename_values = {
        "extension_builder_stub_name": data.name,
-        "extension_builder_stub_camel_name": snake_to_camel(data.id, True),
        "extension_builder_stub_short_description": data.short_description or "",
        "extension_builder_stub": data.id,
        "OwnerData": data.owner_data.name,
@@ -345,7 +328,7 @@ def _rename_extension_builder_stub(data: ExtensionData, extension_dir: Path) ->
            directory=extension_dir_path,
            old_text=old_text,
            new_text=new_text,
-            file_extensions=[".py", ".js", ".vue", ".html", ".md", ".json", ".toml"],
+            file_extensions=[".py", ".js", ".html", ".md", ".json", ".toml"],
        )

    _rename_files_and_dirs_in_directory(
@@ -423,7 +406,6 @@ def _parse_extension_data(data: ExtensionData) -> dict:
        "owner_data": {
            "name": data.owner_data.name,
            "editable": data.owner_data.editable,
-            "fields": [field.name for field in data.owner_data.fields],
            "js_fields": [
                field.field_to_js()
                for field in data.owner_data.fields
@@ -450,18 +432,6 @@ def _parse_extension_data(data: ExtensionData) -> dict:
            ],
            "db_fields": [field.field_to_db() for field in data.owner_data.fields],
            "all_fields": [field.field_to_py() for field in data.owner_data.fields],
-            "random_fields_values": [
-                field.field_to_random_value() for field in data.owner_data.fields
-            ],
-            "public_fields": [
-                field.field_to_py()
-                for field in data.owner_data.fields
-                if field.name
-                in [
-                    data.public_page.owner_data_fields.name,
-                    data.public_page.owner_data_fields.description,
-                ]
-            ],
        },
        "client_data": {
            "name": data.client_data.name,
@@ -487,9 +457,6 @@ def _parse_extension_data(data: ExtensionData) -> dict:
            ],
            "db_fields": [field.field_to_db() for field in data.client_data.fields],
            "all_fields": [field.field_to_py() for field in data.client_data.fields],
-            "random_fields_values": [
-                field.field_to_random_value() for field in data.client_data.fields
-            ],
        },
        "settings_data": {
            "enabled": data.settings_data.enabled,
@@ -569,7 +536,7 @@ def _rename_files_and_dirs_in_directory(directory, old_text, new_text):
                    logger.warning(f"Failed to rename directory {old_dir_path}: {e}")


-def _is_excluded_dir(path: str) -> bool:
+def _is_excluded_dir(path):
    for excluded_dir in excluded_dirs:
        if path.startswith(excluded_dir):
            return True
@@ -1,26 +1,16 @@
 import hashlib
 import hmac
-import json
 import time
-from base64 import b64encode

-import httpx
 from loguru import logger

 from lnbits.core.crud import get_wallet
-from lnbits.core.crud.payments import create_payment, update_payment
+from lnbits.core.crud.payments import create_payment
 from lnbits.core.models import CreatePayment, Payment, PaymentState
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.db import Connection
 from lnbits.fiat import get_fiat_provider
-from lnbits.fiat.base import (
-    FiatPaymentFailedStatus,
-    FiatPaymentPendingStatus,
-    FiatPaymentStatus,
-    FiatPaymentSuccessStatus,
-)
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager


 async def handle_fiat_payment_confirmation(
@@ -37,35 +27,6 @@ async def handle_fiat_payment_confirmation(
        logger.warning(e)


-async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
-    if not payment.is_internal:
-        return FiatPaymentPendingStatus()
-    if payment.success:
-        return FiatPaymentSuccessStatus()
-    if payment.failed:
-        return FiatPaymentFailedStatus()
-
-    if not payment.fiat_provider:
-        return FiatPaymentPendingStatus()
-
-    checking_id = payment.extra.get("fiat_checking_id")
-    if not checking_id:
-        return FiatPaymentPendingStatus()
-
-    fiat_provider = await get_fiat_provider(payment.fiat_provider)
-    if not fiat_provider:
-        return FiatPaymentPendingStatus()
-    fiat_status = await fiat_provider.get_invoice_status(checking_id)
-
-    if fiat_status.success:
-        payment.status = PaymentState.SUCCESS.value
-        await update_payment(payment)
-        await handle_fiat_payment_confirmation(payment)
-        task_manager.internal_invoice_queue.put_nowait(payment)
-
-    return fiat_status
-
-
 def check_stripe_signature(
    payload: bytes,
    sig_header: str | None,
@@ -109,139 +70,6 @@ def check_stripe_signature(
        raise ValueError("Stripe signature verification failed.")


-async def verify_paypal_webhook(headers, payload: bytes):
-    """
-    Validate PayPal webhook signatures using the PayPal verify API.
-    """
-    webhook_id = settings.paypal_webhook_id
-    if not webhook_id:
-        logger.warning("PayPal webhook ID not set.")
-        raise ValueError("PayPal webhook cannot be verified. Missing webhook ID.")
-
-    required_headers = {
-        "PAYPAL-TRANSMISSION-ID": headers.get("PAYPAL-TRANSMISSION-ID"),
-        "PAYPAL-TRANSMISSION-TIME": headers.get("PAYPAL-TRANSMISSION-TIME"),
-        "PAYPAL-TRANSMISSION-SIG": headers.get("PAYPAL-TRANSMISSION-SIG"),
-        "PAYPAL-CERT-URL": headers.get("PAYPAL-CERT-URL"),
-        "PAYPAL-AUTH-ALGO": headers.get("PAYPAL-AUTH-ALGO"),
-    }
-    if not all(required_headers.values()):
-        logger.warning("Missing PayPal webhook headers.")
-        raise ValueError("PayPal webhook cannot be verified. Missing headers.")
-
-    try:
-        async with httpx.AsyncClient(base_url=settings.paypal_api_endpoint) as client:
-            token_resp = await client.post(
-                "/v1/oauth2/token",
-                data={"grant_type": "client_credentials"},
-                auth=(
-                    settings.paypal_client_id or "",
-                    settings.paypal_client_secret or "",
-                ),
-            )
-            token_resp.raise_for_status()
-            access_token = token_resp.json().get("access_token")
-            if not access_token:
-                raise ValueError("PayPal token missing in verification flow.")
-
-            verify_resp = await client.post(
-                "/v1/notifications/verify-webhook-signature",
-                json={
-                    "auth_algo": required_headers["PAYPAL-AUTH-ALGO"],
-                    "cert_url": required_headers["PAYPAL-CERT-URL"],
-                    "transmission_id": required_headers["PAYPAL-TRANSMISSION-ID"],
-                    "transmission_sig": required_headers["PAYPAL-TRANSMISSION-SIG"],
-                    "transmission_time": required_headers["PAYPAL-TRANSMISSION-TIME"],
-                    "webhook_id": webhook_id,
-                    "webhook_event": json.loads(payload.decode()),
-                },
-                headers={"Authorization": f"Bearer {access_token}"},
-            )
-            verify_resp.raise_for_status()
-            verification_status = verify_resp.json().get("verification_status")
-            if verification_status != "SUCCESS":
-                raise ValueError("PayPal webhook verification failed.")
-    except Exception as exc:
-        logger.warning(exc)
-        raise ValueError("PayPal webhook cannot be verified.") from exc
-
-
-def check_square_signature(
-    payload: bytes,
-    sig_header: str | None,
-    secret: str | None,
-    notification_url: str | None,
-):
-    if not sig_header:
-        logger.warning("Square signature header is missing.")
-        raise ValueError("Square signature header is missing.")
-
-    if not secret:
-        logger.warning("Square webhook signature key is not set.")
-        raise ValueError("Square webhook cannot be verified.")
-
-    if not notification_url:
-        logger.warning("Square webhook notification URL is not set.")
-        raise ValueError("Square webhook cannot be verified.")
-
-    signed_payload = notification_url.encode() + payload
-    computed_signature = b64encode(
-        hmac.new(
-            key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
-        ).digest()
-    ).decode()
-
-    if hmac.compare_digest(computed_signature, sig_header) is not True:
-        logger.warning("Square signature verification failed.")
-        raise ValueError("Square signature verification failed.")
-
-
-def check_revolut_signature(
-    payload: bytes,
-    sig_header: str | None,
-    timestamp_header: str | None,
-    secret: str | None,
-    tolerance_seconds=300,
-):
-    if not sig_header:
-        logger.warning("Revolut signature header is missing.")
-        raise ValueError("Revolut signature header is missing.")
-
-    if not timestamp_header:
-        logger.warning("Revolut timestamp header is missing.")
-        raise ValueError("Revolut timestamp header is missing.")
-
-    if not secret:
-        logger.warning("Revolut webhook signing secret is not set.")
-        raise ValueError("Revolut webhook cannot be verified.")
-
-    try:
-        timestamp = int(timestamp_header)
-    except ValueError as exc:
-        logger.warning("Invalid Revolut timestamp.")
-        raise ValueError("Invalid Revolut timestamp.") from exc
-
-    timestamp_seconds = timestamp / 1000 if timestamp > 9999999999 else timestamp
-
-    if abs(time.time() - timestamp_seconds) > tolerance_seconds:
-        logger.warning("Timestamp outside tolerance.")
-        raise ValueError("Timestamp outside tolerance." f"Timestamp: {timestamp}")
-
-    signed_payload = b"v1." + timestamp_header.encode() + b"." + payload
-    digest = hmac.new(
-        key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
-    ).hexdigest()
-    expected_signature = f"v1={digest}"
-
-    provided_signatures = [sig.strip() for sig in sig_header.split(",") if sig.strip()]
-    if not any(
-        hmac.compare_digest(expected_signature, provided)
-        for provided in provided_signatures
-    ):
-        logger.warning("Revolut signature verification failed.")
-        raise ValueError("Revolut signature verification failed.")
-
-
 async def test_connection(provider: str) -> SimpleStatus:
    """
    Test the connection to Stripe by checking if the API key is valid.
@@ -66,8 +66,6 @@ async def check_server_balance_against_node():


 async def check_balance_delta_changed():
-    if settings.notification_balance_delta_threshold_sats <= 0:
-        return
    status = await get_balance_delta()
    if settings.latest_balance_delta_sats is None:
        settings.latest_balance_delta_sats = status.delta_sats
@@ -1,7 +1,6 @@
 import asyncio
 import json
 import smtplib
-from asyncio.tasks import create_task
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from http import HTTPStatus
@@ -74,7 +73,7 @@ async def send_admin_notification(
    message: str,
    message_type: str | None = None,
 ) -> None:
-    return await send_notification_in_background(
+    return await send_notification(
        settings.lnbits_telegram_notifications_chat_id,
        settings.lnbits_nostr_notifications_identifiers,
        settings.lnbits_email_notifications_to_emails,
@@ -97,7 +96,7 @@ async def send_user_notification(
        if user_notifications.nostr_identifier
        else []
    )
-    return await send_notification_in_background(
+    return await send_notification(
        user_notifications.telegram_chat_id,
        nostr_identifiers,
        email_address,
@@ -222,29 +221,12 @@ async def send_email(
    msg["Subject"] = subject
    msg.attach(MIMEText(message, "plain"))
    username = username if len(username) > 0 else from_email
-
-    def _send() -> bool:
-        with smtplib.SMTP(server, port) as smtp_server:
-            smtp_server.starttls()
-            smtp_server.login(username, password)
-            smtp_server.sendmail(from_email, to_emails, msg.as_string())
+    with smtplib.SMTP(server, port) as smtp_server:
+        smtp_server.starttls()
+        smtp_server.login(username, password)
+        smtp_server.sendmail(from_email, to_emails, msg.as_string())
        return True

-    try:
-        return await asyncio.to_thread(_send)
-    except Exception as e:
-        logger.warning(f"Sending Email failed. {e!s}")
-        return False
-
-
-async def dispatch_payment_notification(payment: Payment) -> None:
-    """
-    This worker dispatches the payment notifications.
-    """
-    wallet = await get_wallet(payment.wallet_id)
-    if wallet:
-        await send_payment_notification(wallet, payment)
-

 async def dispatch_webhook(payment: Payment):
    """
@@ -304,34 +286,6 @@ async def send_payment_notification(wallet: Wallet, payment: Payment):
        logger.error(f"Error dispatching webhook: {e!s}")


-def send_payment_notification_in_background(wallet: Wallet, payment: Payment):
-    try:
-        create_task(send_payment_notification(wallet, payment))
-    except Exception as e:
-        logger.warning(f"Error sending payment notification: {e}")
-
-
-async def send_notification_in_background(
-    telegram_chat_id: str | None,
-    nostr_identifiers: list[str] | None,
-    email_addresses: list[str] | None,
-    message: str,
-    message_type: str | None = None,
-):
-    try:
-        create_task(
-            send_notification(
-                telegram_chat_id,
-                nostr_identifiers,
-                email_addresses,
-                message,
-                message_type,
-            )
-        )
-    except Exception as e:
-        logger.warning(f"Error sending notification in background: {e}")
-
-
 async def send_ws_payment_notification(wallet: Wallet, payment: Payment):
    # TODO: websocket message should be a clean payment model
    # await websocket_manager.send(wallet.inkey, payment.json())
@@ -17,15 +17,14 @@ from lnbits.db import Connection, Filters
 from lnbits.decorators import check_user_extension_access
 from lnbits.exceptions import InvoiceError, PaymentError, UnsupportedError
 from lnbits.fiat import get_fiat_provider
-from lnbits.helpers import check_callback_url, daystart_timestamp
+from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
+from lnbits.tasks import create_task, internal_invoice_queue_put
 from lnbits.utils.crypto import fake_privkey, random_secret_and_hash, verify_preimage
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
 from lnbits.wallets import fake_wallet, get_funding_source
 from lnbits.wallets.base import (
    InvoiceResponse,
-    PaymentFailedStatus,
    PaymentPendingStatus,
    PaymentResponse,
    PaymentStatus,
@@ -48,8 +47,7 @@ from ..models import (
    PaymentState,
    Wallet,
 )
-from .fiat_providers import check_fiat_status
-from .notifications import send_payment_notification_in_background
+from .notifications import send_payment_notification

 payment_lock = asyncio.Lock()
 wallets_payments_lock: dict[str, asyncio.Lock] = {}
@@ -64,20 +62,17 @@ async def pay_invoice(
    description: str = "",
    tag: str = "",
    labels: list[str] | None = None,
-    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if settings.lnbits_only_allow_incoming_payments:
        raise PaymentError("Only incoming payments allowed.", status="failed")
    invoice = _validate_payment_request(payment_request, max_sat)
-
    if not invoice.amount_msat:
        raise ValueError("Missig invoice amount.")

    async with db.reuse_conn(conn) if conn else db.connect() as new_conn:
        amount_msat = invoice.amount_msat
        wallet = await _check_wallet_for_payment(wallet_id, tag, amount_msat, new_conn)
-
        if not wallet.can_send_payments:
            raise PaymentError(
                "Wallet does not have permission to pay invoices.",
@@ -98,15 +93,12 @@ async def pay_invoice(
            memo=description or invoice.description or "",
            extra=extra,
            labels=labels,
-            external_id=external_id,
        )

+    payment = await _pay_invoice(wallet.source_wallet_id, create_payment_model, conn)
+
    async with db.reuse_conn(conn) if conn else db.connect() as new_conn:
-        payment = await _pay_invoice(
-            wallet.source_wallet_id, create_payment_model, conn=new_conn
-        )
-
-        await _credit_service_fee_wallet(wallet, payment, conn=new_conn)
+        await _credit_service_fee_wallet(wallet, payment, new_conn)

    return payment

@@ -171,15 +163,15 @@ async def create_fiat_invoice(

    internal_payment.fiat_provider = fiat_provider_name
    internal_payment.extra["fiat_checking_id"] = fiat_invoice.checking_id
-    # TODO: move to payment
+    # todo: move to payent
    internal_payment.extra["fiat_payment_request"] = fiat_invoice.payment_request
    new_checking_id = (
        f"fiat_{fiat_provider_name}_"
        f"{fiat_invoice.checking_id or internal_payment.checking_id}"
    )
-    internal_payment = await update_payment(
-        internal_payment, new_checking_id, conn=conn
-    )
+    await update_payment(internal_payment, new_checking_id, conn=conn)
+    internal_payment.checking_id = new_checking_id
+
    return internal_payment


@@ -205,24 +197,20 @@ async def create_wallet_invoice(wallet_id: str, data: CreateInvoice) -> Payment:
        # do not save memo if description_hash or unhashed_description is set
        memo = ""

-    async with db.connect() as conn:
-        payment = await create_invoice(
-            wallet_id=wallet_id,
-            amount=data.amount,
-            memo=memo,
-            currency=data.unit,
-            description_hash=description_hash,
-            unhashed_description=unhashed_description,
-            expiry=data.expiry,
-            extra=data.extra,
-            extension=data.extension,
-            webhook=data.webhook,
-            internal=data.internal,
-            payment_hash=data.payment_hash,
-            labels=data.labels,
-            external_id=data.external_id,
-            conn=conn,
-        )
+    payment = await create_invoice(
+        wallet_id=wallet_id,
+        amount=data.amount,
+        memo=memo,
+        currency=data.unit,
+        description_hash=description_hash,
+        unhashed_description=unhashed_description,
+        expiry=data.expiry,
+        extra=data.extra,
+        webhook=data.webhook,
+        internal=data.internal,
+        payment_hash=data.payment_hash,
+        labels=data.labels,
+    )

    if data.lnurl_withdraw:
        try:
@@ -261,9 +249,7 @@ async def create_invoice(
    webhook: str | None = None,
    internal: bool | None = False,
    payment_hash: str | None = None,
-    extension: str | None = None,
    labels: list[str] | None = None,
-    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if not amount > 0:
@@ -345,11 +331,9 @@ async def create_invoice(
        expiry=invoice.expiry_date,
        memo=memo,
        extra=extra,
-        extension=extension,
        webhook=webhook,
        fee=invoice_response.fee_msat or 0,
        labels=labels,
-        external_id=external_id,
    )

    payment = await create_payment(
@@ -371,15 +355,13 @@ async def update_pending_payments(wallet_id: str):
        await update_pending_payment(payment)


-async def update_pending_payment(
-    payment: Payment, conn: Connection | None = None
-) -> Payment:
-    status = await check_payment_status(payment)
+async def update_pending_payment(payment: Payment) -> Payment:
+    status = await payment.check_status()
    if status.failed:
        payment.status = PaymentState.FAILED
-        payment = await update_payment(payment, conn=conn)
+        await update_payment(payment)
    elif status.success:
-        payment = await update_payment_success_status(payment, status, conn=conn)
+        payment = await update_payment_success_status(payment, status)
    return payment


@@ -517,7 +499,7 @@ async def update_wallet_balance(
        )
        payment.status = PaymentState.SUCCESS
        await update_payment(payment, conn=conn)
-        task_manager.internal_invoice_queue.put_nowait(payment)
+        await internal_invoice_queue_put(payment.checking_id)


 async def check_wallet_limits(
@@ -557,9 +539,10 @@ async def check_wallet_daily_withdraw_limit(
        raise ValueError("It is not allowed to spend funds from this server.")

    payments = await get_payments(
-        since=daystart_timestamp(),
+        since=int(time.time()) - 60 * 60 * 24,
        outgoing=True,
        wallet_id=wallet_id,
+        limit=1,
        conn=conn,
    )
    if len(payments) == 0:
@@ -627,25 +610,7 @@ async def check_transaction_status(
    if payment.status == PaymentState.SUCCESS.value:
        return PaymentSuccessStatus(fee_msat=payment.fee)

-    return await check_payment_status(payment)
-
-
-async def check_payment_status(payment: Payment) -> PaymentStatus:
-    if payment.is_internal:
-        if payment.success:
-            return PaymentSuccessStatus()
-        if payment.failed:
-            return PaymentFailedStatus()
-        if payment.is_in and payment.fiat_provider:
-            fiat_status = await check_fiat_status(payment)
-            return PaymentStatus(paid=fiat_status.paid)
-        return PaymentPendingStatus()
-    funding_source = get_funding_source()
-    if payment.is_out:
-        status = await funding_source.get_payment_status(payment.checking_id)
-    else:
-        status = await funding_source.get_invoice_status(payment.checking_id)
-    return status
+    return await payment.check_status()


 async def get_payments_daily_stats(
@@ -733,7 +698,6 @@ async def _pay_internal_invoice(
    internal_payment = await check_internal(
        create_payment_model.payment_hash, conn=conn
    )
-
    if not internal_payment:
        return None

@@ -742,7 +706,6 @@ async def _pay_internal_invoice(
    internal_invoice = await get_standalone_payment(
        internal_payment.checking_id, incoming=True, conn=conn
    )
-
    if not internal_invoice:
        raise PaymentError("Internal payment not found.", status="failed")

@@ -764,7 +727,6 @@ async def _pay_internal_invoice(

    internal_id = f"internal_{create_payment_model.payment_hash}"
    logger.debug(f"creating temporary internal payment with id {internal_id}")
-
    payment = await create_payment(
        checking_id=internal_id,
        data=create_payment_model,
@@ -779,16 +741,13 @@ async def _pay_internal_invoice(
    await update_payment(internal_payment, conn=conn)
    logger.success(f"internal payment successful {internal_payment.checking_id}")

-    await _send_payment_notification_in_background(
-        wallet.id, payment, conn=conn
-    )  # notify the sender
-    await _send_payment_notification_in_background(
-        internal_payment.wallet_id, internal_payment, conn=conn
-    )  # notify the receiver
+    await send_payment_notification(wallet, payment)
+
+    # notify receiver asynchronously
+    from lnbits.tasks import internal_invoice_queue

-    # notify receiver asynchronously (extension listeners)
    logger.debug(f"enqueuing internal invoice {internal_payment.checking_id}")
-    task_manager.internal_invoice_queue.put_nowait(internal_payment)
+    await internal_invoice_queue.put(internal_payment.checking_id)

    return payment

@@ -825,15 +784,14 @@ async def _pay_external_invoice(

    fee_reserve_msat = fee_reserve(amount_msat, internal=False)

-    task = task_manager.create_task(
-        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat),
-        f"fundingsource_pay_invoice_{checking_id}",
+    task = create_task(
+        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat)
    )

    # make sure a hold invoice or deferred payment is not blocking the server
    wait_time = max(1, settings.lnbits_funding_source_pay_invoice_wait_seconds)
    try:
-        payment_response = await asyncio.wait_for(task.task, timeout=wait_time)
+        payment_response = await asyncio.wait_for(task, timeout=wait_time)
    except asyncio.TimeoutError:
        # return pending payment on timeout
        logger.debug(
@@ -856,8 +814,7 @@ async def _pay_external_invoice(
        payment = await update_payment_success_status(
            payment, payment_response, conn=conn
        )
-
-        await _send_payment_notification_in_background(wallet.id, payment, conn=conn)
+        await send_payment_notification(wallet, payment)
        logger.success(f"payment successful {payment_response.checking_id}")

    payment.checking_id = payment_response.checking_id
@@ -874,7 +831,7 @@ async def update_payment_success_status(
        payment.status = PaymentState.SUCCESS
        payment.fee = -(abs(status.fee_msat or 0) + abs(service_fee_msat))
        payment.preimage = payment.preimage or status.preimage
-        payment = await update_payment(payment, conn=conn)
+        await update_payment(payment, conn=conn)
    return payment


