make it configureable

Uvicorn's default ws_ping_interval=20 / ws_ping_timeout=20 can
non-deterministically close local WebSocket connections (e.g. NWC provider
↔ nostrclient relay) under event-loop load. The client side already sends
its own pings, so server-side pings are redundant here.

See discussion:
https://github.com/lnbits/nostrclient/pull/71#issuecomment-4803033307

.github/workflows/bundle.yml

@@ -10,15 +10,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.head_ref }}
+          ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || github.event.pull_request.head.sha }}
       - uses: lnbits/lnbits/.github/actions/prepare@dev
         with:
           python-version: "3.10"
           node-version: "24.x"
           npm: true
-      - run: make bundle
-      - name: Commit and push bundle changes
+      - name: Build and commit bundle (same-repo PR)
+        if: github.event.pull_request.head.repo.full_name == github.repository
         run: |
+          make bundle
           git config user.name "alan"
           git config user.email "alan@lnbits.com"
           git add lnbits/static
@@ -27,3 +28,6 @@ jobs:
           fi
           git commit -m "chore: make bundle [skip ci]"
           git push
+      - name: Check bundle is up-to-date (fork PR)
+        if: github.event.pull_request.head.repo.full_name != github.repository
+        run: make checkbundle

docs/guide/installation.md

@@ -51,7 +51,7 @@ nav_order: 1
 sudo apt-get install jq libfuse2
 wget $(curl -s https://api.github.com/repos/lnbits/lnbits/releases/latest | jq -r '.assets[] | select(.name | endswith(".AppImage")) | .browser_download_url') -O LNbits-latest.AppImage
 chmod +x LNbits-latest.AppImage
-LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
+LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 AUTH_HTTPS_ONLY=false ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
 ```
 
 - LNbits will create a folder for DB and extension files **in the same directory** as the AppImage.
@@ -285,10 +285,7 @@ but you can also set the env variables or pass command line arguments:
 