@@ -900,7 +857,7 @@ async def _verify_external_payment(
        raise PaymentError("Payment already paid.", status="success")

    # payment failed
-    status = await check_payment_status(payment)
+    status = await payment.check_status()
    if status.failed:
        raise PaymentError(
            "Payment is failed node, retrying is not possible.", status="failed"
@@ -1065,56 +1022,3 @@ async def cancel_hold_invoice(payment: Payment) -> InvoiceResponse:
    await update_payment(payment)

    return response
-
-
-async def _send_payment_notification_in_background(
-    wallet_id: str, payment: Payment, conn: Connection | None = None
-):
-    # fetch balance again
-    wallet = await get_wallet(wallet_id, conn=conn)
-    if not wallet:
-        raise PaymentError(f"Could not fetch wallet '{wallet_id}'.", status="failed")
-    send_payment_notification_in_background(wallet, payment)
-
-
-async def update_invoice_from_paid_invoices_stream(checking_id: str) -> Payment | None:
-    """
-    Takes a checking_id of an incoming payment from paid_invoices_stream()
-    Checks its status, updates its status and returns it.
-    returns None if no incoming payment was found or the status is not successful
-    """
-    payment = await get_standalone_payment(checking_id, incoming=True)
-    if not payment:
-        logger.warning(f"No incoming payment found for '{checking_id}'.")
-        return None
-
-    status = await check_payment_status(payment)
-
-    if not status.success:
-        logger.error(
-            "Unexpected status response from paid_invoices_stream. Skipping update."
-        )
-        return None
-
-    payment.fee = status.fee_msat or payment.fee
-    # only overwrite preimage if status.preimage provides it
-    payment.preimage = status.preimage or payment.preimage
-    payment.status = PaymentState.SUCCESS
-    payment = await update_payment(payment)
-
-    return payment
-
-
-async def fundingsource_invoice_producer() -> None:
-    """
-    will collect all invoices that come directly from the backend wallet.
-
-    Called registered in the app startup sequence and run by taskmanager.
-    """
-    funding_source = get_funding_source()
-    async for checking_id in funding_source.paid_invoices_stream():
-        logger.info(f"got a payment notification {checking_id}")
-        payment = await update_invoice_from_paid_invoices_stream(checking_id)
-        if payment:
-            logger.success(f"fundingsource invoice {checking_id} settled")
-            task_manager.invoice_queue.put_nowait(payment)
@@ -3,11 +3,7 @@ from uuid import uuid4

 from loguru import logger

-from lnbits.core.crud.settings import set_settings_field
-from lnbits.core.db import db
 from lnbits.core.models.extensions import UserExtension
-from lnbits.core.models.users import RegisterUser
-from lnbits.db import Connection
 from lnbits.settings import (
    EditableSettings,
    SuperSettings,
@@ -23,7 +19,6 @@ from ..crud import (
    get_account_by_email,
    get_account_by_pubkey,
    get_account_by_username,
-    get_accounts_count,
    get_super_settings,
    get_user_extensions,
    get_user_from_account,
@@ -53,60 +48,43 @@ async def create_user_account_no_ckeck(
    account: Account | None = None,
    wallet_name: str | None = None,
    default_exts: list[str] | None = None,
-    conn: Connection | None = None,
 ) -> User:
-    async with db.reuse_conn(conn) if conn else db.connect() as conn:
-        await check_users_limit(conn)

-        if account:
-            account.validate_fields()
-            if account.username and await get_account_by_username(
-                account.username, conn=conn
-            ):
-                raise ValueError("Username already exists.")
+    if account:
+        account.validate_fields()
+        if account.username and await get_account_by_username(account.username):
+            raise ValueError("Username already exists.")

-            if account.email and await get_account_by_email(account.email, conn=conn):
-                raise ValueError("Email already exists.")
+        if account.email and await get_account_by_email(account.email):
+            raise ValueError("Email already exists.")

-            if account.pubkey and await get_account_by_pubkey(
-                account.pubkey, conn=conn
-            ):
-                raise ValueError("Pubkey already exists.")
+        if account.pubkey and await get_account_by_pubkey(account.pubkey):
+            raise ValueError("Pubkey already exists.")

-            if not account.id:
-                account.id = uuid4().hex
+        if not account.id:
+            account.id = uuid4().hex

-        account = await create_account(account, conn=conn)
-        await create_wallet(
-            user_id=account.id,
-            wallet_name=wallet_name or settings.lnbits_default_wallet_name,
-            conn=conn,
-        )
+    account = await create_account(account)
+    await create_wallet(
+        user_id=account.id,
+        wallet_name=wallet_name or settings.lnbits_default_wallet_name,
+    )

-        user_extensions = (default_exts or []) + settings.lnbits_user_default_extensions
-        for ext_id in user_extensions:
-            try:
-                user_ext = UserExtension(user=account.id, extension=ext_id, active=True)
-                await create_user_extension(user_ext, conn=conn)
-            except Exception as e:
-                logger.error(f"Error enabeling default extension {ext_id}: {e}")
+    user_extensions = (default_exts or []) + settings.lnbits_user_default_extensions
+    for ext_id in user_extensions:
+        try:
+            user_ext = UserExtension(user=account.id, extension=ext_id, active=True)
+            await create_user_extension(user_ext)
+        except Exception as e:
+            logger.error(f"Error enabeling default extension {ext_id}: {e}")

-        user = await get_user_from_account(account, conn=conn)
+    user = await get_user_from_account(account)
    if not user:
        raise ValueError("Cannot find user for account.")

    return user


-async def check_users_limit(conn: Connection | None = None):
-    if settings.lnbits_max_users == 0:
-        return
-
-    users_count = await get_accounts_count(conn=conn)
-    if users_count >= settings.lnbits_max_users:
-        raise ValueError("Max amount of users have been created")
-
-
 async def update_user_account(account: Account) -> Account:
    account.validate_fields()

@@ -185,12 +163,6 @@ async def check_admin_settings():
        if account and account.extra and account.extra.provider == "env":
            settings.first_install = True

-        if settings.has_first_install_token_changed():
-            logger.warning("First install token is changed. Resetting admin settings.")
-            new_settings = await init_admin_settings()
-            settings.super_user = new_settings.super_user
-            settings.first_install = True
-
        logger.success(
            "✔️ Admin UI is enabled. run `uv run lnbits-cli superuser` "
            "to get the superuser."
@@ -212,25 +184,3 @@ async def init_admin_settings(super_user: str | None = None) -> SuperSettings:

    editable_settings = EditableSettings.from_dict(settings.dict())
    return await create_admin_settings(account.id, editable_settings.dict())
-
-
-async def check_register_activation_settings(data: RegisterUser):
-    if not settings.lnbits_require_user_activation:
-        return None
-    if settings.lnbits_user_activation_by_invitation_code:
-        code = data.invitation_code.strip() if data.invitation_code else ""
-        if len(code) == 0:
-            raise ValueError("Invitation code cannot be empty.")
-
-        if code == settings.lnbits_register_reusable_activation_code:
-            return None
-        if code in settings.lnbits_register_one_time_activation_codes:
-            settings.lnbits_register_one_time_activation_codes.remove(code)
-            await set_settings_field(
-                "lnbits_register_one_time_activation_codes",
-                settings.lnbits_register_one_time_activation_codes,
-            )
-            return None
-        raise ValueError("Invalid invitation code.")
-
-    raise ValueError("No activation method provided.")
@@ -2,43 +2,74 @@ import asyncio

 from loguru import logger

-from lnbits.core.crud import create_audit_entry
+from lnbits.core.crud import (
+    create_audit_entry,
+    get_wallet,
+)
+from lnbits.core.crud.audit import delete_expired_audit_entries
 from lnbits.core.crud.payments import get_payments_status_count
 from lnbits.core.crud.users import get_accounts
 from lnbits.core.crud.wallets import get_wallets_count
 from lnbits.core.models.audit import AuditEntry
 from lnbits.core.models.extensions import InstallableExtension
 from lnbits.core.models.notifications import NotificationType
-from lnbits.core.services.funding_source import get_balance_delta
+from lnbits.core.services.funding_source import (
+    check_balance_delta_changed,
+    check_server_balance_against_node,
+    get_balance_delta,
+)
 from lnbits.core.services.notifications import (
    enqueue_admin_notification,
+    process_next_notification,
+    send_payment_notification,
 )
 from lnbits.db import Filters
 from lnbits.settings import settings
-from lnbits.utils.cache import cache
-from lnbits.utils.exchange_rates import btc_price_from_aggregator, btc_rates
+from lnbits.utils.exchange_rates import btc_rates

 audit_queue: asyncio.Queue[AuditEntry] = asyncio.Queue()


-async def process_next_audit_entry() -> None:
-    """
-    Waits for audit entries to be pushed to the queue.
-    Then it inserts the entries into the DB.
-    """
-    data = await audit_queue.get()
-    await create_audit_entry(data)
+async def run_by_the_minute_tasks() -> None:
+    minute_counter = 0
+    while settings.lnbits_running:
+        status_minutes = settings.lnbits_notification_server_status_hours * 60
+
+        if settings.notification_balance_delta_threshold_sats > 0:
+            try:
+                # runs by default every minute, the delta should not change that often
+                await check_balance_delta_changed()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % settings.lnbits_watchdog_interval_minutes == 0:
+            try:
+                await check_server_balance_against_node()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % status_minutes == 0:
+            try:
+                await _notify_server_status()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % 60 == 0:
+            try:
+                # initialize the list of all extensions
+                await InstallableExtension.get_installable_extensions()
+            except Exception as ex:
+                logger.error(ex)
+
+        minute_counter += 1
+        await asyncio.sleep(60)


-async def refresh_extension_cache() -> None:
-    # only refreshes every 10 minutes
-    await InstallableExtension.get_installable_extensions()
-
-
-async def notify_server_status() -> None:
+async def _notify_server_status() -> None:
    accounts = await get_accounts(filters=Filters(limit=0))
    wallets_count = await get_wallets_count()
    payments = await get_payments_status_count()
+
    status = await get_balance_delta()
    values = {
        "up_time": settings.lnbits_server_up_time,
@@ -55,38 +86,76 @@ async def notify_server_status() -> None:
    enqueue_admin_notification(NotificationType.server_status, values)


+async def wait_for_paid_invoices(invoice_paid_queue: asyncio.Queue) -> None:
+    """
+    This worker dispatches events to all extensions and dispatches webhooks.
+    """
+    while settings.lnbits_running:
+        payment = await invoice_paid_queue.get()
+        logger.trace("received invoice paid event")
+        # payment notification
+        wallet = await get_wallet(payment.wallet_id)
+        if wallet:
+            await send_payment_notification(wallet, payment)
+
+
+async def wait_for_audit_data() -> None:
+    """
+    Waits for audit entries to be pushed to the queue.
+    Then it inserts the entries into the DB.
+    """
+    while settings.lnbits_running:
+        data = await audit_queue.get()
+        try:
+            await create_audit_entry(data)
+        except Exception as ex:
+            logger.warning(ex)
+            await asyncio.sleep(3)
+
+
+async def wait_notification_messages() -> None:
+
+    while settings.lnbits_running:
+        try:
+            await process_next_notification()
+        except Exception as ex:
+            logger.warning("Payment notification error", ex)
+            await asyncio.sleep(3)
+
+
+async def purge_audit_data() -> None:
+    """
+    Remove audit entries which have passed their retention period.
+    """
+    while settings.lnbits_running:
+        try:
+            await delete_expired_audit_entries()
+        except Exception as ex:
+            logger.warning(ex)
+
+        # clean every hour
+        await asyncio.sleep(60 * 60)
+
+
 async def collect_exchange_rates_data() -> None:
    """
    Collect exchange rates data. Used for monitoring only.
    """
-    currency = settings.lnbits_default_accounting_currency or "USD"
-    max_history_size = settings.lnbits_exchange_history_size
-    try:
-        if (
-            settings.lnbits_price_aggregator_enabled
-            and settings.lnbits_price_aggregator_url
-        ):
-            price = await btc_price_from_aggregator(currency)
-            if price:
-                cache.set(
-                    f"btc-price-{currency}",
-                    price,
-                    expiry=settings.lnbits_exchange_rate_cache_seconds,
-                )
-                settings.append_exchange_rate_datapoint(
-                    {"Aggregator": price}, max_history_size
-                )
+    while settings.lnbits_running:
+        currency = settings.lnbits_default_accounting_currency or "USD"
+        max_history_size = settings.lnbits_exchange_history_size
+        sleep_time = settings.lnbits_exchange_history_refresh_interval_seconds
+
+        if sleep_time > 0:
+            try:
+                rates = await btc_rates(currency)
+                if rates:
+                    rates_values = [r[1] for r in rates]
+                    lnbits_rate = sum(rates_values) / len(rates_values)
+                    rates.append(("LNbits", lnbits_rate))
+                settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
+            except Exception as ex:
+                logger.warning(ex)
        else:
-            rates = await btc_rates(currency)
-            if rates:
-                rates_values = [r[1] for r in rates]
-                lnbits_rate = sum(rates_values) / len(rates_values)
-                rates.append(("LNbits", lnbits_rate))
-                cache.set(
-                    f"btc-price-{currency}",
-                    lnbits_rate,
-                    expiry=settings.lnbits_exchange_rate_cache_seconds,
-                )
-            settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
-    except Exception as ex:
-        logger.warning(ex)
+            sleep_time = 60
+        await asyncio.sleep(sleep_time)
@@ -0,0 +1,3 @@
+{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
+%} {% block scripts %} {{ window_vars(user) }} {% endblock %} {% block page %}{%
+endblock %}
@@ -0,0 +1,3 @@
+{% extends "public.html" %} {% from "macros.jinja" import window_vars with
+context %} {% block scripts %} {{ window_vars() }} {% endblock %} {% block page
+%} {% endblock %}
@@ -8,8 +8,8 @@ from urllib.parse import urlparse
 from fastapi import APIRouter, Depends, File
 from fastapi.responses import FileResponse

+from lnbits.core.models import User
 from lnbits.core.models.notifications import NotificationType
-from lnbits.core.models.users import Account
 from lnbits.core.services import (
    enqueue_admin_notification,
    get_balance_delta,
@@ -20,7 +20,7 @@ from lnbits.core.services.settings import dict_to_settings
 from lnbits.decorators import check_admin, check_super_user
 from lnbits.server import server_restart
 from lnbits.settings import AdminSettings, Settings, UpdateSettings, settings
-from lnbits.task_manager import PublicTask, task_manager
+from lnbits.tasks import invoice_listeners

 from .. import core_app_extra
 from ..crud import get_admin_settings, reset_core_settings, update_admin_settings
@@ -44,10 +44,11 @@ async def api_auditor():
    name="Monitor",
    description="show the current listeners and other monitoring data",
    dependencies=[Depends(check_admin)],
-    response_model=list[PublicTask],
 )
-async def api_monitor() -> list[PublicTask]:
-    return task_manager.get_public_tasks()
+async def api_monitor():
+    return {
+        "invoice_listeners": list(invoice_listeners.keys()),
+    }


@admin_router.get(
@@ -66,9 +67,9 @@ async def api_test_email():

@admin_router.get("/api/v1/settings")
 async def api_get_settings(
-    account: Account = Depends(check_admin),
+    user: User = Depends(check_admin),
 ) -> AdminSettings | None:
-    admin_settings = await get_admin_settings(account.is_super_user)
+    admin_settings = await get_admin_settings(user.super_user)
    return admin_settings


@@ -76,14 +77,12 @@ async def api_get_settings(
    "/api/v1/settings",
    status_code=HTTPStatus.OK,
 )
-async def api_update_settings(
-    data: UpdateSettings, account: Account = Depends(check_admin)
-):
+async def api_update_settings(data: UpdateSettings, user: User = Depends(check_admin)):
    enqueue_admin_notification(
-        NotificationType.settings_update, {"username": account.username}
+        NotificationType.settings_update, {"username": user.username}
    )
    await update_admin_settings(data)
-    admin_settings = await get_admin_settings(account.is_super_user)
+    admin_settings = await get_admin_settings(user.super_user)
    if not admin_settings:
        raise ValueError("Updated admin settings not found.")
    update_cached_settings(admin_settings.dict())
@@ -95,11 +94,9 @@ async def api_update_settings(
    "/api/v1/settings",
    status_code=HTTPStatus.OK,
 )
-async def api_update_settings_partial(
-    data: dict, account: Account = Depends(check_admin)
-):
+async def api_update_settings_partial(data: dict, user: User = Depends(check_admin)):
    updatable_settings = dict_to_settings({**settings.dict(), **data})
-    return await api_update_settings(updatable_settings, account)
+    return await api_update_settings(updatable_settings, user)


@admin_router.get(
@@ -113,9 +110,9 @@ async def api_reset_settings(field_name: str):


@admin_router.delete("/api/v1/settings", status_code=HTTPStatus.OK)
-async def api_delete_settings(account: Account = Depends(check_super_user)) -> None:
+async def api_delete_settings(user: User = Depends(check_super_user)) -> None:
    enqueue_admin_notification(
-        NotificationType.settings_update, {"username": account.username}
+        NotificationType.settings_update, {"username": user.username}
    )
    await reset_core_settings()
    server_restart.set()
@@ -8,17 +8,13 @@ from fastapi import APIRouter, Depends
 from fastapi.responses import StreamingResponse

 from lnbits.core.models import (
+    BaseWallet,
    ConversionData,
    CreateWallet,
    User,
    Wallet,
 )
-from lnbits.core.models.users import AccountId
-from lnbits.decorators import (
-    check_account_exists,
-    check_account_id_exists,
-    check_user_exists,
-)
+from lnbits.decorators import check_user_exists
 from lnbits.settings import settings
 from lnbits.utils.exchange_rates import (
    allowed_currencies,
@@ -43,9 +39,7 @@ async def health() -> dict:


@api_router.get("/api/v1/status", status_code=HTTPStatus.OK)
-async def health_check(
-    account_id: AccountId = Depends(check_account_id_exists),
-) -> dict:
+async def health_check(user: User = Depends(check_user_exists)) -> dict:
    stat: dict[str, Any] = {
        "server_time": int(time()),
        "up_time": settings.lnbits_server_up_time,
@@ -53,7 +47,7 @@ async def health_check(
    }

    stat["version"] = settings.version
-    if not account_id.is_admin_id:
+    if not user.admin:
        return stat

    funding_source = get_funding_source()
@@ -70,6 +64,7 @@ async def health_check(
    "/api/v1/wallets",
    name="Wallets",
    description="Get basic info for all of user's wallets.",
+    response_model=list[BaseWallet],
 )
 async def api_wallets(user: User = Depends(check_user_exists)) -> list[Wallet]:
    return user.wallets
@@ -83,7 +78,7 @@ async def api_create_account(data: CreateWallet) -> Wallet:

@api_router.get(
    "/api/v1/rate/history",
-    dependencies=[Depends(check_account_exists)],
+    dependencies=[Depends(check_user_exists)],
 )
 async def api_exchange_rate_history() -> list[dict]:
    return settings.lnbits_exchange_rate_history
@@ -15,18 +15,11 @@ from lnbits.core.crud.assets import (
 )
 from lnbits.core.models.assets import AssetFilters, AssetInfo, AssetUpdate
 from lnbits.core.models.misc import SimpleStatus
-from lnbits.core.models.users import AccountId
-from lnbits.core.services.assets import (
-    ASSET_SECURITY_HEADERS,
-    INLINE_ASSET_MIME_TYPES,
-    content_disposition,
-    create_user_asset,
-    normalize_media_type,
-    thumbnail_media_type,
-)
+from lnbits.core.models.users import User
+from lnbits.core.services.assets import create_user_asset
 from lnbits.db import Filters, Page
 from lnbits.decorators import (
-    check_account_id_exists,
+    check_user_exists,
    optional_user_id,
    parse_filters,
 )
@@ -42,10 +35,10 @@ upload_file_param = File(...)
    summary="Get paginated list user assets",
 )
 async def api_get_user_assets(
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
    filters: Filters = Depends(parse_filters(AssetFilters)),
 ) -> Page[AssetInfo]:
-    return await get_user_assets(account_id.id, filters=filters)
+    return await get_user_assets(user.id, filters=filters)


@asset_router.get(
@@ -55,20 +48,20 @@ async def api_get_user_assets(
 )
 async def api_get_asset(
    asset_id: str,
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ) -> AssetInfo:
-    asset_info = await get_user_asset_info(account_id.id, asset_id)
+    asset_info = await get_user_asset_info(user.id, asset_id)
    if not asset_info:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")
    return asset_info


@asset_router.get(
-    "/{asset_id}/data",
-    name="Get user asset data",
-    summary="Get user asset data data by ID",
+    "/{asset_id}/binary",
+    name="Get user asset binary",
+    summary="Get user asset binary data by ID",
 )
-async def api_get_asset_data(
+async def api_get_asset_binary(
    asset_id: str,
    user_id: str | None = Depends(optional_user_id),
 ) -> Response:
@@ -82,7 +75,11 @@ async def api_get_asset_data(
    if not asset:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return asset_response(asset.data, asset.mime_type, asset.name)
+    return Response(
+        content=asset.data,
+        media_type=asset.mime_type,
+        headers={"Content-Disposition": f'inline; filename="{asset.name}"'},
+    )


@asset_router.get(
@@ -104,14 +101,14 @@ async def api_get_asset_thumbnail(
    if not asset_info:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return asset_response(
+    return Response(
        content=(
            base64.b64decode(asset_info.thumbnail_base64)
            if asset_info.thumbnail_base64
            else b""
        ),
-        media_type=thumbnail_media_type(),
-        filename=asset_info.name,
+        media_type=asset_info.mime_type,
+        headers={"Content-Disposition": f'inline; filename="{asset_info.name}"'},
    )


@@ -123,12 +120,12 @@ async def api_get_asset_thumbnail(
 async def api_update_asset(
    asset_id: str,
    data: AssetUpdate,
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ) -> AssetInfo:
-    if account_id.is_admin_id:
+    if user.admin:
        asset_info = await get_asset_info(asset_id)
    else:
-        asset_info = await get_user_asset_info(account_id.id, asset_id)
+        asset_info = await get_user_asset_info(user.id, asset_id)

    if not asset_info:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")
@@ -147,13 +144,13 @@ async def api_update_asset(
    summary="Upload user assets",
 )
 async def api_upload_asset(
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
    file: UploadFile = upload_file_param,
    public_asset: bool = False,
 ) -> AssetInfo:
-    asset = await create_user_asset(account_id.id, file, public_asset)
+    asset = await create_user_asset(user.id, file, public_asset)

-    asset_info = await get_user_asset_info(account_id.id, asset.id)
+    asset_info = await get_user_asset_info(user.id, asset.id)
    if not asset_info:
        raise ValueError("Failed to retrieve asset info after upload.")

@@ -167,24 +164,11 @@ async def api_upload_asset(
 )
 async def api_delete_asset(
    asset_id: str,
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ) -> SimpleStatus:
-    asset = await get_user_asset(account_id.id, asset_id)
+    asset = await get_user_asset(user.id, asset_id)
    if not asset:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    await delete_user_asset(account_id.id, asset_id)
+    await delete_user_asset(user.id, asset_id)
    return SimpleStatus(success=True, message="Asset deleted successfully.")
-
-
-def asset_response(content: bytes, media_type: str, filename: str) -> Response:
-    media_type = normalize_media_type(media_type)
-    disposition = "inline" if media_type in INLINE_ASSET_MIME_TYPES else "attachment"
-    return Response(
-        content=content,
-        media_type=media_type,
-        headers={
-            **ASSET_SECURITY_HEADERS,
-            "Content-Disposition": content_disposition(disposition, filename),
-        },
-    )
@@ -4,15 +4,13 @@ import json
 from collections.abc import Callable
 from http import HTTPStatus
 from time import time
-from typing import Annotated
 from uuid import uuid4

-from fastapi import APIRouter, Cookie, Depends, HTTPException, Request
+from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi_sso.sso.base import OpenID, SSOBase
 from loguru import logger

-from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.crud.users import (
    get_user_access_control_lists,
    update_user_access_control_list,
@@ -27,17 +25,8 @@ from lnbits.core.models.users import (
    UpdateAccessControlList,
 )
 from lnbits.core.services import create_user_account
-from lnbits.core.services.users import (
-    check_register_activation_settings,
-    update_user_account,
-)
-from lnbits.decorators import (
-    access_token_payload,
-    check_account_exists,
-    check_admin,
-    check_user_exists,
-    optional_user_id,
-)
+from lnbits.core.services.users import update_user_account
+from lnbits.decorators import access_token_payload, check_user_exists
 from lnbits.helpers import (
    create_access_token,
    decrypt_internal_message,
@@ -91,7 +80,6 @@ async def login(data: LoginUsernamePassword) -> JSONResponse:
    account = await get_account_by_username_or_email(data.username)
    if not account or not account.verify_password(data.password):
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid credentials.")
-
    return _auth_success_response(account.username, account.id, account.email)


@@ -100,7 +88,7 @@ async def nostr_login(request: Request) -> JSONResponse:
    if not settings.is_auth_method_allowed(AuthMethods.nostr_auth_nip98):
        raise HTTPException(HTTPStatus.FORBIDDEN, "Login with Nostr Auth not allowed.")
    event = _nostr_nip98_event(request)
-    account = await get_account_by_pubkey(event["pubkey"], active_only=False)
+    account = await get_account_by_pubkey(event["pubkey"])
    if not account:
        account = Account(
            id=uuid4().hex,
@@ -108,8 +96,6 @@ async def nostr_login(request: Request) -> JSONResponse:
            extra=UserExtra(provider="nostr"),
        )
        await create_user_account(account)
-    if not account.activated:
-        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User is not activated.")
    return _auth_success_response(account.username or "", account.id, account.email)


@@ -130,87 +116,14 @@ async def login_usr(data: LoginUsr) -> JSONResponse:
    return _auth_success_response(account.username, account.id, account.email)


-@auth_router.post("/impersonate", description="Login via the User ID of another user")
-async def impersonate_user(
-    data: LoginUsr,
-    user: User = Depends(check_admin),
-    cookie_access_token: Annotated[str | None, Cookie()] = None,
-) -> JSONResponse:
-    if not cookie_access_token:
-        raise HTTPException(
-            HTTPStatus.UNAUTHORIZED, "Only cookie based impersonation is allowed."
-        )
-    if data.usr == user.id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "You cannot impersonate yourself.")
-    if settings.is_admin_user(data.usr):
-        # this check includes the superuser
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN, "You cannot impersonate another admin user."
-        )
-
-    account = await get_account(data.usr)
-    if not account:
-        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User ID does not exist.")
-
-    response = _auth_success_response(account.username, account.id, account.email)
-
-    max_age = settings.auth_token_expire_minutes * 60
-    response.set_cookie(
-        "admin_access_token",
-        cookie_access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_impersonated",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    return response
-
-
-@auth_router.delete(
-    "/impersonate", description="Stop impersonation and go back to admin"
-)
-async def stop_impersonate_user(
-    user: User = Depends(check_user_exists),
-    admin_access_token: Annotated[str | None, Cookie()] = None,
-) -> JSONResponse:
-    if not admin_access_token:
-        raise HTTPException(
-            HTTPStatus.UNAUTHORIZED,
-            "No admin access token found to stop impersonation.",
-        )
-    response = JSONResponse(
-        {"access_token": admin_access_token, "token_type": "bearer"}
-    )
-    max_age = settings.auth_token_expire_minutes * 60
-    response.set_cookie(
-        "cookie_access_token",
-        admin_access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.delete_cookie("admin_access_token")
-    response.delete_cookie("is_access_token_expired")
-    response.delete_cookie("is_lnbits_user_impersonated")
-    return response
-
-
@auth_router.get("/acl")
 async def api_get_user_acls(
    request: Request,
-    account: Account = Depends(check_account_exists),
+    user: User = Depends(check_user_exists),
 ) -> UserAcls:
    api_routes = get_api_routes(request.app.router.routes)

-    acls = await get_user_access_control_lists(account.id)
+    acls = await get_user_access_control_lists(user.id)

    # Add missing/new endpoints to the ACLs
    for acl in acls.access_control_list:
@@ -223,7 +136,7 @@ async def api_get_user_acls(
            acl.endpoints.append(EndpointAccess(path=path, name=name))
        acl.endpoints.sort(key=lambda e: e.name.lower())

-    return UserAcls(id=account.id, access_control_list=acls.access_control_list)
+    return UserAcls(id=user.id, access_control_list=acls.access_control_list)


@auth_router.put("/acl")
@@ -231,13 +144,13 @@ async def api_get_user_acls(
 async def api_update_user_acl(
    request: Request,
    data: UpdateAccessControlList,
-    account: Account = Depends(check_account_exists),
+    user: User = Depends(check_user_exists),
 ) -> UserAcls:
-
+    account = await get_account(user.id)
    if not account or not account.verify_password(data.password):
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid credentials.")

-    user_acls = await get_user_access_control_lists(account.id)
+    user_acls = await get_user_access_control_lists(user.id)
    acl = user_acls.get_acl_by_id(data.id)
    if acl:
        user_acls.access_control_list.remove(acl)
@@ -262,30 +175,33 @@ async def api_update_user_acl(

@auth_router.delete("/acl")
 async def api_delete_user_acl(
-    data: DeleteAccessControlList, account: Account = Depends(check_account_exists)
+    data: DeleteAccessControlList,
+    user: User = Depends(check_user_exists),
 ):
+    account = await get_account(user.id)
    if not account or not account.verify_password(data.password):
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid credentials.")

-    user_acls = await get_user_access_control_lists(account.id)
+    user_acls = await get_user_access_control_lists(user.id)
    user_acls.delete_acl_by_id(data.id)
    await update_user_access_control_list(user_acls)


@auth_router.post("/acl/token")
 async def api_create_user_api_token(
-    data: ApiTokenRequest, account: Account = Depends(check_account_exists)
+    data: ApiTokenRequest,
+    user: User = Depends(check_user_exists),
 ) -> ApiTokenResponse:
    if not data.expiration_time_minutes > 0:
        raise ValueError("Expiration time must be in the future.")
-
+    account = await get_account(user.id)
    if not account or not account.verify_password(data.password):
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid credentials.")

    if not account.username:
        raise ValueError("Username must be configured.")

-    acls = await get_user_access_control_lists(account.id)
+    acls = await get_user_access_control_lists(user.id)
    acl = acls.get_acl_by_id(data.acl_id)
    if not acl:
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid ACL id.")
@@ -302,16 +218,18 @@ async def api_create_user_api_token(

@auth_router.delete("/acl/token")
 async def api_delete_user_api_token(
-    data: DeleteTokenRequest, account: Account = Depends(check_account_exists)
+    data: DeleteTokenRequest,
+    user: User = Depends(check_user_exists),
 ):

+    account = await get_account(user.id)
    if not account or not account.verify_password(data.password):
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid credentials.")

    if not account.username:
        raise ValueError("Username must be configured.")

-    acls = await get_user_access_control_lists(account.id)
+    acls = await get_user_access_control_lists(user.id)
    acl = acls.get_acl_by_id(data.acl_id)
    if not acl:
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid ACL id.")
@@ -321,10 +239,7 @@ async def api_delete_user_api_token(

@auth_router.get("/{provider}", description="SSO Provider")
 async def login_with_sso_provider(
-    request: Request,
-    provider: str,
-    user_id: str | None,
-    auth_user_id: str | None = Depends(optional_user_id),
+    request: Request, provider: str, user_id: str | None = None
 ):
    provider_sso = _new_sso(provider)
    if not provider_sso:
@@ -332,8 +247,6 @@ async def login_with_sso_provider(
            HTTPStatus.FORBIDDEN,
            f"Login by '{provider}' not allowed.",
        )
-    if user_id and user_id != auth_user_id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "User ID mismatch.")

    provider_sso.redirect_uri = str(request.base_url) + f"api/v1/auth/{provider}/token"
    with provider_sso:
@@ -354,11 +267,7 @@ async def handle_oauth_token(request: Request, provider: str) -> RedirectRespons
        userinfo = await provider_sso.verify_and_process(request)
        if not userinfo:
            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid user info.")
-        if provider_sso.state is None or provider_sso.state == "null":
-            user_id = None
-        else:
-            user_id = decrypt_internal_message(provider_sso.state)
-
+        user_id = decrypt_internal_message(provider_sso.state)
    request.session.pop("user", None)
    return await _handle_sso_login(userinfo, user_id)

@@ -390,14 +299,12 @@ async def register(data: RegisterUser) -> JSONResponse:
    if not is_valid_username(data.username):
        raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid username.")

-    if await get_account_by_username(data.username, active_only=False):
+    if await get_account_by_username(data.username):
        raise HTTPException(HTTPStatus.BAD_REQUEST, "Username already exists.")

    if data.email and not is_valid_email_address(data.email):
        raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid email.")

-    await check_register_activation_settings(data)
-
    account = Account(
        id=uuid4().hex,
        email=data.email,
@@ -411,20 +318,24 @@ async def register(data: RegisterUser) -> JSONResponse:
@auth_router.put("/pubkey")
 async def update_pubkey(
    data: UpdateUserPubkey,
-    account: Account = Depends(check_account_exists),
+    user: User = Depends(check_user_exists),
    payload: AccessTokenPayload = Depends(access_token_payload),
 ) -> User | None:
-    if data.user_id != account.id:
+    if data.user_id != user.id:
        raise ValueError("Invalid user ID.")

    _validate_auth_timeout(payload.auth_time)
    if (
        data.pubkey
-        and data.pubkey != account.pubkey
+        and data.pubkey != user.pubkey
        and await get_account_by_pubkey(data.pubkey)
    ):
        raise ValueError("Public key already in use.")

+    account = await get_account(user.id)
+    if not account:
+        raise HTTPException(HTTPStatus.NOT_FOUND, "Account not found.")
+
    account.pubkey = normalize_public_key(data.pubkey)
    await update_account(account)
    return await get_user_from_account(account)
@@ -433,19 +344,23 @@ async def update_pubkey(
@auth_router.put("/password")
 async def update_password(
    data: UpdateUserPassword,
-    account: Account = Depends(check_account_exists),
+    user: User = Depends(check_user_exists),
    payload: AccessTokenPayload = Depends(access_token_payload),
 ) -> User | None:
    _validate_auth_timeout(payload.auth_time)
-    if data.user_id != account.id:
+    if data.user_id != user.id:
        raise ValueError("Invalid user ID.")
    if (
        data.username
-        and account.username != data.username
+        and user.username != data.username
        and await get_account_by_username(data.username)
    ):
        raise HTTPException(HTTPStatus.BAD_REQUEST, "Username already exists.")

+    account = await get_account(user.id)
+    if not account:
+        raise ValueError("Account not found.")
+
    # old accounts do not have a password
    if account.password_hash:
        if not data.password_old:
@@ -502,13 +417,17 @@ async def reset_password(data: ResetUserPassword) -> JSONResponse:
    return _auth_success_response(account.username, user_id, account.email)


-@auth_router.patch("")
+@auth_router.put("/update")
 async def update(
-    data: UpdateUser, account: Account = Depends(check_account_exists)
+    data: UpdateUser, user: User = Depends(check_user_exists)
 ) -> User | None:
-    if data.user_id != account.id:
+    if data.user_id != user.id:
        raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid user ID.")

+    account = await get_account(user.id)
+    if not account:
+        raise HTTPException(HTTPStatus.NOT_FOUND, "Account not found.")
+
    if data.username:
        account.username = data.username
    if data.extra:
@@ -518,54 +437,19 @@ async def update(
    return await get_user_from_account(account)


-@auth_router.patch("/ui")
-async def update_ui_customization(
-    req: Request, account: Account = Depends(check_account_exists)
-) -> Account:
-    ui_customization = await req.json()
-    account.ui_customization = {**(account.ui_customization or {}), **ui_customization}
-
-    if len(account.ui_customization or {}) > 1000 * 1024:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST, "UI customization too large. Drop some fields."
-        )
-
-    await update_user_account(account)
-    return account
-
-
@auth_router.put("/first_install")
 async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
    if not settings.first_install:
        raise HTTPException(HTTPStatus.FORBIDDEN, "This is not your first install")
-
-    if settings.first_install_token:
-        if not data.first_install_token:
-            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Missing first_install_token.")
-        if settings.first_install_token != data.first_install_token:
-            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid first_install_token.")
-
-    account = await get_account_by_username(data.username, False)
-    if account:
-        raise HTTPException(HTTPStatus.BAD_REQUEST, "Username already exists.")
-
    account = await get_account(settings.super_user)
    if not account:
        raise HTTPException(HTTPStatus.INTERNAL_SERVER_ERROR, "Superuser not found.")
-
    account.username = data.username
    account.extra = account.extra or UserExtra()
    account.extra.provider = "lnbits"
    account.hash_password(data.password)
    await update_account(account)
    settings.first_install = False
-
-    # only confrm it after the super user has been successfully updated
-    if settings.first_install_token:
-        settings.first_install_token_confirmed = data.first_install_token
-        await set_settings_field(
-            "first_install_token_confirmed", data.first_install_token
-        )
    return _auth_success_response(account.username, account.id, account.email)


@@ -575,7 +459,7 @@ async def _handle_sso_login(userinfo: OpenID, verified_user_id: str | None = Non
        raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid email.")

    redirect_path = "/wallet"
-    account = await get_account_by_email(email, active_only=False)
+    account = await get_account_by_email(email)

    if verified_user_id:
        if account:
@@ -594,7 +478,7 @@ async def _handle_sso_login(userinfo: OpenID, verified_user_id: str | None = Non
            id=uuid4().hex, email=email, extra=UserExtra(email_verified=True)
        )
        await create_user_account(account)
-    return _auth_redirect_response(redirect_path, account.id, email)
+    return _auth_redirect_response(redirect_path, email)


 def _auth_success_response(
@@ -609,20 +493,9 @@ def _auth_success_response(
    max_age = settings.auth_token_expire_minutes * 60
    response = JSONResponse({"access_token": access_token, "token_type": "bearer"})
    response.set_cookie(
-        "cookie_access_token",
-        access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_authorized",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
    response.delete_cookie("is_access_token_expired")

    return response
@@ -639,28 +512,15 @@ def _auth_api_token_response(
    )


-def _auth_redirect_response(path: str, user_id: str, email: str) -> RedirectResponse:
-    payload = AccessTokenPayload(
-        usr=user_id, sub="", email=email, auth_time=int(time())
-    )
+def _auth_redirect_response(path: str, email: str) -> RedirectResponse:
+    payload = AccessTokenPayload(sub="" or "", email=email, auth_time=int(time()))
    access_token = create_access_token(data=payload.dict())
    max_age = settings.auth_token_expire_minutes * 60
    response = RedirectResponse(path)
    response.set_cookie(
-        "cookie_access_token",
-        access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_authorized",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
    response.delete_cookie("is_access_token_expired")
    return response

@@ -680,10 +540,7 @@ def _new_sso(provider: str) -> SSOBase | None:

        sso_provider_class = _find_auth_provider_class(provider)
        sso_provider = sso_provider_class(
-            client_id,
-            client_secret,
-            None,
-            allow_insecure_http=not settings.auth_https_only,
+            client_id, client_secret, None, allow_insecure_http=True
        )
        if (
            discovery_url
@@ -4,30 +4,15 @@ from fastapi import APIRouter, Request
 from loguru import logger

 from lnbits.core.crud.payments import (
-    get_payments,
    get_standalone_payment,
-    update_payment,
 )
-from lnbits.core.models import Payment, PaymentFilters
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.payments import CreateInvoice
 from lnbits.core.services.fiat_providers import (
-    check_fiat_status,
-    check_revolut_signature,
-    check_square_signature,
    check_stripe_signature,
-    verify_paypal_webhook,
 )
-from lnbits.core.services.payments import (
-    create_fiat_invoice,
-    create_wallet_invoice,
-    service_fee_fiat,
-)
-from lnbits.db import Filter, Filters
-from lnbits.fiat import get_fiat_provider
+from lnbits.core.services.payments import create_fiat_invoice
 from lnbits.fiat.base import FiatSubscriptionPaymentOptions
-from lnbits.fiat.revolut import RevolutWallet
-from lnbits.fiat.square import SquareWallet
 from lnbits.settings import settings

 callback_router = APIRouter(prefix="/api/v1/callback", tags=["callback"])
@@ -37,7 +22,7 @@ callback_router = APIRouter(prefix="/api/v1/callback", tags=["callback"])
 async def api_generic_webhook_handler(
    provider_name: str, request: Request
 ) -> SimpleStatus:
-    logger.info(f"Received callback from provider: '{provider_name}'.")
+
    if provider_name.lower() == "stripe":
        payload = await request.body()
        sig_header = request.headers.get("Stripe-Signature")
@@ -52,52 +37,6 @@ async def api_generic_webhook_handler(
            message=f"Callback received successfully from '{provider_name}'.",
        )

-    if provider_name.lower() == "paypal":
-        payload = await request.body()
-        await verify_paypal_webhook(request.headers, payload)
-        event = await request.json()
-        await handle_paypal_event(event)
-
-        return SimpleStatus(
-            success=True,
-            message=f"Callback received successfully from '{provider_name}'.",
-        )
-
-    if provider_name.lower() == "square":
-        payload = await request.body()
-        sig_header = request.headers.get("x-square-hmacsha256-signature")
-        check_square_signature(
-            payload,
-            sig_header,
-            settings.square_webhook_signature_key,
-            settings.square_payment_webhook_url,
-        )
-        event = await request.json()
-        await handle_square_event(event)
-
-        return SimpleStatus(
-            success=True,
-            message=f"Callback received successfully from '{provider_name}'.",
-        )
-
-    if provider_name.lower() == "revolut":
-        payload = await request.body()
-        sig_header = request.headers.get("Revolut-Signature")
-        timestamp_header = request.headers.get("Revolut-Request-Timestamp")
-        check_revolut_signature(
-            payload,
-            sig_header,
-            timestamp_header,
-            settings.revolut_webhook_signing_secret,
-        )
-        event = await request.json()
-        await handle_revolut_event(event)
-
-        return SimpleStatus(
-            success=True,
-            message=f"Callback received successfully from '{provider_name}'.",
-        )
-
    return SimpleStatus(
        success=False,
        message=f"Unknown fiat provider '{provider_name}'.",
@@ -109,8 +48,6 @@ async def handle_stripe_event(event: dict):
    event_type = event.get("type")
    if event_type == "checkout.session.completed":
        await _handle_stripe_checkout_session_completed(event)
-    elif event_type == "payment_intent.succeeded":
-        await _handle_stripe_intent_session_completed(event)
    elif event_type == "invoice.paid":
        await _handle_stripe_subscription_invoice_paid(event)
    else:
@@ -119,38 +56,18 @@ async def handle_stripe_event(event: dict):
        )


-async def _handle_stripe_intent_session_completed(event: dict):
-    event_id = event.get("id")
-    event_object = event.get("data", {}).get("object", {})
-    object_type = event_object.get("object")
-    payment_hash = event_object.get("metadata", {}).get("payment_hash")
-    logger.debug(
-        f"Handling Stripe event: '{event_id}'. Type: '{object_type}'."
-        f" Payment hash: '{payment_hash}'."
-    )
-    if not payment_hash:
-        logger.warning("Stripe event does not contain a payment hash.")
-        return
-
-    payment = await get_standalone_payment(payment_hash)
-    if not payment:
-        logger.warning(f"No payment found for hash: '{payment_hash}'.")
-        return
-    await check_fiat_status(payment)
-
-
 async def _handle_stripe_checkout_session_completed(event: dict):
    event_id = event.get("id")
    event_object = event.get("data", {}).get("object", {})
    object_type = event_object.get("object")
    payment_hash = event_object.get("metadata", {}).get("payment_hash")
-    alan_action = event_object.get("metadata", {}).get("alan_action")
+    lnbits_action = event_object.get("metadata", {}).get("lnbits_action")
    logger.debug(
        f"Handling Stripe event: '{event_id}'. Type: '{object_type}'."
        f" Payment hash: '{payment_hash}'."
    )
-    if alan_action != "invoice":
-        logger.warning(f"Stripe event is not an invoice: '{alan_action}'.")
+    if lnbits_action != "invoice":
+        logger.warning(f"Stripe event is not an invoice: '{lnbits_action}'.")
        return

    if not payment_hash:
@@ -159,7 +76,7 @@ async def _handle_stripe_checkout_session_completed(event: dict):
    payment = await get_standalone_payment(payment_hash)
    if not payment:
        raise ValueError(f"No payment found for hash: '{payment_hash}'.")
-    await check_fiat_status(payment)
+    await payment.check_fiat_status()


 async def _handle_stripe_subscription_invoice_paid(event: dict):
@@ -204,7 +121,7 @@ async def _handle_stripe_subscription_invoice_paid(event: dict):
        ),
    )

-    await check_fiat_status(payment)
+    await payment.check_fiat_status()


 async def _get_stripe_subscription_payment_options(
@@ -215,7 +132,7 @@ async def _get_stripe_subscription_payment_options(

    metadata = parent.get("subscription_details", {}).get("metadata", {})

-    if metadata.get("alan_action") != "subscription":
+    if metadata.get("lnbits_action") != "subscription":
        raise ValueError("Stripe invoice.paid metadata action is not 'subscription'.")

    if "extra" in metadata:
@@ -226,484 +143,3 @@ async def _get_stripe_subscription_payment_options(
            metadata["extra"] = {}

    return FiatSubscriptionPaymentOptions(**metadata)
-
-
-async def handle_paypal_event(event: dict):
-    event_id = event.get("id", "")
-    event_type = event.get("event_type", "")
-    resource = event.get("resource", {})
-    logger.info(f"Handling PayPal event: '{event_id}'. Type: '{event_type}'.")
-
-    if event_type in ("CHECKOUT.ORDER.APPROVED", "PAYMENT.CAPTURE.COMPLETED"):
-        payment_hash = _paypal_extract_payment_hash(resource)
-        if not payment_hash:
-            logger.warning("PayPal event missing payment hash.")
-            return
-        payment = await get_standalone_payment(payment_hash)
-        if not payment:
-            logger.warning(f"No payment found for hash: '{payment_hash}'.")
-            return
-        await check_fiat_status(payment)
-        return
-
-    if event_type in ("PAYMENT.SALE.COMPLETED"):
-        await _handle_paypal_subscription_payment(resource)
-        return
-
-    logger.warning(f"Unhandled PayPal event type: '{event_type}'.")
-
-
-async def _handle_paypal_subscription_payment(resource: dict):
-    amount_info = resource.get("amount") or {}
-    currency = (amount_info.get("currency") or "").upper()
-    total = amount_info.get("total")
-    if not currency or total is None:
-        raise ValueError("PayPal subscription event missing amount.")
-
-    custom_id = resource.get("custom_id") or resource.get("custom")
-    if not custom_id:
-        raise ValueError("PayPal subscription event missing custom metadata.")
-
-    payment_options = _deserialize_paypal_metadata(custom_id)
-    if not payment_options.wallet_id:
-        raise ValueError("PayPal subscription event missing wallet_id.")
-
-    memo = payment_options.memo or ""
-    extra = {
-        **(payment_options.extra or {}),
-        "subscription_request_id": resource.get("billing_agreement_id"),
-        "fiat_method": "subscription",
-        "tag": payment_options.tag,
-        "subscription": {
-            "checking_id": resource.get("id") or resource.get("billing_agreement_id"),
-            "payment_request": "",
-        },
-    }
-
-    payment = await create_fiat_invoice(
-        wallet_id=payment_options.wallet_id,
-        invoice_data=CreateInvoice(
-            unit=currency,
-            amount=float(total),
-            memo=memo,
-            extra=extra,
-            fiat_provider="paypal",
-        ),
-    )
-
-    await check_fiat_status(payment)
-
-
-def _paypal_extract_payment_hash(resource: dict) -> str | None:
-    purchase_units = resource.get("purchase_units") or []
-    for pu in purchase_units:
-        if pu.get("invoice_id"):
-            return pu.get("invoice_id")
-        if pu.get("custom_id"):
-            return pu.get("custom_id")
-    return None
-
-
-def _deserialize_paypal_metadata(custom_id: str) -> FiatSubscriptionPaymentOptions:
-    try:
-        meta = json.loads(custom_id)
-        wallet_id = meta[0] if len(meta) > 0 else None
-        tag = meta[1] if len(meta) > 1 else None
-        subscription_request_id = meta[2] if len(meta) > 2 else None
-        extra_link = meta[3] if len(meta) > 3 else None
-        memo = meta[4] if len(meta) > 4 else None
-
-        extra = {
-            "link": extra_link,
-            "subscription_request_id": subscription_request_id,
-        }
-
-        return FiatSubscriptionPaymentOptions(
-            wallet_id=wallet_id,
-            tag=tag,
-            subscription_request_id=subscription_request_id,
-            extra=extra,
-            memo=memo,
-        )
-    except (json.JSONDecodeError, IndexError) as e:
-        logger.warning(f"Failed to deserialize PayPal metadata: {e}")
-        return FiatSubscriptionPaymentOptions()
-
-
-async def handle_square_event(event: dict):
-    event_id = event.get("event_id") or event.get("id", "")
-    event_type = event.get("type", "")
-    logger.info(f"Handling Square event: '{event_id}'. Type: '{event_type}'.")
-
-    if event_type == "payment.updated":
-        await _handle_square_payment_event(event)
-        return
-
-    if event_type == "invoice.payment_made":
-        await _handle_square_invoice_payment_made(event)
-        return
-
-    logger.warning(f"Unhandled Square event type: '{event_type}'.")
-
-
-async def handle_revolut_event(event: dict):
-    event_type = event.get("event", "")
-    order_id = event.get("order_id")
-    logger.info(f"Handling Revolut event: '{event_type}'. Order ID: '{order_id}'.")
-
-    if event_type in ["ORDER_AUTHORISED", "ORDER_COMPLETED"]:
-        if not order_id:
-            logger.warning("Revolut event missing order_id.")
-            return
-
-        payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-        if payment:
-            await check_fiat_status(payment)
-            return
-
-        if event_type == "ORDER_COMPLETED":
-            logger.warning(f"No payment found for Revolut order: '{order_id}'.")
-            await _handle_revolut_subscription_order_paid(order_id)
-            return
-
-        logger.info(f"Ignoring Revolut authorised order without payment: '{order_id}'.")
-        return
-
-    if event_type == "SUBSCRIPTION_INITIATED":
-        logger.info("Revolut subscription initiated event received.")
-        return
-
-    if event_type in [
-        "SUBSCRIPTION_CANCELLED",
-        "SUBSCRIPTION_FINISHED",
-        "SUBSCRIPTION_OVERDUE",
-    ]:
-        logger.info(f"Revolut subscription lifecycle event received: '{event_type}'.")
-        return
-
-    logger.warning(f"Unhandled Revolut event type: '{event_type}'.")
-
-
-async def _get_revolut_provider() -> RevolutWallet | None:
-    fiat_provider = await get_fiat_provider("revolut")
-    if not isinstance(fiat_provider, RevolutWallet):
-        logger.warning("Revolut fiat provider is not configured.")
-        return None
-    return fiat_provider
-
-
-async def _handle_revolut_subscription(
-    subscription: dict,
-    fiat_provider: RevolutWallet,
-    order_id: str | None = None,
-    order: dict | None = None,
-):
-    subscription_id = subscription.get("id")
-    if not subscription_id:
-        logger.warning("Revolut subscription missing id.")
-        return
-
-    reference = fiat_provider.deserialize_subscription_reference(
-        subscription.get("external_reference")
-    )
-    if not reference:
-        logger.warning("Revolut subscription event missing LNbits metadata.")
-        return
-
-    if not order_id:
-        cycle_id = subscription.get("current_cycle_id")
-        if not cycle_id:
-            logger.warning("Revolut subscription missing current_cycle_id.")
-            return
-
-        cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
-        order_id = cycle.get("order_id")
-        if not order_id:
-            logger.warning("Revolut subscription cycle missing order_id.")
-            return
-
-    existing_payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-    if existing_payment:
-        if existing_payment.external_id != subscription_id:
-            existing_payment.external_id = subscription_id
-            await update_payment(existing_payment)
-        await check_fiat_status(existing_payment)
-        return
-
-    if not order:
-        order = await fiat_provider.get_order(order_id)
-    amount_minor = order.get("amount")
-    currency = (order.get("currency") or "").upper()
-    if amount_minor is None or not currency:
-        raise ValueError("Revolut subscription order missing amount or currency.")
-
-    extra = {
-        **(reference.extra or {}),
-        "subscription_request_id": subscription_id,
-        "fiat_method": "subscription",
-        "tag": reference.tag,
-        "subscription": {
-            "checking_id": f"order_{order_id}",
-            "payment_request": order.get("checkout_url") or "",
-        },
-    }
-    lnbits_payment = await _create_revolut_subscription_payment(
-        wallet_id=reference.wallet_id,
-        amount_minor=amount_minor,
-        currency=currency,
-        memo=reference.memo or "",
-        extra=extra,
-        order_id=order_id,
-        payment_request=order.get("checkout_url") or "",
-        subscription_id=subscription_id,
-    )
-
-    await check_fiat_status(lnbits_payment)
-
-
-async def _handle_revolut_subscription_order_paid(order_id: str):
-    fiat_provider = await _get_revolut_provider()
-    if not fiat_provider:
-        return
-
-    order = await fiat_provider.get_order(order_id)
-    order_type = (order.get("type") or "").lower()
-    order_state = (order.get("state") or "").upper()
-    if order_type != "payment" or order_state != "COMPLETED":
-        logger.warning(f"Revolut order is not a completed payment: '{order_id}'.")
-        return
-
-    channel_data = order.get("channel_data") or {}
-    subscription_id = channel_data.get("subscription_id")
-    if not subscription_id:
-        logger.warning(f"Revolut order missing subscription_id: '{order_id}'.")
-        return
-
-    subscription = await fiat_provider.get_subscription(subscription_id)
-    if subscription.get("state") != "active":
-        logger.warning(f"Revolut subscription is not active: '{subscription_id}'.")
-        return
-
-    await _handle_revolut_subscription(
-        subscription, fiat_provider, order_id=order_id, order=order
-    )
-
-
-async def _create_revolut_subscription_payment(
-    wallet_id: str,
-    amount_minor: int,
-    currency: str,
-    memo: str,
-    extra: dict,
-    order_id: str,
-    payment_request: str,
-    subscription_id: str,
-) -> Payment:
-    amount = RevolutWallet.minor_units_to_amount(amount_minor, currency)
-    payment = await create_wallet_invoice(
-        wallet_id,
-        CreateInvoice(
-            unit=currency,
-            amount=amount,
-            memo=memo,
-            extra=extra,
-            internal=True,
-            external_id=subscription_id,
-        ),
-    )
-    payment.fee = -abs(service_fee_fiat(payment.msat, "revolut"))
-    payment.fiat_provider = "revolut"
-    payment.extra["fiat_checking_id"] = f"order_{order_id}"
-    payment.extra["fiat_payment_request"] = payment_request
-    checking_id = f"fiat_revolut_order_{order_id}"
-    await update_payment(payment, checking_id)
-    payment.checking_id = checking_id
-    return payment
-
-
-async def _handle_square_payment_event(event: dict):
-    payment = _square_extract_payment(event)
-    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
-    if payment_options.wallet_id:
-        if not _square_payment_is_completed(payment):
-            logger.debug("Square subscription payment is not completed yet.")
-            return
-        await _handle_square_subscription_payment(payment, payment_options)
-        return
-
-    order_id = payment.get("order_id")
-    if not order_id:
-        logger.warning("Square payment event missing order_id.")
-        return
-
-    lnbits_payment = await get_standalone_payment(f"fiat_square_order_{order_id}")
-    if not lnbits_payment:
-        logger.warning(f"No payment found for Square order: '{order_id}'.")
-        return
-
-    await check_fiat_status(lnbits_payment)
-
-
-async def _handle_square_invoice_payment_made(event: dict):
-    invoice = event.get("data", {}).get("object", {}).get("invoice") or {}
-    order_id = invoice.get("order_id")
-    if not order_id:
-        logger.warning("Square invoice.payment_made event missing order_id.")
-        return
-    subscription_id = invoice.get("subscription_id")
-
-    fiat_provider = await get_fiat_provider("square")
-    if not isinstance(fiat_provider, SquareWallet):
-        logger.warning("Square fiat provider is not configured.")
-        return
-
-    payment = await fiat_provider.get_payment_for_order(order_id)
-    if not payment:
-        logger.warning(f"No Square payment found for invoice order: '{order_id}'.")
-        return
-
-    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
-    if not payment_options.wallet_id:
-        payment_id = payment.get("id")
-        stored_payment = (
-            await get_standalone_payment(f"fiat_square_payment_{payment_id}")
-            if payment_id
-            else None
-        )
-        if not stored_payment and subscription_id:
-            stored_payments = await get_payments(
-                filters=Filters(
-                    filters=[
-                        Filter.parse_query(
-                            "external_id", [subscription_id], PaymentFilters
-                        )
-                    ],
-                    model=PaymentFilters,
-                    sortby="created_at",
-                    direction="desc",
-                    limit=1,
-                )
-            )
-            stored_payment = stored_payments[0] if stored_payments else None
-        if stored_payment:
-            payment_options = _square_payment_options_from_payment(stored_payment)
-        else:
-            logger.warning("Square subscription payment missing LNbits metadata.")
-            return
-
-    await _handle_square_subscription_payment(
-        payment,
-        payment_options,
-        invoice.get("public_url") or "",
-        square_subscription_id=subscription_id,
-    )
-
-
-async def _handle_square_subscription_payment(
-    payment: dict,
-    payment_options: FiatSubscriptionPaymentOptions,
-    payment_request: str = "",
-    square_subscription_id: str | None = None,
-):
-    amount_money = payment.get("amount_money") or {}
-    amount = amount_money.get("amount")
-    currency = (amount_money.get("currency") or "").upper()
-    payment_id = payment.get("id")
-    if amount is None or not currency or not payment_id:
-        raise ValueError("Square subscription payment event missing payment amount.")
-    wallet_id = payment_options.wallet_id
-    if not wallet_id:
-        raise ValueError("Square subscription payment event missing wallet_id.")
-
-    checking_id = f"payment_{payment_id}"
-    existing_payment = await get_standalone_payment(f"fiat_square_{checking_id}")
-    if existing_payment:
-        if (
-            square_subscription_id
-            and existing_payment.external_id != square_subscription_id
-        ):
-            existing_payment.external_id = square_subscription_id
-            await update_payment(existing_payment)
-        await check_fiat_status(existing_payment)
-        return
-
-    square_subscription_id = square_subscription_id or (
-        payment_options.extra or {}
-    ).get("square_subscription_id")
-    extra = {
-        **(payment_options.extra or {}),
-        "subscription_request_id": payment_options.subscription_request_id,
-        "fiat_method": "subscription",
-        "tag": payment_options.tag,
-        "subscription": {
-            "checking_id": checking_id,
-            "payment_request": payment_request,
-        },
-    }
-
-    lnbits_payment = await create_fiat_invoice(
-        wallet_id=wallet_id,
-        invoice_data=CreateInvoice(
-            unit=currency,
-            amount=amount / 100,
-            memo=payment_options.memo or "",
-            extra=extra,
-            fiat_provider="square",
-            external_id=square_subscription_id,
-        ),
-    )
-
-    await check_fiat_status(lnbits_payment)
-
-
-def _square_payment_options_from_payment(
-    payment: Payment,
-) -> FiatSubscriptionPaymentOptions:
-    extra = payment.extra or {}
-    return FiatSubscriptionPaymentOptions(
-        wallet_id=payment.wallet_id,
-        tag=extra.get("tag") or payment.tag,
-        subscription_request_id=extra.get("subscription_request_id"),
-        extra=extra,
-        memo=payment.memo,
-    )
-
-
-def _square_extract_payment(event: dict) -> dict:
-    event_object = event.get("data", {}).get("object", {})
-    return event_object.get("payment") or event_object
-
-
-def _square_payment_is_completed(payment: dict) -> bool:
-    return (payment.get("status") or "").upper() == "COMPLETED"
-
-
-def _square_payment_note(payment: dict) -> str:
-    return payment.get("note") or payment.get("payment_note") or ""
-
-
-def _deserialize_square_metadata(custom_id: str) -> FiatSubscriptionPaymentOptions:
-    try:
-        meta = json.loads(custom_id)
-        if not isinstance(meta, list):
-            return FiatSubscriptionPaymentOptions()
-        wallet_id = meta[0] if len(meta) > 0 else None
-        tag = meta[1] if len(meta) > 1 else None
-        subscription_request_id = meta[2] if len(meta) > 2 else None
-        extra_link = meta[3] if len(meta) > 3 else None
-        memo = meta[4] if len(meta) > 4 else None
-
-        extra = {
-            "link": extra_link,
-            "subscription_request_id": subscription_request_id,
-        }
-
-        return FiatSubscriptionPaymentOptions(
-            wallet_id=wallet_id,
-            tag=tag,
-            subscription_request_id=subscription_request_id,
-            extra=extra,
-            memo=memo,
-        )
-    except (json.JSONDecodeError, IndexError, TypeError):
-        return FiatSubscriptionPaymentOptions()
@@ -1,73 +1,40 @@
-import json
 import sys
 import traceback
 from http import HTTPStatus

-import httpx
 from bolt11 import decode as bolt11_decode
 from fastapi import APIRouter, Depends, HTTPException
-from fastapi.requests import Request
 from loguru import logger

 from lnbits.core.crud.extensions import get_user_extensions
-from lnbits.core.crud.wallets import get_wallet, get_wallets_ids
-from lnbits.core.db import db
 from lnbits.core.models import (
    SimpleStatus,
+    User,
 )
 from lnbits.core.models.extensions import (
    CreateExtension,
-    CreateExtensionReview,
    Extension,
-    ExtensionBackgroundPaymentDestinationPolicy,
-    ExtensionBackgroundPaymentGrant,
-    ExtensionBackgroundPaymentGrantRequest,
    ExtensionConfig,
    ExtensionMeta,
-    ExtensionPermissionCheckRequest,
-    ExtensionPermissionCheckResponse,
-    ExtensionPermissionCheckResult,
-    ExtensionPermissionsResponse,
    ExtensionRelease,
-    ExtensionReview,
-    ExtensionReviewPaymentRequest,
-    ExtensionReviewsStatus,
-    ExtensionWalletPaymentsWatchGrant,
-    ExtensionWalletPaymentsWatchGrantRequest,
    InstallableExtension,
    PayToEnableInfo,
    ReleasePaymentInfo,
    UserExtension,
    UserExtensionInfo,
-    WasmInvocation,
-    WasmInvocationStats,
-    WasmRuntimeLimitsInfo,
-    WasmRuntimeLimitsUpdate,
-    wasm_extension_icon_url,
 )
-from lnbits.core.models.users import Account, AccountId
 from lnbits.core.services import check_transaction_status, create_invoice
 from lnbits.core.services.extensions import (
    activate_extension,
    deactivate_extension,
-    get_current_wasm_invocations,
    get_valid_extension,
    get_valid_extensions,
-    get_wasm_invocation_history,
-    get_wasm_invocation_summary,
    install_extension,
-    resolve_wasm_runtime_limits,
-    stop_wasm_invocation,
    uninstall_extension,
-    update_wasm_extension_runtime_limits,
-    validate_wasm_runtime_limit_overrides,
 )
-from lnbits.core.wasm_ext.api.permissions import validate_extension_permissions
-from lnbits.db import Page
 from lnbits.decorators import (
-    check_account_exists,
-    check_account_id_exists,
    check_admin,
+    check_user_exists,
 )
 from lnbits.settings import settings

@@ -89,9 +56,6 @@ extension_router = APIRouter(
    prefix="/api/v1/extension",
 )

-WALLET_PAY_INVOICE_BACKGROUND_PERMISSION = "wallet.pay_invoice_background"
-WALLET_PAYMENTS_WATCH_PERMISSION = "wallet.payments.watch"
-

@extension_router.post("", dependencies=[Depends(check_admin)])
 async def api_install_extension(data: CreateExtension):
@@ -115,9 +79,7 @@ async def api_install_extension(data: CreateExtension):
    )

    try:
-        extension = await install_extension(
-            ext_info, granted_permissions=data.permissions
-        )
+        extension = await install_extension(ext_info)

    except Exception as exc:
        logger.warning(exc)
@@ -126,16 +88,12 @@ async def api_install_extension(data: CreateExtension):
        ext_info.clean_extension_files()
        detail = (
            str(exc)
-            if isinstance(exc, (AssertionError, ValueError))
+            if isinstance(exc, AssertionError)
            else f"Failed to install extension '{ext_info.id}'."
            f"({ext_info.installed_version})."
        )
        raise HTTPException(
-            status_code=(
-                HTTPStatus.BAD_REQUEST
-                if isinstance(exc, (AssertionError, ValueError))
-                else HTTPStatus.INTERNAL_SERVER_ERROR
-            ),
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
            detail=detail,
        ) from exc

@@ -156,106 +114,6 @@ async def api_install_extension(data: CreateExtension):
        ) from exc


-@extension_router.get(
-    "/wasm/invocations/current",
-    dependencies=[Depends(check_admin)],
-)
-async def api_get_current_wasm_invocations(
-    extension_id: str | None = None,
-) -> list[WasmInvocation]:
-    return get_current_wasm_invocations(extension_id=extension_id)
-
-
-@extension_router.get(
-    "/wasm/invocations",
-    dependencies=[Depends(check_admin)],
-)
-async def api_get_wasm_invocations(
-    extension_id: str | None = None,
-    status: str | None = None,
-    limit: int = 100,
-    offset: int = 0,
-) -> list[WasmInvocation]:
-    return await get_wasm_invocation_history(
-        extension_id=extension_id,
-        status=status,
-        limit=limit,
-        offset=offset,
-    )
-
-
-@extension_router.get(
-    "/wasm/invocations/stats",
-    dependencies=[Depends(check_admin)],
-)
-async def api_get_wasm_invocation_stats(
-    extension_id: str | None = None,
-    hours: int = 24,
-) -> WasmInvocationStats:
-    return await get_wasm_invocation_summary(extension_id=extension_id, hours=hours)
-
-
-@extension_router.post(
-    "/wasm/invocations/{invocation_id}/stop",
-    dependencies=[Depends(check_admin)],
-)
-async def api_stop_wasm_invocation(invocation_id: str) -> SimpleStatus:
-    await stop_wasm_invocation(invocation_id, reason="Stopped by admin.")
-    return SimpleStatus(success=True, message="WASM invocation stop requested.")
-
-
-@extension_router.get(
-    "/wasm/runtime-limits/extensions",
-    dependencies=[Depends(check_admin)],
-)
-async def api_get_wasm_runtime_limit_extensions() -> list[WasmRuntimeLimitsInfo]:
-    installed_extensions = await get_installed_extensions()
-    return [
-        WasmRuntimeLimitsInfo(
-            id=extension.id,
-            name=extension.name,
-            active=extension.active,
-            wasm_runtime_limits=validate_wasm_runtime_limit_overrides(
-                extension.wasm_runtime_limits,
-                strict=False,
-            ),
-            effective_wasm_runtime_limits=resolve_wasm_runtime_limits(extension),
-        )
-        for extension in installed_extensions
-        if extension.is_wasm
-    ]
-
-
-@extension_router.put(
-    "/wasm/runtime-limits/{ext_id}",
-    dependencies=[Depends(check_admin)],
-)
-async def api_update_wasm_runtime_limits(
-    ext_id: str,
-    data: WasmRuntimeLimitsUpdate,
-) -> WasmRuntimeLimitsInfo:
-    try:
-        wasm_runtime_limits = await update_wasm_extension_runtime_limits(
-            ext_id, data.limits
-        )
-        extension = await get_installed_extension(ext_id)
-        if not extension:
-            raise ValueError(f"Extension '{ext_id}' is not installed.")
-        extension.wasm_runtime_limits = wasm_runtime_limits
-        return WasmRuntimeLimitsInfo(
-            id=extension.id,
-            name=extension.name,
-            active=extension.active,
-            wasm_runtime_limits=wasm_runtime_limits,
-            effective_wasm_runtime_limits=resolve_wasm_runtime_limits(extension),
-        )
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail=str(exc),
-        ) from exc
-
-
@extension_router.get("/{ext_id}/details")
 async def api_extension_details(
    ext_id: str,
@@ -284,10 +142,9 @@ async def api_extension_details(
 async def api_update_pay_to_enable(
    ext_id: str,
    data: PayToEnableInfo,
-    account: Account = Depends(check_admin),
+    user: User = Depends(check_admin),
 ) -> SimpleStatus:
-    user_wallet_ids = await get_wallets_ids(account.id, deleted=False)
-    if data.wallet not in user_wallet_ids:
+    if data.wallet not in user.wallet_ids:
        raise HTTPException(
            HTTPStatus.BAD_REQUEST, "Wallet does not belong to this admin user."
        )
@@ -306,7 +163,7 @@ async def api_update_pay_to_enable(

@extension_router.put("/{ext_id}/enable")
 async def api_enable_extension(
-    ext_id: str, account_id: AccountId = Depends(check_account_id_exists)
+    ext_id: str, user: User = Depends(check_user_exists)
 ) -> SimpleStatus:
    if ext_id not in [e.code for e in await get_valid_extensions()]:
        raise HTTPException(
@@ -320,12 +177,12 @@ async def api_enable_extension(
    if not ext.active:
        raise ValueError(f"Extension '{ext_id}' is not activated.")

-    user_ext = await get_user_extension(account_id.id, ext_id)
+    user_ext = await get_user_extension(user.id, ext_id)
    if not user_ext:
-        user_ext = UserExtension(user=account_id.id, extension=ext_id, active=False)
+        user_ext = UserExtension(user=user.id, extension=ext_id, active=False)
        await create_user_extension(user_ext)

-    if account_id.is_admin_id or not ext.requires_payment:
+    if user.admin or not ext.requires_payment:
        user_ext.active = True
        await update_user_extension(user_ext)
        return SimpleStatus(success=True, message=f"Extension '{ext_id}' enabled.")
@@ -362,13 +219,13 @@ async def api_enable_extension(

@extension_router.put("/{ext_id}/disable")
 async def api_disable_extension(
-    ext_id: str, account_id: AccountId = Depends(check_account_id_exists)
+    ext_id: str, user: User = Depends(check_user_exists)
 ) -> SimpleStatus:
    if ext_id not in [e.code for e in await get_valid_extensions()]:
        raise HTTPException(
            HTTPStatus.BAD_REQUEST, f"Extension '{ext_id}' doesn't exist."
        )
-    user_ext = await get_user_extension(account_id.id, ext_id)
+    user_ext = await get_user_extension(user.id, ext_id)
    if not user_ext or not user_ext.active:
        return SimpleStatus(
            success=True, message=f"Extension '{ext_id}' already disabled."
@@ -379,213 +236,6 @@ async def api_disable_extension(
    return SimpleStatus(success=True, message=f"Extension '{ext_id}' disabled.")


-@extension_router.post("/{ext_id}/permissions/background-payment")
-async def api_grant_background_payment_permission(
-    ext_id: str,
-    data: ExtensionBackgroundPaymentGrantRequest,
-    account_id: AccountId = Depends(check_account_id_exists),
-) -> dict:
-    installed_ext = await get_installed_extension(ext_id)
-    if not installed_ext or not installed_ext.active:
-        raise HTTPException(
-            HTTPStatus.NOT_FOUND, f"Extension '{ext_id}' is not active."
-        )
-
-    installed_permission_ids = {
-        permission.id for permission in installed_ext.permissions or []
-    }
-    if WALLET_PAY_INVOICE_BACKGROUND_PERMISSION not in installed_permission_ids:
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN,
-            f"Extension '{ext_id}' cannot request background payments.",
-        )
-
-    user_ext = await get_user_extension(account_id.id, ext_id)
-    if not user_ext or not user_ext.active:
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN,
-            f"Extension '{ext_id}' is not enabled for this user.",
-        )
-
-    wallet = await get_wallet(data.wallet_id)
-    if not wallet or wallet.user != account_id.id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "Not your wallet.")
-    if wallet.is_lightning_shared_wallet:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            "Background payments are not allowed from shared wallets.",
-        )
-    if not wallet.can_send_payments:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            "This wallet cannot send payments.",
-        )
-
-    permissions = user_ext.permissions or {}
-    grant = data.to_grant(
-        _user_permission_grant_id_for_wallet(
-            permissions,
-            WALLET_PAY_INVOICE_BACKGROUND_PERMISSION,
-            data.wallet_id,
-        )
-    )
-    background_grants = [
-        existing
-        for existing in permissions.get(WALLET_PAY_INVOICE_BACKGROUND_PERMISSION, [])
-        if isinstance(existing, dict) and existing.get("wallet_id") != grant.wallet_id
-    ]
-    background_grants.append(json.loads(grant.json()))
-    permissions[WALLET_PAY_INVOICE_BACKGROUND_PERMISSION] = background_grants
-    user_ext.permissions = permissions
-    await update_user_extension(user_ext)
-    return {"permission": WALLET_PAY_INVOICE_BACKGROUND_PERMISSION, "grant": grant}
-
-
-@extension_router.post("/{ext_id}/permissions/wallet-payments-watch")
-async def api_grant_wallet_payments_watch_permission(
-    ext_id: str,
-    data: ExtensionWalletPaymentsWatchGrantRequest,
-    account_id: AccountId = Depends(check_account_id_exists),
-) -> dict:
-    installed_ext = await get_installed_extension(ext_id)
-    if not installed_ext or not installed_ext.active:
-        raise HTTPException(
-            HTTPStatus.NOT_FOUND, f"Extension '{ext_id}' is not active."
-        )
-
-    installed_permission_ids = {
-        permission.id for permission in installed_ext.permissions or []
-    }
-    if WALLET_PAYMENTS_WATCH_PERMISSION not in installed_permission_ids:
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN,
-            f"Extension '{ext_id}' cannot request wallet payment watch access.",
-        )
-
-    user_ext = await get_user_extension(account_id.id, ext_id)
-    if not user_ext or not user_ext.active:
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN,
-            f"Extension '{ext_id}' is not enabled for this user.",
-        )
-
-    wallet = await get_wallet(data.wallet_id)
-    if not wallet or wallet.user != account_id.id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "Not your wallet.")
-
-    permissions = user_ext.permissions or {}
-    grant = data.to_grant(
-        _user_permission_grant_id_for_wallet(
-            permissions,
-            WALLET_PAYMENTS_WATCH_PERMISSION,
-            data.wallet_id,
-        )
-    )
-    watch_grants = [
-        existing
-        for existing in permissions.get(WALLET_PAYMENTS_WATCH_PERMISSION, [])
-        if isinstance(existing, dict) and existing.get("wallet_id") != grant.wallet_id
-    ]
-    watch_grants.append(json.loads(grant.json()))
-    permissions[WALLET_PAYMENTS_WATCH_PERMISSION] = watch_grants
-    user_ext.permissions = permissions
-    await update_user_extension(user_ext)
-    return {"permission": WALLET_PAYMENTS_WATCH_PERMISSION, "grant": grant}
-
-
-@extension_router.get("/{ext_id}/permissions")
-async def api_get_extension_permissions(
-    ext_id: str,
-    account_id: AccountId = Depends(check_account_id_exists),
-) -> ExtensionPermissionsResponse:
-    installed_ext = await _require_active_wasm_extension(ext_id)
-    extension_permissions = validate_extension_permissions(
-        installed_ext.id, installed_ext.permissions, strict=False
-    )
-    user_ext = await get_user_extension(account_id.id, ext_id)
-    return ExtensionPermissionsResponse(
-        extension_permissions=extension_permissions,
-        user_permissions=_safe_user_extension_permissions(
-            user_ext.permissions if user_ext else {}
-        ),
-    )
-
-
-@extension_router.delete("/{ext_id}/permissions/user/{grant_id}")
-async def api_delete_user_extension_permission(
-    ext_id: str,
-    grant_id: str,
-    account_id: AccountId = Depends(check_account_id_exists),
-) -> SimpleStatus:
-    await _require_active_wasm_extension(ext_id)
-
-    user_ext = await get_user_extension(account_id.id, ext_id)
-    if not user_ext:
-        return SimpleStatus(success=True, message="Permission grant removed.")
-
-    user_ext.permissions = _remove_user_permission_grant(
-        user_ext.permissions or {}, grant_id
-    )
-    await update_user_extension(user_ext)
-    return SimpleStatus(success=True, message="Permission grant removed.")
-
-
-@extension_router.post("/{ext_id}/permissions/check")
-async def api_check_extension_permissions(
-    ext_id: str,
-    data: ExtensionPermissionCheckRequest,
-    account_id: AccountId = Depends(check_account_id_exists),
-) -> ExtensionPermissionCheckResponse:
-    installed_ext = await get_installed_extension(ext_id)
-    if not installed_ext or not installed_ext.active:
-        raise HTTPException(
-            HTTPStatus.NOT_FOUND, f"Extension '{ext_id}' is not active."
-        )
-
-    installed_permission_ids = {
-        permission.id for permission in installed_ext.permissions or []
-    }
-
-    user_ext = await get_user_extension(account_id.id, ext_id)
-    if not user_ext or not user_ext.active:
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN,
-            f"Extension '{ext_id}' is not enabled for this user.",
-        )
-
-    results: list[ExtensionPermissionCheckResult] = []
-    for permission in data.permissions:
-        if permission.id not in installed_permission_ids:
-            raise HTTPException(
-                HTTPStatus.FORBIDDEN,
-                f"Extension '{ext_id}' cannot request '{permission.id}'.",
-            )
-        if permission.id == WALLET_PAY_INVOICE_BACKGROUND_PERMISSION:
-            results.append(
-                await _check_background_payment_permission(
-                    account_id.id,
-                    user_ext.permissions or {},
-                    permission.grant,
-                )
-            )
-            continue
-        if permission.id == WALLET_PAYMENTS_WATCH_PERMISSION:
-            results.append(
-                await _check_wallet_payments_watch_permission(
-                    account_id.id,
-                    user_ext.permissions or {},
-                    permission.grant,
-                )
-            )
-            continue
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            f"Unsupported permission check '{permission.id}'.",
-        )
-
-    return ExtensionPermissionCheckResponse(permissions=results)
-
-
@extension_router.put("/{ext_id}/activate", dependencies=[Depends(check_admin)])
 async def api_activate_extension(ext_id: str) -> SimpleStatus:
    try:
@@ -627,6 +277,7 @@ async def api_deactivate_extension(ext_id: str) -> SimpleStatus:

@extension_router.delete("/{ext_id}", dependencies=[Depends(check_admin)])
 async def api_uninstall_extension(ext_id: str) -> SimpleStatus:
+
    extension = await get_installed_extension(ext_id)
    if not extension:
        raise HTTPException(
@@ -725,9 +376,7 @@ async def get_pay_to_install_invoice(

@extension_router.put("/{ext_id}/invoice/enable")
 async def get_pay_to_enable_invoice(
-    ext_id: str,
-    data: PayToEnableInfo,
-    account_id: AccountId = Depends(check_account_id_exists),
+    ext_id: str, data: PayToEnableInfo, user: User = Depends(check_user_exists)
 ):
    if not data.amount or data.amount <= 0:
        raise HTTPException(
@@ -773,9 +422,9 @@ async def get_pay_to_enable_invoice(
        memo=f"Enable '{ext.name}' extension.",
    )

-    user_ext = await get_user_extension(account_id.id, ext_id)
+    user_ext = await get_user_extension(user.id, ext_id)
    if not user_ext:
-        user_ext = UserExtension(user=account_id.id, extension=ext_id, active=False)
+        user_ext = UserExtension(user=user.id, extension=ext_id, active=False)
        await create_user_extension(user_ext)
    user_ext_info = user_ext.extra if user_ext.extra else UserExtensionInfo()
    user_ext_info.payment_hash_to_enable = payment.payment_hash
@@ -786,7 +435,7 @@ async def get_pay_to_enable_invoice(

@extension_router.get(
    "/release/{org}/{repo}/{tag_name}",
-    dependencies=[Depends(check_account_exists)],
+    dependencies=[Depends(check_user_exists)],
 )
 async def get_extension_release(org: str, repo: str, tag_name: str):
    try:
@@ -794,19 +443,11 @@ async def get_extension_release(org: str, repo: str, tag_name: str):
        if not config:
            return {}

-        permissions = validate_extension_permissions(config.name, config.permissions)
-
        return {
            "min_lnbits_version": config.min_lnbits_version,
            "is_version_compatible": config.is_version_compatible(),
            "warning": config.warning,
-            "extension_type": config.extension_type,
-            "permissions": [dict(permission) for permission in permissions],
        }
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST, detail=str(exc)
-        ) from exc
    except Exception as exc:
        raise HTTPException(
            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(exc)
@@ -815,18 +456,15 @@ async def get_extension_release(org: str, repo: str, tag_name: str):

@extension_router.get("")
 async def api_get_user_extensions(
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ) -> list[Extension]:
-    async with db.connect() as conn:
-        user_extensions_ids = [
-            ue.extension for ue in await get_user_extensions(account_id.id, conn=conn)
-        ]
-        valid_extensions = [
-            ext
-            for ext in await get_valid_extensions(False, conn=conn)
-            if ext.code in user_extensions_ids
-        ]
-        return valid_extensions
+
+    user_extensions_ids = [ue.extension for ue in await get_user_extensions(user.id)]
+    return [
+        ext
+        for ext in await get_valid_extensions(False)
+        if ext.code in user_extensions_ids
+    ]


@extension_router.delete(
@@ -860,31 +498,19 @@ async def delete_extension_db(ext_id: str):

 # TODO: create a response model for this
@extension_router.get("/all")
-async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
-    async with db.connect() as conn:
-        installed_exts: list[InstallableExtension] = await get_installed_extensions(
-            conn=conn
-        )
-        all_ext_ids = [ext.code for ext in await get_valid_extensions(conn=conn)]
-        inactive_extensions = [
-            e.id for e in await get_installed_extensions(active=False, conn=conn)
-        ]
-        db_versions = await get_db_versions(conn=conn)
-
+async def extensions(user: User = Depends(check_user_exists)):
+    installed_exts: list[InstallableExtension] = await get_installed_extensions()
    installed_exts_ids = [e.id for e in installed_exts]

-    installable_exts = await InstallableExtension.get_installable_extensions(
-        post_refresh_cache=account_id.is_admin_id
-    )
+    installable_exts = await InstallableExtension.get_installable_extensions()
    installable_exts_ids = [e.id for e in installable_exts]
    installable_exts += [e for e in installed_exts if e.id not in installable_exts_ids]
-    installed_exts_by_id = {e.id: e for e in installed_exts}

    for e in installable_exts:
-        installed_ext = installed_exts_by_id.get(e.id)
+        installed_ext = next((ie for ie in installed_exts if e.id == ie.id), None)
        if installed_ext and installed_ext.meta:
            installed_release = installed_ext.meta.installed_release
-            if installed_ext.meta.pay_to_enable and not account_id.is_admin_id:
+            if installed_ext.meta.pay_to_enable and not user.admin:
                # not a security leak, but better not to share the wallet id
                installed_ext.meta.pay_to_enable.wallet = None
            pay_to_enable = installed_ext.meta.pay_to_enable
@@ -902,279 +528,48 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
            e.short_description = installed_ext.short_description
            e.icon = installed_ext.icon

-    extension_data = []
-    for ext in installable_exts:
-        installed_ext = installed_exts_by_id.get(ext.id)
-        is_wasm = installed_ext.is_wasm if installed_ext else ext.is_wasm
-        icon = wasm_extension_icon_url(ext.id) if is_wasm else ext.icon
-        permissions = (
-            validate_extension_permissions(
-                installed_ext.id, installed_ext.permissions, strict=False
-            )
-            if installed_ext
-            else []
-        )
-        extension_data.append(
-            {
-                "id": ext.id,
-                "name": ext.name,
-                "icon": icon,
-                "shortDescription": ext.short_description,
-                "stars": ext.stars,
-                "isFeatured": ext.meta.featured if ext.meta else False,
-                "categories": ext.meta.categories if ext.meta else [],
-                "dependencies": ext.meta.dependencies if ext.meta else "",
-                "isInstalled": ext.id in installed_exts_ids,
-                "hasDatabaseTables": next(
-                    (True for version in db_versions if version.db == ext.id), False
-                ),
-                "isAvailable": ext.id in all_ext_ids,
-                "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
-                "isActive": ext.id not in inactive_extensions,
-                "latestRelease": (
-                    dict(ext.meta.latest_release)
-                    if ext.meta and ext.meta.latest_release
-                    else None
-                ),
-                "hasPaidRelease": ext.meta.has_paid_release if ext.meta else False,
-                "hasFreeRelease": ext.meta.has_free_release if ext.meta else False,
-                "paidFeatures": ext.meta.paid_features if ext.meta else False,
-                "installedRelease": (
-                    dict(ext.meta.installed_release)
-                    if ext.meta and ext.meta.installed_release
-                    else None
-                ),
-                "payToEnable": (
-                    dict(ext.meta.pay_to_enable)
-                    if ext.meta and ext.meta.pay_to_enable
-                    else {}
-                ),
-                "isPaymentRequired": ext.requires_payment,
-                "isWasm": is_wasm,
-                "permissions": [dict(permission) for permission in permissions],
-                "inProgress": False,
-                "selectedForUpdate": False,
-            }
-        )
+    all_ext_ids = [ext.code for ext in await get_valid_extensions()]
+    inactive_extensions = [e.id for e in await get_installed_extensions(active=False)]
+    db_versions = await get_db_versions()
+
+    extension_data = [
+        {
+            "id": ext.id,
+            "name": ext.name,
+            "icon": ext.icon,
+            "shortDescription": ext.short_description,
+            "stars": ext.stars,
+            "isFeatured": ext.meta.featured if ext.meta else False,
+            "dependencies": ext.meta.dependencies if ext.meta else "",
+            "isInstalled": ext.id in installed_exts_ids,
+            "hasDatabaseTables": next(
+                (True for version in db_versions if version.db == ext.id), False
+            ),
+            "isAvailable": ext.id in all_ext_ids,
+            "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
+            "isActive": ext.id not in inactive_extensions,
+            "latestRelease": (
+                dict(ext.meta.latest_release)
+                if ext.meta and ext.meta.latest_release
+                else None
+            ),
+            "hasPaidRelease": ext.meta.has_paid_release if ext.meta else False,
+            "hasFreeRelease": ext.meta.has_free_release if ext.meta else False,
+            "paidFeatures": ext.meta.paid_features if ext.meta else False,
+            "installedRelease": (
+                dict(ext.meta.installed_release)
+                if ext.meta and ext.meta.installed_release
+                else None
+            ),
+            "payToEnable": (
+                dict(ext.meta.pay_to_enable)
+                if ext.meta and ext.meta.pay_to_enable
+                else {}
+            ),
+            "isPaymentRequired": ext.requires_payment,
+            "inProgress": False,
+            "selectedForUpdate": False,
+        }
+        for ext in installable_exts
+    ]
    return extension_data
-
-
-@extension_router.get(
-    "/reviews/tags",
-    dependencies=[Depends(check_account_exists)],
-)
-async def get_extension_reviews_tags() -> list[ExtensionReviewsStatus]:
-    async with httpx.AsyncClient() as client:
-        resp = await client.get(settings.lnbits_extensions_reviews_url + "/tags")
-        resp.raise_for_status()
-        data = resp.json()
-        return [ExtensionReviewsStatus(**item) for item in data]
-
-
-@extension_router.get(
-    "/reviews/{ext_id}",
-    dependencies=[Depends(check_account_exists)],
-)
-async def get_extension_reviews(ext_id: str, request: Request) -> Page[ExtensionReview]:
-    async with httpx.AsyncClient() as client:
-        query_string = str(request.query_params)
-        resp = await client.get(
-            settings.lnbits_extensions_reviews_url + f"/reviews/{ext_id}?{query_string}"
-        )
-        resp.raise_for_status()
-        reviews = resp.json()
-        return Page(
-            data=[ExtensionReview(**item) for item in reviews["data"]],
-            total=reviews["total"],
-        )
-
-
-@extension_router.put(
-    "/reviews",
-    dependencies=[Depends(check_account_exists)],
-)
-async def create_extension_review(
-    data: CreateExtensionReview,
-) -> ExtensionReviewPaymentRequest:
-    async with httpx.AsyncClient() as client:
-        resp = await client.post(
-            settings.lnbits_extensions_reviews_url + "/reviews", json=data.dict()
-        )
-        resp.raise_for_status()
-        payment_request = resp.json()
-        return ExtensionReviewPaymentRequest(**payment_request)
-
-
-async def _require_active_wasm_extension(ext_id: str) -> InstallableExtension:
-    installed_ext = await get_installed_extension(ext_id)
-    if not installed_ext or not installed_ext.active:
-        raise HTTPException(
-            HTTPStatus.NOT_FOUND, f"Extension '{ext_id}' is not active."
-        )
-    if not installed_ext.is_wasm:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST, f"Extension '{ext_id}' is not a WASM extension."
-        )
-    return installed_ext
-
-
-def _safe_user_extension_permissions(permissions: dict | None) -> dict:
-    safe_permissions: dict[str, list[dict]] = {}
-    for permission_id, grants in (permissions or {}).items():
-        if not isinstance(permission_id, str) or not isinstance(grants, list):
-            continue
-        safe_grants = [
-            grant
-            for grant in grants
-            if isinstance(grant, dict) and isinstance(grant.get("id"), str)
-        ]
-        if safe_grants:
-            safe_permissions[permission_id] = safe_grants
-    return safe_permissions
-
-
-def _user_permission_grant_id_for_wallet(
-    permissions: dict, permission_id: str, wallet_id: str
-) -> str | None:
-    grants = permissions.get(permission_id)
-    if not isinstance(grants, list):
-        return None
-
-    for grant in grants:
-        if not isinstance(grant, dict) or grant.get("wallet_id") != wallet_id:
-            continue
-        grant_id = grant.get("id")
-        return grant_id if isinstance(grant_id, str) and grant_id else None
-    return None
-
-
-def _remove_user_permission_grant(permissions: dict, grant_id: str) -> dict:
-    updated_permissions = dict(permissions or {})
-    for permission_id, grants in list(updated_permissions.items()):
-        if not isinstance(grants, list):
-            continue
-
-        remaining_grants = [
-            grant
-            for grant in grants
-            if not isinstance(grant, dict) or grant.get("id") != grant_id
-        ]
-        if remaining_grants:
-            updated_permissions[permission_id] = remaining_grants
-        else:
-            updated_permissions.pop(permission_id, None)
-    return updated_permissions
-
-
-async def _check_background_payment_permission(
-    account_id: str,
-    permissions: dict,
-    grant_data: dict,
-) -> ExtensionPermissionCheckResult:
-    try:
-        data = ExtensionBackgroundPaymentGrantRequest.parse_obj(grant_data)
-    except ValueError as exc:
-        raise HTTPException(HTTPStatus.BAD_REQUEST, str(exc)) from exc
-
-    wallet = await get_wallet(data.wallet_id)
-    if not wallet or wallet.user != account_id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "Not your wallet.")
-    if wallet.is_lightning_shared_wallet:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            "Background payments are not allowed from shared wallets.",
-        )
-    if not wallet.can_send_payments:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            "This wallet cannot send payments.",
-        )
-
-    requested_grant = data.to_grant()
-    existing_grant = _find_background_payment_grant(
-        permissions, requested_grant.wallet_id
-    )
-    covered = (
-        existing_grant is not None
-        and existing_grant.enabled
-        and existing_grant.max_amount >= requested_grant.max_amount
-        and _background_destination_policy_covers(
-            existing_grant.destination_policy, requested_grant.destination_policy
-        )
-    )
-    grant = existing_grant if covered and existing_grant else requested_grant
-    return ExtensionPermissionCheckResult(
-        id=WALLET_PAY_INVOICE_BACKGROUND_PERMISSION,
-        approved=covered,
-        grant=json.loads(grant.json()),
-    )
-
-
-async def _check_wallet_payments_watch_permission(
-    account_id: str,
-    permissions: dict,
-    grant_data: dict,
-) -> ExtensionPermissionCheckResult:
-    try:
-        data = ExtensionWalletPaymentsWatchGrantRequest.parse_obj(grant_data)
-    except ValueError as exc:
-        raise HTTPException(HTTPStatus.BAD_REQUEST, str(exc)) from exc
-
-    wallet = await get_wallet(data.wallet_id)
-    if not wallet or wallet.user != account_id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "Not your wallet.")
-
-    existing_grant = _find_wallet_payments_watch_grant(permissions, data.wallet_id)
-    covered = bool(existing_grant and existing_grant.enabled)
-    grant = existing_grant if covered and existing_grant else data.to_grant()
-    return ExtensionPermissionCheckResult(
-        id=WALLET_PAYMENTS_WATCH_PERMISSION,
-        approved=covered,
-        grant=json.loads(grant.json()),
-    )
-
-
-def _find_background_payment_grant(
-    permissions: dict, wallet_id: str
-) -> ExtensionBackgroundPaymentGrant | None:
-    grants = permissions.get(WALLET_PAY_INVOICE_BACKGROUND_PERMISSION)
-    if not isinstance(grants, list):
-        return None
-    for grant_data in grants:
-        if not isinstance(grant_data, dict):
-            continue
-        try:
-            grant = ExtensionBackgroundPaymentGrant.parse_obj(grant_data)
-        except ValueError:
-            continue
-        if grant.wallet_id == wallet_id:
-            return grant
-    return None
-
-
-def _find_wallet_payments_watch_grant(
-    permissions: dict, wallet_id: str
-) -> ExtensionWalletPaymentsWatchGrant | None:
-    grants = permissions.get(WALLET_PAYMENTS_WATCH_PERMISSION)
-    if not isinstance(grants, list):
-        return None
-    for grant_data in grants:
-        if not isinstance(grant_data, dict):
-            continue
-        try:
-            grant = ExtensionWalletPaymentsWatchGrant.parse_obj(grant_data)
-        except ValueError:
-            continue
-        if grant.wallet_id == wallet_id:
-            return grant
-    return None
-
-
-def _background_destination_policy_covers(
-    existing: ExtensionBackgroundPaymentDestinationPolicy,
-    requested: ExtensionBackgroundPaymentDestinationPolicy,
-) -> bool:
-    return (
-        existing == requested
-        or existing == ExtensionBackgroundPaymentDestinationPolicy.EXTERNAL_ALLOWED
-    )
@@ -7,6 +7,7 @@ from fastapi.responses import FileResponse

 from lnbits.core.models import (
    SimpleStatus,
+    User,
 )
 from lnbits.core.models.extensions import (
    Extension,
@@ -15,7 +16,6 @@ from lnbits.core.models.extensions import (
    UserExtension,
 )
 from lnbits.core.models.extensions_builder import ExtensionData
-from lnbits.core.models.users import Account, AccountId
 from lnbits.core.services.extensions import (
    activate_extension,
    install_extension,
@@ -26,9 +26,9 @@ from lnbits.core.services.extensions_builder import (
    zip_directory,
 )
 from lnbits.decorators import (
-    check_account_id_exists,
    check_admin,
    check_extension_builder,
+    check_user_exists,
 )

 from ..crud import (
@@ -84,9 +84,9 @@ async def api_build_extension(data: ExtensionData) -> FileResponse:
 )
 async def api_deploy_extension(
    data: ExtensionData,
-    account: Account = Depends(check_admin),
+    user: User = Depends(check_admin),
 ) -> SimpleStatus:
-    working_dir_name = "deploy_" + sha256(account.id.encode("utf-8")).hexdigest()
+    working_dir_name = "deploy_" + sha256(user.id.encode("utf-8")).hexdigest()
    stub_ext_id = "extension_builder_stub"
    release, build_dir = await build_extension_from_data(
        data, stub_ext_id, working_dir_name
@@ -110,9 +110,9 @@ async def api_deploy_extension(

    await activate_extension(Extension.from_installable_ext(ext_info))

-    user_ext = await get_user_extension(account.id, data.id)
+    user_ext = await get_user_extension(user.id, data.id)
    if not user_ext:
-        user_ext = UserExtension(user=account.id, extension=data.id, active=True)
+        user_ext = UserExtension(user=user.id, extension=data.id, active=True)
        await create_user_extension(user_ext)
    elif not user_ext.active:
        user_ext.active = True
@@ -128,10 +128,10 @@ async def api_deploy_extension(
 )
 async def api_preview_extension(
    data: ExtensionData,
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ) -> SimpleStatus:
    stub_ext_id = "extension_builder_stub"
-    working_dir_name = "preview_" + sha256(account_id.id.encode("utf-8")).hexdigest()
+    working_dir_name = "preview_" + sha256(user.id.encode("utf-8")).hexdigest()
    await build_extension_from_data(data, stub_ext_id, working_dir_name)

    return SimpleStatus(success=True, message=f"Extension '{data.id}' preview ready.")
@@ -1,36 +1,17 @@
 from http import HTTPStatus

 from fastapi import APIRouter, Depends, HTTPException
-from loguru import logger
-from pydantic import BaseModel

-from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.wallets import WalletTypeInfo
-from lnbits.core.services import update_cached_settings
 from lnbits.core.services.fiat_providers import test_connection
 from lnbits.decorators import check_admin, require_admin_key
-from lnbits.fiat import RevolutWallet, StripeWallet, get_fiat_provider
+from lnbits.fiat import StripeWallet, get_fiat_provider
 from lnbits.fiat.base import CreateFiatSubscription, FiatSubscriptionResponse

 fiat_router = APIRouter(tags=["Fiat API"], prefix="/api/v1/fiat")


-class RevolutCreateWebhook(BaseModel):
-    url: str
-    endpoint: str | None = None
-    api_secret_key: str | None = None
-    api_version: str | None = None
-
-
-class RevolutCreateWebhookResponse(BaseModel):
-    id: str | None = None
-    url: str
-    events: list[str] = []
-    signing_secret: str
-    already_exists: bool = False
-
-
@fiat_router.put(
    "/check/{provider}",
    status_code=HTTPStatus.OK,
@@ -40,54 +21,6 @@ async def api_test_fiat_provider(provider: str) -> SimpleStatus:
    return await test_connection(provider)


-@fiat_router.post(
-    "/revolut/webhook",
-    status_code=HTTPStatus.OK,
-    dependencies=[Depends(check_admin)],
-)
-async def api_create_revolut_webhook(
-    data: RevolutCreateWebhook,
-) -> RevolutCreateWebhookResponse:
-    try:
-        webhook = await RevolutWallet.create_webhook(
-            url=data.url,
-            endpoint=data.endpoint,
-            api_secret_key=data.api_secret_key,
-            api_version=data.api_version,
-        )
-    except ValueError as exc:
-        logger.warning(exc)
-        raise HTTPException(status_code=400, detail=str(exc)) from exc
-    except Exception as exc:
-        logger.warning(exc)
-        raise HTTPException(
-            status_code=500, detail="Failed to create Revolut webhook."
-        ) from exc
-
-    signing_secret = webhook.get("signing_secret")
-    webhook_url = webhook.get("url") or data.url
-    if not signing_secret:
-        raise HTTPException(
-            status_code=502, detail="Revolut returned no webhook signing secret."
-        )
-
-    updated_settings = {
-        "revolut_payment_webhook_url": webhook_url,
-        "revolut_webhook_signing_secret": signing_secret,
-    }
-    for key, value in updated_settings.items():
-        await set_settings_field(key, value)
-    update_cached_settings(updated_settings)
-
-    return RevolutCreateWebhookResponse(
-        id=webhook.get("id"),
-        url=webhook_url,
-        events=webhook.get("events") or [],
-        signing_secret=signing_secret,
-        already_exists=webhook.get("already_exists", False),
-    )
-
-
@fiat_router.post(
    "/{provider}/subscription",
    status_code=HTTPStatus.OK,
@@ -97,11 +30,6 @@ async def create_subscription(
    data: CreateFiatSubscription,
    key_type: WalletTypeInfo = Depends(require_admin_key),
 ) -> FiatSubscriptionResponse:
-    logger.debug(
-        f"Creating subscription with provider '{provider}. '"
-        f"Subscription ID '{data.subscription_id}'."
-    )
-
    fiat_provider = await get_fiat_provider(provider)
    if not fiat_provider:
        raise HTTPException(404, "Fiat provider not found")
@@ -119,12 +47,6 @@ async def create_subscription(
    subscription_response = await fiat_provider.create_subscription(
        data.subscription_id, data.quantity, data.payment_options
    )
-    if subscription_response.error_message:
-        logger.warning(
-            f"Failed to create subscription with provider '{provider}': "
-            f"{subscription_response.error_message}"
-        )
-
    return subscription_response


@@ -153,28 +75,20 @@ async def cancel_subscription(
 )
 async def connection_token(provider: str):
    fiat_provider = await get_fiat_provider(provider)
-    if not fiat_provider:
-        raise HTTPException(status_code=404, detail="Fiat provider not found")
-
-    if provider != "stripe":
-        raise HTTPException(
-            status_code=400,
-            detail=f"Connection tokens are not supported for provider '{provider}'.",
-        )
-
-    if not isinstance(fiat_provider, StripeWallet):
-        raise HTTPException(
-            status_code=500, detail="Stripe wallet/provider not configured"
-        )
-    try:
-        tok = await fiat_provider.create_terminal_connection_token()
-        secret = tok.get("secret")
-        if not secret:
+    if provider == "stripe":
+        if not isinstance(fiat_provider, StripeWallet):
            raise HTTPException(
-                status_code=502, detail="Stripe returned no connection token"
+                status_code=500, detail="Stripe wallet/provider not configured"
            )
-        return {"secret": secret}
-    except Exception as e:
-        raise HTTPException(
-            status_code=500, detail="Failed to create connection token"
-        ) from e
+        try:
+            tok = await fiat_provider.create_terminal_connection_token()
+            secret = tok.get("secret")
+            if not secret:
+                raise HTTPException(
+                    status_code=502, detail="Stripe returned no connection token"
+                )
+            return {"secret": secret}
+        except Exception as e:
+            raise HTTPException(
+                status_code=500, detail="Failed to create connection token"
+            ) from e
@@ -42,44 +42,60 @@ async def robots():


@generic_router.get(
-    "/extensions/builder/preview/{ext_id}/{resource}",
+    "/extensions/builder/preview/{ext_id}",
    name="extensions builder",
    dependencies=[Depends(check_extension_builder)],
 )
 async def extensions_builder_preview(
+    request: Request,
    ext_id: str,
-    resource: str | None = None,
    page_name: str | None = None,
    user: User = Depends(check_user_exists),
-) -> FileResponse:
+) -> HTMLResponse:
    working_dir_name = "preview_" + sha256(user.id.encode("utf-8")).hexdigest()
-
-    file_name = "index"
+    html_file_name = "index.html"
    if page_name == "public_page":
-        file_name = "public_page"
+        html_file_name = "public_page.html"

-    resource_path = Path(
-        settings.extension_builder_working_dir_path,
+    html_file_path = Path(
        "extension_builder_stub",
        ext_id,
        working_dir_name,
        ext_id,
-        "static",
+        "templates",
+        ext_id,
+        html_file_name,
    )

-    file_ext = ".vue" if resource == "template" else ".js"
-    file_full_path = Path(resource_path, file_name + file_ext)
+    html_file_full_path = Path(
+        settings.extension_builder_working_dir_path, html_file_path
+    )

-    if not file_full_path.is_file():
-        raise HTTPException(status_code=HTTPStatus.NOT_FOUND)
+    if not html_file_full_path.is_file():
+        return template_renderer().TemplateResponse(
+            request,
+            "error.html",
+            {
+                "err": f"Extension {ext_id} not found",
+                "message": "Please 'Refresh Preview' first.",
+            },
+            status_code=HTTPStatus.NOT_FOUND,
+        )
+
+    response = template_renderer().TemplateResponse(
+        request,
+        html_file_path.as_posix(),
+        {
+            "user": user.json(),
+            "ajax": _is_ajax_request(request),
+        },
+    )

-    response = FileResponse(file_full_path.absolute().as_posix())
    response.headers["Content-Security-Policy"] = (
        "default-src 'self'; "
        "style-src 'self' 'unsafe-inline'; "
        "script-src 'self' 'unsafe-inline' 'unsafe-eval'"
    )
-
    return response


@@ -181,7 +197,6 @@ admin_ui_checks = [Depends(check_admin), Depends(check_admin_ui)]

@generic_router.get("/payments")
@generic_router.get("/wallet")
-@generic_router.get("/wallet/{wallet_id}")
@generic_router.get("/wallets")
@generic_router.get("/account")
@generic_router.get("/extensions")
@@ -189,23 +204,15 @@ admin_ui_checks = [Depends(check_admin), Depends(check_admin_ui)]
@generic_router.get("/audit", dependencies=admin_ui_checks)
@generic_router.get("/node", dependencies=admin_ui_checks)
@generic_router.get("/admin", dependencies=admin_ui_checks)
-@generic_router.get("/admin/extensions/wasm", dependencies=admin_ui_checks)
-@generic_router.get("/admin/extensions/wasm/limits", dependencies=admin_ui_checks)
-@generic_router.get("/admin/extensions/wasm/{ext_id}", dependencies=admin_ui_checks)
@generic_router.get(
    "/extensions/builder", dependencies=[Depends(check_extension_builder)]
 )
-@generic_router.get(
-    "/extensions/builder/preview", dependencies=[Depends(check_extension_builder)]
-)
 async def index(
-    request: Request,
-    ext_id: str | None = None,
-    user: User = Depends(check_user_exists),
+    request: Request, user: User = Depends(check_user_exists)
 ) -> HTMLResponse:
    return template_renderer().TemplateResponse(
        request,
-        "base.html",
+        "index.html",
        {
            "user": user.json(),
        },
@@ -216,7 +223,7 @@ async def index(
@generic_router.get("/node/public")
@generic_router.get("/first_install", dependencies=[Depends(check_first_install)])
 async def index_public(request: Request) -> HTMLResponse:
-    return template_renderer().TemplateResponse(request, "base.html", {"public": True})
+    return template_renderer().TemplateResponse(request, "index_public.html")


@generic_router.get("/uuidv4/{hex_value}")
@@ -277,3 +284,7 @@ async def lnurlwallet(request: Request, lightning: str = ""):
    return RedirectResponse(
        f"/wallet?usr={account.id}&wal={wallet.id}",
    )
+
+
+def _is_ajax_request(request: Request):
+    return request.headers.get("X-Requested-With", None) == "XMLHttpRequest"
@@ -24,7 +24,7 @@ from lnbits.core.models.lnurl import CreateLnurlPayment, LnurlScan
 from lnbits.decorators import (
    WalletTypeInfo,
    require_admin_key,
-    require_base_invoice_key,
+    require_invoice_key,
 )
 from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
@@ -36,8 +36,6 @@ lnurl_router = APIRouter(tags=["LNURL"])

 async def _handle(lnurl: str) -> LnurlResponseModel:
    try:
-        if "@" in lnurl:  # lower case lightning addresses
-            lnurl = lnurl.lower()
        res = await lnurl_handle(lnurl, user_agent=settings.user_agent, timeout=5)
        if isinstance(res, LnurlErrorResponse):
            raise HTTPException(status_code=HTTPStatus.BAD_REQUEST, detail=res.reason)
@@ -50,7 +48,7 @@ async def _handle(lnurl: str) -> LnurlResponseModel:

@lnurl_router.get(
    "/api/v1/lnurlscan/{code}",
-    dependencies=[Depends(require_base_invoice_key)],
+    dependencies=[Depends(require_invoice_key)],
    deprecated=True,
    response_model=LnurlPayResponse
    | LnurlWithdrawResponse
@@ -66,7 +64,7 @@ async def api_lnurlscan(code: str) -> LnurlResponseModel:

@lnurl_router.post(
    "/api/v1/lnurlscan",
-    dependencies=[Depends(require_base_invoice_key)],
+    dependencies=[Depends(require_invoice_key)],
    response_model=LnurlPayResponse
    | LnurlWithdrawResponse
    | LnurlAuthResponse
@@ -18,7 +18,6 @@ from lnbits.core.crud.payments import (
    update_payment,
 )
 from lnbits.core.crud.users import get_account
-from lnbits.core.db import db
 from lnbits.core.models import (
    CancelInvoice,
    CreateInvoice,
@@ -34,19 +33,16 @@ from lnbits.core.models import (
    PaymentWalletStats,
    SettleInvoice,
    SimpleStatus,
-    UpdatePaymentExtra,
 )
 from lnbits.core.models.payments import UpdatePaymentLabels
-from lnbits.core.models.users import AccountId
-from lnbits.core.models.wallets import BaseWalletTypeInfo
+from lnbits.core.models.users import User
 from lnbits.db import Filters, Page
 from lnbits.decorators import (
    WalletTypeInfo,
-    check_account_id_exists,
+    check_user_exists,
    parse_filters,
    require_admin_key,
-    require_base_admin_key,
-    require_base_invoice_key,
+    require_invoice_key,
 )
 from lnbits.helpers import (
    filter_dict_keys,
@@ -71,6 +67,7 @@ from ..services import (
    perform_withdraw,
    settle_hold_invoice,
    update_pending_payment,
+    update_pending_payments,
 )

 payment_router = APIRouter(prefix="/api/v1/payments", tags=["Payments"])
@@ -85,9 +82,10 @@ payment_router = APIRouter(prefix="/api/v1/payments", tags=["Payments"])
    openapi_extra=generate_filter_params_openapi(PaymentFilters),
 )
 async def api_payments(
-    key_info: BaseWalletTypeInfo = Depends(require_base_invoice_key),
+    key_info: WalletTypeInfo = Depends(require_invoice_key),
    filters: Filters = Depends(parse_filters(PaymentFilters)),
 ):
+    await update_pending_payments(key_info.wallet.id)
    return await get_payments(
        wallet_id=key_info.wallet.id,
        pending=True,
@@ -103,10 +101,11 @@ async def api_payments(
    openapi_extra=generate_filter_params_openapi(PaymentFilters),
 )
 async def api_payments_history(
-    key_info: BaseWalletTypeInfo = Depends(require_base_invoice_key),
+    key_info: WalletTypeInfo = Depends(require_invoice_key),
    group: DateTrunc = Query("day"),
    filters: Filters[PaymentFilters] = Depends(parse_filters(PaymentFilters)),
 ):
+    await update_pending_payments(key_info.wallet.id)
    return await get_payments_history(key_info.wallet.id, group, filters)


@@ -119,14 +118,14 @@ async def api_payments_history(
 async def api_payments_counting_stats(
    count_by: PaymentCountField = Query("tag"),
    filters: Filters[PaymentFilters] = Depends(parse_filters(PaymentFilters)),
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ):
-    if account_id.is_admin_id:
+    if user.admin:
        # admin user can see payments from all wallets
        for_user_id = None
    else:
        # regular user can only see payments from their wallets
-        for_user_id = account_id.id
+        for_user_id = user.id

    return await get_payment_count_stats(count_by, filters=filters, user_id=for_user_id)

@@ -139,14 +138,14 @@ async def api_payments_counting_stats(
 )
 async def api_payments_wallets_stats(
    filters: Filters[PaymentFilters] = Depends(parse_filters(PaymentFilters)),
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ):
-    if account_id.is_admin_id:
+    if user.admin:
        # admin user can see payments from all wallets
        for_user_id = None
    else:
        # regular user can only see payments from their wallets
-        for_user_id = account_id.id
+        for_user_id = user.id

    return await get_wallets_stats(filters, user_id=for_user_id)

@@ -158,15 +157,15 @@ async def api_payments_wallets_stats(
    openapi_extra=generate_filter_params_openapi(PaymentFilters),
 )
 async def api_payments_daily_stats(
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
    filters: Filters[PaymentFilters] = Depends(parse_filters(PaymentFilters)),
 ):
-    if account_id.is_admin_id:
+    if user.admin:
        # admin user can see payments from all wallets
        for_user_id = None
    else:
        # regular user can only see payments from their wallets
-        for_user_id = account_id.id
+        for_user_id = user.id
    return await get_payments_daily_stats(filters, user_id=for_user_id)


@@ -179,30 +178,24 @@ async def api_payments_daily_stats(
    openapi_extra=generate_filter_params_openapi(PaymentFilters),
 )
 async def api_payments_paginated(
-    key_info: BaseWalletTypeInfo = Depends(require_base_invoice_key),
+    key_info: WalletTypeInfo = Depends(require_invoice_key),
    recheck_pending: bool = Query(
        False, description="Force check and update of pending payments."
    ),
    filters: Filters = Depends(parse_filters(PaymentFilters)),
-) -> Page[Payment]:
-    async with db.connect() as conn:
-        page = await get_payments_paginated(
-            wallet_id=key_info.wallet.id,
-            filters=filters,
-            conn=conn,
-        )
-        if not recheck_pending:
-            return page
+):
+    page = await get_payments_paginated(
+        wallet_id=key_info.wallet.id,
+        filters=filters,
+    )
+    if not recheck_pending:
+        return page

-        payments = []
-        for payment in page.data:
-            if payment.pending:
-                refreshed_payment = await update_pending_payment(payment, conn=conn)
-                payments.append(refreshed_payment)
-            else:
-                payments.append(payment)
+    for payment in page.data:
+        if payment.pending:
+            await update_pending_payment(payment)

-    return Page(data=payments, total=page.total)
+    return page


@payment_router.get(
@@ -215,19 +208,19 @@ async def api_payments_paginated(
 )
 async def api_all_payments_paginated(
    filters: Filters = Depends(parse_filters(PaymentFilters)),
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ):
-    if account_id.is_admin_id:
+    if user.admin:
        # admin user can see payments from all wallets
        for_user_id = None
    else:
        # regular user can only see payments from their wallets
-        for_user_id = account_id.id
+        for_user_id = user.id

-    async with db.connect() as conn:
-        return await get_payments_paginated(
-            filters=filters, user_id=for_user_id, conn=conn
-        )
+    return await get_payments_paginated(
+        filters=filters,
+        user_id=for_user_id,
+    )


@payment_router.post(
@@ -250,10 +243,10 @@ async def api_all_payments_paginated(
 )
 async def api_payments_create(
    invoice_data: CreateInvoice,
-    key_info: BaseWalletTypeInfo = Depends(require_base_invoice_key),
+    wallet: WalletTypeInfo = Depends(require_invoice_key),
 ) -> Payment:
-    wallet_id = key_info.wallet.id
-    if invoice_data.out is True and key_info.key_type == KeyType.admin:
+    wallet_id = wallet.wallet.id
+    if invoice_data.out is True and wallet.key_type == KeyType.admin:
        if not invoice_data.bolt11:
            raise HTTPException(
                status_code=HTTPStatus.BAD_REQUEST,
@@ -264,7 +257,6 @@ async def api_payments_create(
            payment_request=invoice_data.bolt11,
            extra=invoice_data.extra,
            labels=invoice_data.labels,
-            external_id=invoice_data.external_id,
        )
        return payment

@@ -282,8 +274,9 @@ async def api_payments_create(
 async def api_update_payment_labels(
    payment_hash: str,
    data: UpdatePaymentLabels,
-    key_type: BaseWalletTypeInfo = Depends(require_base_admin_key),
+    key_type: WalletTypeInfo = Depends(require_admin_key),
 ) -> SimpleStatus:
+
    payment = await get_standalone_payment(payment_hash, wallet_id=key_type.wallet.id)
    if payment is None:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Payment does not exist.")
@@ -298,38 +291,6 @@ async def api_update_payment_labels(
    return SimpleStatus(success=True, message="Payment labels updated.")


-@payment_router.patch(
-    "/extra",
-    name="Update payment extra",
-    description="Append new extra metadata to a payment.",
-    response_model=Payment,
-)
-async def api_update_payment_extra(
-    data: UpdatePaymentExtra,
-    key_type: WalletTypeInfo = Depends(require_admin_key),
-) -> Payment:
-    payment = await get_standalone_payment(
-        data.payment_hash, wallet_id=key_type.wallet.id
-    )
-    if payment is None:
-        raise HTTPException(HTTPStatus.NOT_FOUND, "Payment does not exist.")
-    if not payment.success:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST, "Payment extra can only be updated after success."
-        )
-
-    duplicate_keys = sorted(set(payment.extra).intersection(data.extra))
-    if duplicate_keys:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            f"Extra keys already exist: {', '.join(duplicate_keys)}.",
-        )
-
-    payment.extra.update(data.extra)
-    await update_payment(payment)
-    return payment
-
-
@payment_router.get("/fee-reserve")
 async def api_payments_fee_reserve(invoice: str = Query("invoice")) -> JSONResponse:
    invoice_obj = bolt11.decode(invoice)
@@ -371,7 +332,7 @@ async def api_payment(payment_hash, x_api_key: str | None = Header(None)):
        return {"paid": False, "status": "failed"}

    try:
-        payment = await update_pending_payment(payment)
+        status = await payment.check_status()
    except Exception:
        if wallet and wallet.id == payment.wallet_id:
            return {"paid": False, "details": payment}
@@ -380,7 +341,7 @@ async def api_payment(payment_hash, x_api_key: str | None = Header(None)):
    if wallet and wallet.id == payment.wallet_id:
        return {
            "paid": payment.success,
-            "status": f"{payment.status!s}",
+            "status": f"{status!s}",
            "preimage": payment.preimage,
            "details": payment,
        }
@@ -7,11 +7,10 @@ from fastapi import (
 )
 from starlette.responses import RedirectResponse

-from lnbits.core.models.wallets import BaseWalletTypeInfo
 from lnbits.decorators import (
    WalletTypeInfo,
    require_admin_key,
-    require_base_invoice_key,
+    require_invoice_key,
 )

 from ..crud import (
@@ -51,12 +50,12 @@ async def api_create_tinyurl(
    description="get a tinyurl by id",
 )
 async def api_get_tinyurl(
-    tinyurl_id: str, key_info: BaseWalletTypeInfo = Depends(require_base_invoice_key)
+    tinyurl_id: str, wallet: WalletTypeInfo = Depends(require_invoice_key)
 ):
    try:
        tinyurl = await get_tinyurl(tinyurl_id)
        if tinyurl:
-            if tinyurl.wallet == key_info.wallet.id:
+            if tinyurl.wallet == wallet.wallet.id:
                return tinyurl
        raise HTTPException(
            status_code=HTTPStatus.FORBIDDEN, detail="Wrong key provided."
@@ -20,8 +20,6 @@ from lnbits.core.crud import (
    update_admin_settings,
    update_wallet,
 )
-from lnbits.core.crud.users import clear_user_id_cache, get_account, update_account
-from lnbits.core.crud.wallets import delete_wallet_by_id
 from lnbits.core.models import (
    AccountFilters,
    AccountOverview,
@@ -74,7 +72,7 @@ async def api_get_users(
    summary="Get user by Id",
 )
 async def api_get_user(user_id: str) -> User:
-    user = await get_user(user_id, active_only=False)
+    user = await get_user(user_id)
    if not user:
        raise HTTPException(HTTPStatus.NOT_FOUND, "User not found.")
    return user
@@ -117,12 +115,12 @@ async def api_create_user(data: CreateUser) -> CreateUser:

@users_router.put("/user/{user_id}", name="Update user")
 async def api_update_user(
-    user_id: str, data: CreateUser, account: Account = Depends(check_admin)
+    user_id: str, data: CreateUser, user: User = Depends(check_admin)
 ) -> CreateUser:
    if user_id != data.id:
        raise HTTPException(HTTPStatus.BAD_REQUEST, "User Id missmatch.")

-    if user_id == settings.super_user and account.id != settings.super_user:
+    if user_id == settings.super_user and user.id != settings.super_user:
        raise HTTPException(
            status_code=HTTPStatus.BAD_REQUEST,
            detail="Action only allowed for super user.",
@@ -156,24 +154,26 @@ async def api_update_user(
    name="Delete user by Id",
 )
 async def api_users_delete_user(
-    user_id: str, account: Account = Depends(check_admin)
+    user_id: str, user: User = Depends(check_admin)
 ) -> SimpleStatus:
+    wallets = await get_wallets(user_id, deleted=False)
+    if len(wallets) > 0:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Cannot delete user with wallets.",
+        )
+
    if user_id == settings.super_user:
        raise HTTPException(
            status_code=HTTPStatus.BAD_REQUEST,
            detail="Cannot delete super user.",
        )

-    if user_id in settings.lnbits_admin_users and not account.is_super_user:
+    if user_id in settings.lnbits_admin_users and not user.super_user:
        raise HTTPException(
            status_code=HTTPStatus.BAD_REQUEST,
            detail="Only super_user can delete admin user.",
        )
-
-    wallets = await get_wallets(user_id, deleted=False)
-    for wallet in wallets:
-        await delete_wallet_by_id(wallet.id)
-
    await delete_account(user_id)
    return SimpleStatus(success=True, message="User deleted.")

@@ -199,7 +199,7 @@ async def api_users_reset_password(user_id: str) -> str:
    return f"reset_key_{reset_key_b64}"


-@users_router.put(
+@users_router.get(
    "/user/{user_id}/admin",
    dependencies=[Depends(check_super_user)],
    name="Give or revoke admin permsisions to a user",
@@ -222,46 +222,9 @@ async def api_users_toggle_admin(user_id: str) -> SimpleStatus:
    )


-@users_router.put(
-    "/user/{user_id}/activate",
-    name="Activate or deactivate a user",
-)
-async def api_users_toggle_activated(
-    user_id: str, admin_account: Account = Depends(check_admin)
-) -> SimpleStatus:
-    if user_id == settings.super_user:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="Cannot deactivate super user.",
-        )
-    if user_id == admin_account.id:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="You cannot deactivate yourself.",
-        )
-
-    if settings.is_admin_user(user_id):
-        settings.lnbits_admin_users.remove(user_id)
-
-    user_account = await get_account(user_id, active_only=False)
-    if not user_account:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND,
-            detail="User not found.",
-        )
-    user_account.activated = not user_account.activated
-    await update_account(user_account)
-    await clear_user_id_cache(user_id)
-
-    return SimpleStatus(
-        success=True,
-        message=f"User {'activated' if user_account.activated else 'deactivated'}.",
-    )
-
-
@users_router.get("/user/{user_id}/wallet", name="Get wallets for user")
 async def api_users_get_user_wallet(user_id: str) -> list[Wallet]:
-    return await get_wallets(user_id, deleted=None)
+    return await get_wallets(user_id)


@users_router.post("/user/{user_id}/wallet", name="Create a new wallet for user")
@@ -284,7 +247,7 @@ async def api_users_create_user_wallet(
    "/user/{user_id}/wallet/{wallet}/undelete", name="Reactivate deleted wallet"
 )
 async def api_users_undelete_user_wallet(user_id: str, wallet: str) -> SimpleStatus:
-    wal = await get_wallet(wallet, deleted=True)
+    wal = await get_wallet(wallet)
    if not wal:
        raise HTTPException(
            status_code=HTTPStatus.NOT_FOUND,
@@ -332,7 +295,7 @@ async def api_users_delete_all_user_wallet(user_id: str) -> SimpleStatus:
    "The second time it is called will delete the entry from the DB",
 )
 async def api_users_delete_user_wallet(
-    user_id: str, wallet: str, account: Account = Depends(check_admin)
+    user_id: str, wallet: str, user: User = Depends(check_admin)
 ) -> SimpleStatus:
    wal = await get_wallet(wallet)
    if not wal:
@@ -341,7 +304,7 @@ async def api_users_delete_user_wallet(
            detail="Wallet does not exist.",
        )

-    if user_id == settings.super_user and account.id != settings.super_user:
+    if user_id == settings.super_user and user.id != settings.super_user:
        raise HTTPException(
            status_code=HTTPStatus.BAD_REQUEST,
            detail="Action only allowed for super user.",
@@ -9,14 +9,12 @@ from fastapi import (
 )

 from lnbits.core.crud.wallets import (
-    clear_wallet_cache,
    create_wallet,
    get_wallets_paginated,
 )
-from lnbits.core.models import CreateWallet, KeyType, Wallet, WalletTypeInfo
+from lnbits.core.models import CreateWallet, KeyType, User, Wallet, WalletTypeInfo
 from lnbits.core.models.lnurl import StoredPayLink, StoredPayLinks
 from lnbits.core.models.misc import SimpleStatus
-from lnbits.core.models.users import Account, AccountId
 from lnbits.core.models.wallets import (
    WalletsFilters,
    WalletSharePermission,
@@ -31,8 +29,7 @@ from lnbits.core.services.wallets import (
 )
 from lnbits.db import Filters, Page
 from lnbits.decorators import (
-    check_account_exists,
-    check_account_id_exists,
+    check_user_exists,
    parse_filters,
    require_admin_key,
    require_invoice_key,
@@ -68,11 +65,11 @@ async def api_wallet(key_info: WalletTypeInfo = Depends(require_invoice_key)):
    openapi_extra=generate_filter_params_openapi(WalletsFilters),
 )
 async def api_wallets_paginated(
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
    filters: Filters = Depends(parse_filters(WalletsFilters)),
 ):
    page = await get_wallets_paginated(
-        user_id=account_id.id,
+        user_id=user.id,
        filters=filters,
    )

@@ -88,7 +85,7 @@ async def api_invite_wallet_share(

@wallet_router.delete("/share/invite/{share_request_id}")
 async def api_reject_wallet_invitation(
-    share_request_id: str, invited_user: Account = Depends(check_account_exists)
+    share_request_id: str, invited_user: User = Depends(check_user_exists)
 ) -> SimpleStatus:
    await reject_wallet_invitation(invited_user.id, share_request_id)
    return SimpleStatus(success=True, message="Invitation rejected.")
@@ -127,15 +124,12 @@ async def api_update_wallet_name(

@wallet_router.put("/reset/{wallet_id}")
 async def api_reset_wallet_keys(
-    wallet_id: str,
-    account_id: AccountId = Depends(check_account_id_exists),
+    wallet_id: str, user: User = Depends(check_user_exists)
 ) -> Wallet:
    wallet = await get_wallet(wallet_id)
-    if not wallet or wallet.user != account_id.id:
+    if not wallet or wallet.user != user.id:
        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="Wallet not found")

-    clear_wallet_cache(wallet)
-
    wallet.adminkey = uuid4().hex
    wallet.inkey = uuid4().hex
    await update_wallet(wallet)
@@ -181,10 +175,10 @@ async def api_update_wallet(

@wallet_router.delete("/{wallet_id}")
 async def api_delete_wallet(
-    wallet_id: str, account_id: AccountId = Depends(check_account_id_exists)
+    wallet_id: str, user: User = Depends(check_user_exists)
 ) -> None:
    wallet = await get_wallet(wallet_id)
-    if not wallet or wallet.user != account_id.id:
+    if not wallet or wallet.user != user.id:
        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="Wallet not found")

    await delete_wallet(
@@ -195,14 +189,11 @@ async def api_delete_wallet(

@wallet_router.post("")
 async def api_create_wallet(
-    data: CreateWallet, account_id: AccountId = Depends(check_account_id_exists)
+    data: CreateWallet,
+    key_info: WalletTypeInfo = Depends(require_admin_key),
 ) -> Wallet:
-
-    if data.wallet_type not in list(WalletType):
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            f"Wallet type {data.wallet_type} does not exist.",
-        )
+    if data.wallet_type == WalletType.LIGHTNING:
+        return await create_wallet(user_id=key_info.wallet.user, wallet_name=data.name)

    if data.wallet_type == WalletType.LIGHTNING_SHARED:
        if not data.shared_wallet_id:
@@ -211,9 +202,11 @@ async def api_create_wallet(
                "Shared wallet ID is required for shared wallets.",
            )
        return await create_lightning_shared_wallet(
-            user_id=account_id.id,
+            user_id=key_info.wallet.user,
            source_wallet_id=data.shared_wallet_id,
        )

-    # default WalletType.LIGHTNING:
-    return await create_wallet(user_id=account_id.id, wallet_name=data.name)
+    raise HTTPException(
+        HTTPStatus.BAD_REQUEST,
+        f"Unknown wallet type: {data.wallet_type}.",
+    )
@@ -15,9 +15,9 @@ from lnbits.core.models import (
    CreateWebPushSubscription,
    WebPushSubscription,
 )
-from lnbits.core.models.users import AccountId
+from lnbits.core.models.users import User
 from lnbits.decorators import (
-    check_account_id_exists,
+    check_user_exists,
 )

 from ..crud import (
@@ -33,20 +33,20 @@ webpush_router = APIRouter(prefix="/api/v1/webpush", tags=["Webpush"])
 async def api_create_webpush_subscription(
    request: Request,
    data: CreateWebPushSubscription,
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ) -> WebPushSubscription:
    try:
        subscription = json.loads(data.subscription)
        endpoint = subscription["endpoint"]
        host = urlparse(str(request.url)).netloc

-        subscription = await get_webpush_subscription(endpoint, account_id.id)
+        subscription = await get_webpush_subscription(endpoint, user.id)
        if subscription:
            return subscription
        else:
            return await create_webpush_subscription(
                endpoint,
-                account_id.id,
+                user.id,
                data.subscription,
                host,
            )
@@ -61,13 +61,13 @@ async def api_create_webpush_subscription(
@webpush_router.delete("", status_code=HTTPStatus.OK)
 async def api_delete_webpush_subscription(
    request: Request,
-    account_id: AccountId = Depends(check_account_id_exists),
+    user: User = Depends(check_user_exists),
 ):
    try:
        endpoint = unquote(
            base64.b64decode(str(request.query_params.get("endpoint"))).decode("utf-8")
        )
-        count = await delete_webpush_subscription(endpoint, account_id.id)
+        count = await delete_webpush_subscription(endpoint, user.id)
        return {"count": count}
    except Exception as exc:
        logger.debug(exc)
@@ -1,24 +0,0 @@
-from .api.host import ExtensionHostAPI
-from .api.models import ExtensionAPIMethod, ExtensionAPIMethodExport
-from .api.registry import (
-    extension_api_contract,
-    extension_api_method,
-    extension_api_permission_ids,
-    get_extension_api_method,
-    list_extension_api_methods,
-)
-from .api.runtime import ExtensionAPIHost
-from .wasm.loader import WasmExtension
-
-__all__ = [
-    "ExtensionAPIHost",
-    "ExtensionAPIMethod",
-    "ExtensionAPIMethodExport",
-    "ExtensionHostAPI",
-    "WasmExtension",
-    "extension_api_contract",
-    "extension_api_method",
-    "extension_api_permission_ids",
-    "get_extension_api_method",
-    "list_extension_api_methods",
-]
@@ -1,22 +0,0 @@
-from .host import ExtensionHostAPI
-from .models import ExtensionAPIMethod, ExtensionAPIMethodExport
-from .registry import (
-    extension_api_contract,
-    extension_api_method,
-    extension_api_permission_ids,
-    get_extension_api_method,
-    list_extension_api_methods,
-)
-from .runtime import ExtensionAPIHost
-
-__all__ = [
-    "ExtensionAPIHost",
-    "ExtensionAPIMethod",
-    "ExtensionAPIMethodExport",
-    "ExtensionHostAPI",
-    "extension_api_contract",
-    "extension_api_method",
-    "extension_api_permission_ids",
-    "get_extension_api_method",
-    "list_extension_api_methods",
-]
@@ -1,124 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, NoReturn
-
-from bolt11 import decode as bolt11_decode
-from loguru import logger
-
-from lnbits.core.crud.extensions import get_user_extension
-from lnbits.core.crud.payments import check_internal
-from lnbits.core.crud.wallets import get_wallet
-from lnbits.core.models.extensions import (
-    ExtensionBackgroundPaymentDestinationPolicy,
-    ExtensionBackgroundPaymentGrant,
-)
-from lnbits.core.models.wallets import Wallet
-
-WALLET_PAY_INVOICE_BACKGROUND_PERMISSION = "wallet.pay_invoice_background"
-
-
-async def background_payment_extra(
-    *,
-    extension_id: str,
-    wallet: Wallet,
-    payment_request: str,
-    amount_msat: int,
-) -> dict[str, Any]:
-    grant = await _background_payment_grant(extension_id, wallet, amount_msat)
-    await _check_destination_policy(extension_id, wallet, grant, payment_request)
-
-    return {
-        "tag": extension_id,
-        "extension": extension_id,
-        "background_payment": True,
-        "background_permission": WALLET_PAY_INVOICE_BACKGROUND_PERMISSION,
-        "background_wallet_id": wallet.source_wallet_id,
-        "background_destination_policy": grant.destination_policy.value,
-    }
-
-
-def invoice_amount_msat(payment_request: str) -> int:
-    invoice = bolt11_decode(payment_request)
-    amount_msat = int(invoice.amount_msat or 0)
-    if amount_msat <= 0:
-        raise PermissionError("Background payments require an invoice amount.")
-    return amount_msat
-
-
-async def _background_payment_grant(
-    extension_id: str,
-    wallet: Wallet,
-    amount_msat: int,
-) -> ExtensionBackgroundPaymentGrant:
-    if wallet.is_lightning_shared_wallet:
-        _deny(extension_id, wallet, amount_msat, "shared wallet")
-    if not wallet.can_send_payments:
-        _deny(extension_id, wallet, amount_msat, "wallet cannot send payments")
-
-    user_extension = await get_user_extension(wallet.user, extension_id)
-    if not user_extension or not user_extension.active:
-        _deny(extension_id, wallet, amount_msat, "extension disabled for user")
-
-    permissions = user_extension.permissions or {}
-    grants = permissions.get(WALLET_PAY_INVOICE_BACKGROUND_PERMISSION)
-    if not isinstance(grants, list):
-        _deny(extension_id, wallet, amount_msat, "missing background payment grant")
-
-    grant = _find_wallet_grant(grants, wallet.id)
-    if not grant:
-        _deny(extension_id, wallet, amount_msat, "missing wallet background grant")
-    if not grant.enabled:
-        _deny(extension_id, wallet, amount_msat, "background grant disabled")
-    if amount_msat > grant.max_amount * 1000:
-        _deny(extension_id, wallet, amount_msat, "payment exceeds max amount")
-    return grant
-
-
-def _find_wallet_grant(
-    grants: list[Any], wallet_id: str
-) -> ExtensionBackgroundPaymentGrant | None:
-    for grant_data in grants:
-        if not isinstance(grant_data, dict):
-            continue
-        try:
-            grant = ExtensionBackgroundPaymentGrant.parse_obj(grant_data)
-        except ValueError:
-            continue
-        if grant.wallet_id == wallet_id:
-            return grant
-    return None
-
-
-async def _check_destination_policy(
-    extension_id: str,
-    wallet: Wallet,
-    grant: ExtensionBackgroundPaymentGrant,
-    payment_request: str,
-) -> None:
-    if (
-        grant.destination_policy
-        == ExtensionBackgroundPaymentDestinationPolicy.EXTERNAL_ALLOWED
-    ):
-        return
-
-    payment_hash = bolt11_decode(payment_request).payment_hash
-    internal_payment = await check_internal(payment_hash)
-    if not internal_payment:
-        _deny(extension_id, wallet, 0, "external destination not allowed")
-
-    destination_wallet = await get_wallet(internal_payment.wallet_id)
-    if not destination_wallet or destination_wallet.user != wallet.user:
-        _deny(extension_id, wallet, 0, "destination wallet is not owned by user")
-
-
-def _deny(extension_id: str, wallet: Wallet, amount_msat: int, reason: str) -> NoReturn:
-    logger.warning(
-        "WASM extension '{}' denied background payment from wallet '{}', "
-        "user '{}', amount_msat '{}': {}.",
-        extension_id,
-        wallet.id,
-        wallet.user,
-        amount_msat,
-        reason,
-    )
-    raise PermissionError(reason)
@@ -1,718 +0,0 @@
-from __future__ import annotations
-
-import json
-import logging
-import secrets
-import time
-from collections.abc import Iterable, Mapping
-from typing import Any
-
-from lnbits.helpers import sha256s
-
-from ..client.extensions import send_extension_api_request
-from ..storage.crud import (
-    storage_delete_row,
-    storage_get_paginated_rows,
-    storage_get_public_row,
-    storage_get_row,
-    storage_set_row,
-)
-from .background_payments import (
-    WALLET_PAY_INVOICE_BACKGROUND_PERMISSION,
-    background_payment_extra,
-    invoice_amount_msat,
-)
-from .models import (
-    CreateInvoicePublicRequest,
-    CreateInvoiceRequest,
-    CreateInvoiceResponse,
-    EmptyRequest,
-    ExtensionApiRequest,
-    HttpRequest,
-    HttpResponse,
-    ListUserWalletsResponse,
-    LogRequest,
-    LogResponse,
-    NowResponse,
-    PayInvoiceRequest,
-    PayInvoiceResponse,
-    PayLnurlRequest,
-    RandomIdRequest,
-    RandomIdResponse,
-    StorageDeleteRequest,
-    StorageDeleteResponse,
-    StorageGetRequest,
-    StorageGetResponse,
-    StoragePaginatedRequest,
-    StoragePaginatedResponse,
-    StorageSetRequest,
-    StorageSetResponse,
-    UserWalletSummary,
-    WalletBalanceRequest,
-    WalletBalanceResponse,
-)
-from .registry import extension_api_method
-
-logger = logging.getLogger("lnbits.extensions")
-
-
-class ExtensionHostAPI:
-    def __init__(
-        self,
-        extension_id: str,
-        permissions: Iterable[Any],
-        *,
-        user_id: str | None = None,
-        access_token: str | None = None,
-        context: str = "user",
-        owner_id: str | None = None,
-        invocation_id: str | None = None,
-        runtime_limits: dict[str, int] | None = None,
-    ) -> None:
-        self.extension_id = extension_id
-        self.permissions, self.permission_policies = self._permission_data(permissions)
-        self.user_id = user_id
-        self.access_token = access_token
-        self.context = context
-        self.owner_id = sha256s(user_id) if user_id else owner_id
-        self.invocation_id = invocation_id
-        self.runtime_limits = runtime_limits or {}
-        from .utils import ExtensionAPIUtils
-
-        self.utils = ExtensionAPIUtils(
-            self.extension_id,
-            self.permissions,
-            authenticated=self.has_authenticated_context(),
-        )
-
-    @extension_api_method(
-        method_id="storage.get",
-        namespace="storage",
-        name="Get storage row",
-        host_name="storage_get",
-        sdk_name="get",
-        description="Read one row from an extension storage table.",
-        required_permission="ext.storage.read",
-        require_auth=True,
-    )
-    async def storage_get(self, request: StorageGetRequest) -> StorageGetResponse:
-        row = await storage_get_row(
-            self.extension_id,
-            request.table,
-            request.id,
-            self._require_owner_id(),
-        )
-        return StorageGetResponse(data_json=json.dumps(row) if row else None)
-
-    @extension_api_method(
-        method_id="storage.get_public",
-        namespace="storage",
-        name="Get public storage row",
-        host_name="storage_get_public",
-        sdk_name="getPublic",
-        description="Read one public row from an extension storage table.",
-        required_permission="ext.storage.read_public",
-        require_auth=False,
-    )
-    async def storage_get_public(
-        self, request: StorageGetRequest
-    ) -> StorageGetResponse:
-        public_fields = self._public_storage_fields(request.table)
-        row = await storage_get_public_row(self.extension_id, request.table, request.id)
-        if not row:
-            return StorageGetResponse()
-        public_row = {
-            field_name: value
-            for field_name, value in row.items()
-            if field_name in public_fields
-        }
-        # todo: check public fields filtering
-        return StorageGetResponse(data_json=json.dumps(public_row))
-
-    @extension_api_method(
-        method_id="storage.set",
-        namespace="storage",
-        name="Set storage row",
-        host_name="storage_set",
-        sdk_name="set",
-        description="Create or update one row in an extension storage table.",
-        required_permission="ext.storage.write",
-        require_auth=True,
-    )
-    async def storage_set(self, request: StorageSetRequest) -> StorageSetResponse:
-        await storage_set_row(
-            self.extension_id,
-            request.table,
-            request.data,
-            self._require_owner_id(),
-        )
-        return StorageSetResponse()
-
-    @extension_api_method(
-        method_id="storage.get_paginated",
-        namespace="storage",
-        name="Get paginated storage rows",
-        host_name="storage_get_paginated",
-        sdk_name="getPaginated",
-        description="Get filtered, searched, sorted, paginated storage rows.",
-        required_permission="ext.storage.read",
-        require_auth=True,
-    )
-    async def storage_get_paginated(
-        self, request: StoragePaginatedRequest
-    ) -> StoragePaginatedResponse:
-        page = await storage_get_paginated_rows(
-            self.extension_id,
-            request.table,
-            request.filters,
-            owner_id=self._require_owner_id(),
-            search=request.search,
-            search_fields=request.search_fields,
-            sort_by=request.sort_by,
-            descending=request.descending,
-            limit=request.limit,
-            offset=request.offset,
-        )
-        return StoragePaginatedResponse(
-            rows_json=json.dumps(page["data"]),
-            total=page["total"],
-        )
-
-    @extension_api_method(
-        method_id="storage.delete",
-        namespace="storage",
-        name="Delete storage row",
-        host_name="storage_delete",
-        sdk_name="delete",
-        description="Delete one row from an extension storage table.",
-        required_permission="ext.storage.write",
-        require_auth=True,
-    )
-    async def storage_delete(
-        self, request: StorageDeleteRequest
-    ) -> StorageDeleteResponse:
-        await storage_delete_row(
-            self.extension_id,
-            request.table,
-            request.id,
-            self._require_owner_id(),
-        )
-        return StorageDeleteResponse()
-
-    @extension_api_method(
-        method_id="wallet.create_invoice",
-        namespace="wallet",
-        name="Create invoice",
-        host_name="create_invoice",
-        sdk_name="createInvoice",
-        description="Create an incoming Lightning invoice for an allowed wallet.",
-        required_permission="wallet.create_invoice",
-        require_auth=True,
-    )
-    async def wallet_create_invoice(
-        self, request: CreateInvoiceRequest
-    ) -> CreateInvoiceResponse:
-        from lnbits.core.crud.wallets import get_wallet
-        from lnbits.core.models.payments import CreateInvoice
-        from lnbits.core.services.payments import create_payment_request
-
-        if not self.user_id:
-            raise PermissionError(
-                "Creating an invoice for this wallet requires an "
-                "authenticated user context."
-            )
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None or wallet.user != self.user_id:
-            raise PermissionError("Not your wallet.")
-
-        payment = await create_payment_request(
-            request.wallet_id,
-            CreateInvoice(
-                amount=request.amount,
-                unit=request.currency,
-                memo=request.memo,
-                extra=request.extra,
-                extension=self.extension_id,
-            ),
-        )
-        return CreateInvoiceResponse(
-            payment_hash=payment.payment_hash,
-            payment_request=payment.payment_request or payment.bolt11,
-            checking_id=payment.checking_id,
-        )
-
-    @extension_api_method(
-        method_id="wallet.create_invoice_public",
-        namespace="wallet",
-        name="Create public invoice",
-        host_name="create_invoice_public",
-        sdk_name="createInvoicePublic",
-        description="Create a public incoming Lightning invoice.",
-        required_permission="wallet.create_invoice_public",
-        require_auth=False,
-    )
-    async def wallet_create_invoice_public(
-        self, request: CreateInvoicePublicRequest
-    ) -> CreateInvoiceResponse:
-        from lnbits.core.models.payments import CreateInvoice
-        from lnbits.core.services.payments import create_payment_request
-
-        row: dict[str, Any] | None = None
-        wallet_field = ""
-        for policy in self._public_invoice_wallet_sources():
-            row = await storage_get_public_row(
-                self.extension_id,
-                policy["table"],
-                request.source_id,
-            )
-            if row:
-                wallet_field = policy["wallet_field"]
-                break
-
-        if not row:
-            raise PermissionError("Public invoice source was not found.")
-
-        wallet_id = row.get(wallet_field)
-        if not isinstance(wallet_id, str) or not wallet_id:
-            raise PermissionError("Public invoice source has no valid wallet.")
-
-        payment = await create_payment_request(
-            wallet_id,
-            CreateInvoice(
-                amount=request.amount,
-                unit=request.currency,
-                memo=request.memo,
-                extra={
-                    "tag": self.extension_id,
-                    "source_id": request.source_id,
-                    f"extra_{self.extension_id}": request.extra,
-                },
-                extension=self.extension_id,
-            ),
-        )
-        return CreateInvoiceResponse(
-            payment_hash=payment.payment_hash,
-            payment_request=payment.payment_request or payment.bolt11,
-            checking_id=payment.checking_id,
-        )
-
-    @extension_api_method(
-        method_id="wallet.list_user_wallets",
-        namespace="wallet",
-        name="List user wallets",
-        host_name="list_user_wallets",
-        sdk_name="listUserWallets",
-        description="List wallets available to the authenticated extension user.",
-        required_permission="wallet.list",
-    )
-    async def wallet_list_user_wallets(
-        self, request: EmptyRequest
-    ) -> ListUserWalletsResponse:
-        if not self.user_id:
-            raise PermissionError(
-                "Listing user wallets requires an authenticated user context."
-            )
-
-        from lnbits.core.crud.wallets import get_wallets
-
-        user_wallets = await get_wallets(self.user_id)
-        if user_wallets is None:
-            raise PermissionError(
-                "Listing user wallets requires an authenticated user context."
-            )
-        return ListUserWalletsResponse(
-            wallets=[
-                UserWalletSummary(id=w.id, name=w.name, currency=w.currency)
-                for w in user_wallets
-            ]
-        )
-
-    @extension_api_method(
-        method_id="wallet.balance",
-        namespace="wallet",
-        name="Read wallet balance",
-        host_name="wallet_balance",
-        sdk_name="balance",
-        description="Read the balance of a wallet available to the user.",
-        required_permission="wallet.balance.read",
-    )
-    async def wallet_balance(
-        self, request: WalletBalanceRequest
-    ) -> WalletBalanceResponse:
-        from lnbits.core.crud.wallets import get_wallet
-
-        if not self.user_id:
-            raise PermissionError(
-                "Reading a wallet balance requires an authenticated user context."
-            )
-
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None or wallet.user != self.user_id:
-            raise PermissionError("Reading this wallet balance is not allowed.")
-
-        withdrawable_msat = max(wallet.withdrawable_balance, 0)
-        fee_reserve_msat = max(wallet.balance_msat - withdrawable_msat, 0)
-        return WalletBalanceResponse(
-            wallet_id=wallet.id,
-            name=wallet.name,
-            currency=wallet.currency,
-            balance_msat=wallet.balance_msat,
-            balance_sat=wallet.balance,
-            withdrawable_msat=withdrawable_msat,
-            withdrawable_sat=withdrawable_msat // 1000,
-            fee_reserve_msat=fee_reserve_msat,
-            fee_reserve_sat=fee_reserve_msat // 1000,
-            can_send_payments=wallet.can_send_payments,
-        )
-
-    @extension_api_method(
-        method_id="wallet.pay_invoice",
-        namespace="wallet",
-        name="Pay invoice",
-        host_name="pay_invoice",
-        sdk_name="payInvoice",
-        description="Pay a Lightning invoice from a wallet available to the user.",
-    )
-    async def wallet_pay_invoice(
-        self, request: PayInvoiceRequest
-    ) -> PayInvoiceResponse:
-        from lnbits.core.crud.wallets import get_wallet
-        from lnbits.core.services.payments import pay_invoice
-        from lnbits.exceptions import PaymentError
-
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None:
-            raise PermissionError("Paying invoices from this wallet is not allowed.")
-
-        try:
-            if self.user_id:
-                self.require_permission("wallet.pay_invoice")
-                if wallet.user != self.user_id:
-                    raise PermissionError(
-                        "Paying invoices from this wallet is not allowed."
-                    )
-                payment = await pay_invoice(
-                    wallet_id=request.wallet_id,
-                    payment_request=request.payment_request,
-                    max_sat=request.max_sat,
-                    extra={"tag": self.extension_id, **request.extra},
-                    description=request.description,
-                    tag=self.extension_id,
-                )
-            else:
-                self.require_permission(WALLET_PAY_INVOICE_BACKGROUND_PERMISSION)
-                amount_msat = invoice_amount_msat(request.payment_request)
-                extra = await background_payment_extra(
-                    extension_id=self.extension_id,
-                    wallet=wallet,
-                    payment_request=request.payment_request,
-                    amount_msat=amount_msat,
-                )
-                payment = await pay_invoice(
-                    wallet_id=request.wallet_id,
-                    payment_request=request.payment_request,
-                    max_sat=request.max_sat,
-                    extra={**request.extra, **extra},
-                    description=request.description,
-                    tag=self.extension_id,
-                )
-        except (PaymentError, PermissionError, ValueError) as exc:
-            return PayInvoiceResponse(ok=False, error=str(exc))
-
-        return _pay_invoice_response(payment)
-
-    @extension_api_method(
-        method_id="wallet.pay_lnurl",
-        namespace="wallet",
-        name="Pay LNURL",
-        host_name="pay_lnurl",
-        sdk_name="payLnurl",
-        description="Pay a Lightning Address or LNURL-pay request from a wallet.",
-    )
-    async def wallet_pay_lnurl(self, request: PayLnurlRequest) -> PayInvoiceResponse:
-        from lnurl import LnAddressError, LnurlResponseException
-
-        from lnbits.core.crud.wallets import get_wallet
-        from lnbits.core.models.lnurl import CreateLnurlPayment
-        from lnbits.core.services.lnurl import fetch_lnurl_pay_request
-        from lnbits.core.services.payments import pay_invoice
-        from lnbits.exceptions import PaymentError
-
-        from .lnurl import (
-            lnurl_for_core,
-            lnurl_pay_response_text,
-            lnurl_payment_amount_for_core,
-            lnurl_payment_unit_for_core,
-        )
-
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None:
-            raise PermissionError("Paying from this wallet is not allowed.")
-
-        try:
-            if self.user_id:
-                self.require_permission("wallet.pay_invoice")
-                if wallet.user != self.user_id:
-                    raise PermissionError("Paying from this wallet is not allowed.")
-            else:
-                self.require_permission(WALLET_PAY_INVOICE_BACKGROUND_PERMISSION)
-
-            unit = lnurl_payment_unit_for_core(request.currency)
-            res, action = await fetch_lnurl_pay_request(
-                data=CreateLnurlPayment(
-                    lnurl=lnurl_for_core(request.lnurl),
-                    amount=lnurl_payment_amount_for_core(request.amount),
-                    unit=unit,
-                    comment=request.comment,
-                    internal_memo=request.description or None,
-                ),
-                wallet=None,
-            )
-            extra = {"tag": self.extension_id, **request.extra}
-            if action.successAction:
-                extra["success_action"] = action.successAction.json()
-            if request.comment:
-                extra["comment"] = request.comment
-            if unit != "sat":
-                extra["fiat_currency"] = unit
-                extra["fiat_amount"] = str(request.amount)
-
-            if not self.user_id:
-                amount_msat = invoice_amount_msat(str(action.pr))
-                extra = {
-                    **extra,
-                    **(
-                        await background_payment_extra(
-                            extension_id=self.extension_id,
-                            wallet=wallet,
-                            payment_request=str(action.pr),
-                            amount_msat=amount_msat,
-                        )
-                    ),
-                }
-
-            payment = await pay_invoice(
-                wallet_id=request.wallet_id,
-                payment_request=str(action.pr),
-                max_sat=request.max_sat,
-                extra=extra,
-                description=request.description or lnurl_pay_response_text(res),
-                tag=self.extension_id,
-            )
-        except (
-            LnAddressError,
-            LnurlResponseException,
-            PaymentError,
-            PermissionError,
-            ValueError,
-        ) as exc:
-            return PayInvoiceResponse(ok=False, error=str(exc))
-
-        return _pay_invoice_response(payment)
-
-    @extension_api_method(
-        method_id="http.request",
-        namespace="http",
-        name="HTTP request",
-        host_name="http_request",
-        sdk_name="request",
-        description="Make an outbound HTTP request to an allowed host.",
-        required_permission="http.request",
-        require_auth=True,
-    )
-    async def http_request(self, request: HttpRequest) -> HttpResponse:
-        from ..client.http import send_extension_http_request
-
-        policies = self.permission_policies.get("http.request") or []
-        return await send_extension_http_request(
-            self.extension_id,
-            policies,
-            request,
-            timeout_ms=self.runtime_limits.get("wasm_runtime_http_timeout_ms"),
-            max_response_bytes=self.runtime_limits.get(
-                "wasm_runtime_max_http_response_bytes"
-            ),
-        )
-
-    @extension_api_method(
-        method_id="extension.api.request",
-        namespace="extension",
-        name="Extension API request",
-        host_name="extension_api_request",
-        sdk_name="request",
-        description="Call an allowed installed extension API.",
-        required_permission="extension.api.request",
-        require_auth=True,
-    )
-    async def extension_api_request(self, request: ExtensionApiRequest) -> HttpResponse:
-
-        policies = self.permission_policies.get("extension.api.request") or []
-        return await send_extension_api_request(
-            self.extension_id,
-            policies,
-            self.user_id,
-            self.access_token,
-            request,
-            timeout_ms=self.runtime_limits.get("wasm_runtime_http_timeout_ms"),
-            max_response_bytes=self.runtime_limits.get(
-                "wasm_runtime_max_http_response_bytes"
-            ),
-        )
-
-    @extension_api_method(
-        method_id="system.random_id",
-        namespace="system",
-        name="Random ID",
-        host_name="random_id",
-        sdk_name="id",
-        description="Create a random extension-local identifier.",
-        require_auth=False,
-    )
-    async def system_random_id(self, request: RandomIdRequest) -> RandomIdResponse:
-        return RandomIdResponse(
-            id=f"{request.prefix}_{secrets.token_urlsafe(12).replace('-', '_')}"
-        )
-
-    @extension_api_method(
-        method_id="system.now",
-        namespace="system",
-        name="Current timestamp",
-        host_name="now",
-        sdk_name="now",
-        description="Return the current Unix timestamp.",
-        require_auth=False,
-    )
-    async def system_now(self, request: EmptyRequest) -> NowResponse:
-        return NowResponse(timestamp=int(time.time()))
-
-    @extension_api_method(
-        method_id="system.log",
-        namespace="system",
-        name="Log message",
-        host_name="log",
-        sdk_name="log",
-        description="Write a bounded message to the extension log.",
-        require_auth=False,
-    )
-    async def system_log(self, request: LogRequest) -> LogResponse:
-        log = getattr(logger, request.level)
-        log("extension:%s %s", self.extension_id, request.message)
-        return LogResponse()
-
-    @staticmethod
-    def _permission_data(
-        permissions: Iterable[Any],
-    ) -> tuple[set[str], dict[str, list[Any]]]:
-        permission_ids: set[str] = set()
-        policies: dict[str, list[Any]] = {}
-
-        for permission in permissions:
-            if isinstance(permission, str):
-                permission_ids.add(permission)
-                continue
-
-            permission_id: str | None = None
-            permission_policies: Any = None
-            if isinstance(permission, Mapping):
-                permission_id = permission.get("id")  # type: ignore[assignment]
-                permission_policies = permission.get("policies")
-            else:
-                permission_id = getattr(permission, "id", None)
-                permission_policies = getattr(permission, "policies", None)
-
-            if not permission_id:
-                continue
-            permission_ids.add(permission_id)
-            if isinstance(permission_policies, list):
-                policies[permission_id] = permission_policies
-
-        return permission_ids, policies
-
-    def _public_storage_fields(self, table: str) -> set[str]:
-        tables = self.permission_policies.get("ext.storage.read_public")
-        if not isinstance(tables, list) or not tables:
-            raise PermissionError(
-                "Public storage reads require policies for "
-                "'ext.storage.read_public'."
-            )
-
-        for table_policy in tables:
-            if not isinstance(table_policy, dict):
-                continue
-            if table_policy.get("table_name") != table:
-                continue
-            public_fields = table_policy.get("public_fields")
-            if not isinstance(public_fields, list) or not all(
-                isinstance(field, str) and field for field in public_fields
-            ):
-                raise PermissionError(
-                    f"Public storage table '{table}' has no valid public fields."
-                )
-            return set(public_fields)
-
-        raise PermissionError(f"Storage table '{table}' is not publicly readable.")
-
-    def _public_invoice_wallet_sources(self) -> list[dict[str, str]]:
-        policies = self.permission_policies.get("wallet.create_invoice_public")
-        if not isinstance(policies, list) or not policies:
-            raise PermissionError("Public invoice creation requires a policies list.")
-
-        sources: list[dict[str, str]] = []
-        for source_policy in policies:
-            if not isinstance(source_policy, dict):
-                raise PermissionError(
-                    "Public invoice creation policies must be objects."
-                )
-            table = source_policy.get("table")
-            wallet_field = source_policy.get("wallet_field")
-            if not isinstance(table, str) or not table:
-                raise PermissionError(
-                    "Public invoice creation requires a storage table policy."
-                )
-            if not isinstance(wallet_field, str) or not wallet_field:
-                raise PermissionError(
-                    "Public invoice creation requires a wallet field policy."
-                )
-            sources.append({"table": table, "wallet_field": wallet_field})
-
-        if not sources:
-            raise PermissionError(
-                "Public invoice creation requires at least one valid policy."
-            )
-        return sources
-
-    def require_permission(self, permission: str | None) -> None:
-        if permission and permission not in self.permissions:
-            raise PermissionError(
-                f"Extension '{self.extension_id}' is missing permission '{permission}'."
-            )
-
-    def has_authenticated_context(self) -> bool:
-        return bool(self.user_id) or self.context == "event"
-
-    def _require_owner_id(self) -> str:
-        if not self.owner_id:
-            raise PermissionError("Extension API method requires an owner context.")
-        return self.owner_id
-
-    def __repr__(self) -> str:
-        return (
-            "ExtensionHostAPI("
-            f"extension_id={self.extension_id!r}, "
-            f"context={self.context!r}, "
-            f"owner_id={self.owner_id!r}"
-            ")"
-        )
-
-
-def _pay_invoice_response(payment: Any) -> PayInvoiceResponse:
-    return PayInvoiceResponse(
-        ok=True,
-        checking_id=payment.checking_id,
-        payment_hash=payment.payment_hash,
-        status=payment.status,
-        amount_msat=abs(payment.amount),
-        fee_msat=abs(payment.fee),
-        pending=payment.pending,
-        success=payment.success,
-    )
@@ -1,70 +0,0 @@
-from __future__ import annotations
-
-import json
-from typing import Any
-
-from lnurl import LnAddress, Lnurl
-
-
-def normalize_lnurl(value: str) -> str:
-    normalized = value.strip()
-    if normalized.lower().startswith("lightning:"):
-        normalized = normalized[len("lightning:") :]
-    if "@" in normalized:
-        normalized = normalized.lower()
-    if not normalized:
-        raise ValueError("LNURL is required.")
-    return normalized
-
-
-def lnurl_for_core(value: str) -> Lnurl | LnAddress:
-    normalized = normalize_lnurl(value)
-    if "@" in normalized:
-        return LnAddress(normalized)
-    return Lnurl(normalized)
-
-
-def lnurl_payment_amount_for_core(amount: float) -> int:
-    if amount <= 0:
-        raise ValueError("Amount must be greater than zero.")
-    return round(amount * 1000)
-
-
-def lnurl_payment_unit_for_core(currency: str) -> str:
-    unit = currency.strip().lower()
-    if not unit:
-        raise ValueError("Currency is required.")
-    if unit in {"sat", "sats"}:
-        return "sat"
-    return unit.upper()
-
-
-def lnurl_pay_response_metadata_json(response: Any) -> str:
-    metadata = getattr(response, "metadata", None)
-    if metadata is None:
-        return "[]"
-
-    metadata_list = getattr(metadata, "list", None)
-    try:
-        if callable(metadata_list):
-            return json.dumps(metadata_list())
-        return json.dumps(metadata)
-    except TypeError:
-        return json.dumps(str(metadata))
-
-
-def lnurl_pay_response_text(response: Any) -> str:
-    description = getattr(response, "description", None)
-    if description is not None:
-        return str(description)
-
-    metadata = getattr(response, "metadata", None)
-    text = getattr(metadata, "text", None)
-    return str(text) if text is not None else ""
-
-
-def lnurl_pay_response_int(response: Any, snake_name: str, camel_name: str) -> int:
-    value = getattr(response, snake_name, None)
-    if value is None:
-        value = getattr(response, camel_name, 0)
-    return int(value or 0)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
dni ⚡	2320018302	fixup!	2025-11-26 14:26:16 +01:00
dni ⚡	0dc0725a9b	fix: change button label on wallet	2025-11-26 14:25:21 +01:00
				`@@ -1 +0,0 @@`
				`"""SSO authentication providers for LNbits"""`