 ```sh
 # .env variables are currently passed when running, but LNbits can be managed with the admin UI.
-LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000 --host 0.0.0.0
-
-# Once you have created a user, you can set as the super_user
-SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
+LNBITS_ADMIN_UI=true AUTH_HTTPS_ONLY=false ./result/bin/lnbits --port 9000 --host 0.0.0.0
 ```
 
 > ![NOTE](https://img.shields.io/badge/NOTE-3b82f6?labelColor=494949)

lnbits/core/crud/payments.py

@@ -290,6 +290,7 @@ async def create_payment(
         webhook=data.webhook,
         fee=-abs(data.fee),
         tag=extra.get("tag", None),
+        extension=data.extension,
         extra=extra,
         labels=data.labels or [],
         external_id=data.external_id,

lnbits/core/models/payments.py

@@ -54,6 +54,7 @@ class CreatePayment(BaseModel):
     amount_msat: int
     memo: str
     extra: dict | None = {}
+    extension: str | None = None
     preimage: str | None = None
     expiry: datetime | None = None
     webhook: str | None = None
@@ -259,6 +260,7 @@ class CreateInvoice(BaseModel):
     )
     expiry: int | None = None
     extra: dict | None = None
+    extension: str | None = None
     webhook: str | None = None
     bolt11: str | None = None
     lnurl_withdraw: LnurlWithdrawResponse | None = None

lnbits/core/services/fiat_providers.py

@@ -8,7 +8,7 @@ import httpx
 from loguru import logger
 
 from lnbits.core.crud import get_wallet
-from lnbits.core.crud.payments import create_payment
+from lnbits.core.crud.payments import create_payment, update_payment
 from lnbits.core.models import CreatePayment, Payment, PaymentState
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.db import Connection
@@ -57,6 +57,8 @@ async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
     fiat_status = await fiat_provider.get_invoice_status(checking_id)
 
     if fiat_status.success:
+        payment.status = PaymentState.SUCCESS.value
+        await update_payment(payment)
         await handle_fiat_payment_confirmation(payment)
 
         # notify receivers asynchronously

lnbits/core/services/payments.py

@@ -214,6 +214,7 @@ async def create_wallet_invoice(wallet_id: str, data: CreateInvoice) -> Payment:
             unhashed_description=unhashed_description,
             expiry=data.expiry,
             extra=data.extra,
+            extension=data.extension,
             webhook=data.webhook,
             internal=data.internal,
             payment_hash=data.payment_hash,
@@ -259,6 +260,7 @@ async def create_invoice(
     webhook: str | None = None,
     internal: bool | None = False,
     payment_hash: str | None = None,
+    extension: str | None = None,
     labels: list[str] | None = None,
     external_id: str | None = None,
     conn: Connection | None = None,
@@ -342,6 +344,7 @@ async def create_invoice(
         expiry=invoice.expiry_date,
         memo=memo,
         extra=extra,
+        extension=extension,
         webhook=webhook,
         fee=invoice_response.fee_msat or 0,
         labels=labels,

lnbits/server.py

@@ -27,6 +27,8 @@ from lnbits.settings import set_cli_settings, settings
 @click.option(
     "--reload", is_flag=True, default=False, help="Enable auto-reload for development"
 )
+@click.option("--ws-max-queue", default=128, help="Websocket max queue size")
+@click.option("--ws-ping-timeout", default=900.0, help="Websocket ping timeout")
 def main(
     port: int,
     host: str,
@@ -34,6 +36,8 @@ def main(
     ssl_keyfile: str,
     ssl_certfile: str,
     reload: bool,
+    ws_max_queue: int,
+    ws_ping_timeout: float
 ):
     """Launched with `uv run lnbits` at root level"""
 
@@ -58,6 +62,8 @@ def main(
             ssl_keyfile=ssl_keyfile,
             ssl_certfile=ssl_certfile,
             reload=reload or False,
+            ws_ping_timeout=ws_ping_timeout,
+            ws_max_queue=ws_max_queue,
         )
 
         server = uvicorn.Server(config=config)

lnbits/static/js/init-app.js

@@ -27,6 +27,14 @@ const DynamicComponent = {
             name: r.name,
             component: async () => {
               await LNbits.utils.loadTemplate(r.template)
+              if (r.i18n) {
+                const locale =
+                  window.i18n?.global?.locale?.value ??
+                  window.i18n?.global?.locale ??
+                  window.g.locale ??
+                  'en'
+                await LNbits.utils.loadExtI18n(r.i18n, locale)
+              }
               await LNbits.utils.loadScript(r.component)
               return window[r.name]
             }
@@ -151,6 +159,30 @@ window.i18n = new VueI18n.createI18n({
   fallbackLocale: 'en',
   messages: window.localisation
 })
+;(function () {
+  let _applying = false
+  let _target = null
+  Vue.watch(
+    () => window.i18n.global.locale,
+    async (locale, prevLocale) => {
+      if (_applying || !LNbits.utils._extI18nDirs.size) return
+      _target = locale
+      _applying = true
+      window.i18n.global.locale = prevLocale
+      _applying = false
+      await Promise.all(
+        [...LNbits.utils._extI18nDirs].map(dir =>
+          LNbits.utils.loadExtI18n(dir, locale)
+        )
+      )
+      if (_target !== locale) return
+      _applying = true
+      window.i18n.global.locale = locale
+      _applying = false
+    },
+    {flush: 'sync'}
+  )
+})()
 
 window.app.mixin({
   data() {

lnbits/static/js/utils.js

@@ -323,6 +323,20 @@ window._lnbitsUtils = {
     converter.setOption('simpleLineBreaks', true)
     return converter.makeHtml(text)
   },
+  _extI18nDirs: new Set(),
+  _extI18nLoaded: {},
+  loadExtI18n(dir, locale) {
+    this._extI18nDirs.add(dir)
+    const loaded = (this._extI18nLoaded[dir] ??= {})
+    if (loaded[locale]) return loaded[locale]
+    loaded[locale] = this.loadScript(`${dir}/${locale}.js`).catch(() => {
+      if (locale !== 'en') {
+        loaded['en'] ??= this.loadScript(`${dir}/en.js`).catch(() => {})
+        return loaded['en']
+      }
+    })
+    return loaded[locale]
+  },
   async decryptLnurlPayAES(success_action, preimage) {
     let keyb = new Uint8Array(
       preimage.match(/[\da-f]{2}/gi).map(h => parseInt(h, 16))

lnbits/wallets/phoenixd.py

@@ -117,11 +117,12 @@ class PhoenixdWallet(Wallet):
             # PhoenixD description limited to 128 characters
             if description_hash:
                 data["descriptionHash"] = description_hash.hex()
+            elif unhashed_description:
+                data["descriptionHash"] = hashlib.sha256(
+                    unhashed_description
+                ).hexdigest()
             else:
-                desc = memo
-                if desc is None and unhashed_description:
-                    desc = unhashed_description.decode()
-                desc = desc or ""
+                desc = memo or ""
                 if len(desc) > 128:
                     data["descriptionHash"] = hashlib.sha256(desc.encode()).hexdigest()
                 else:

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lnbits"
-version = "1.5.5-rc2"
+version = "1.5.5"
 requires-python = ">=3.10,<3.13"
 description = "LNbits, free and open-source Lightning wallet and accounts system."
 authors = [{ name = "Alan Bits", email = "alan@lnbits.com" }]

tests/unit/test_fiat_providers.py

@@ -8,7 +8,7 @@ from unittest.mock import AsyncMock
 import pytest
 from pytest_mock.plugin import MockerFixture
 
-from lnbits.core.crud.payments import get_payments
+from lnbits.core.crud.payments import get_payment, get_payments
 from lnbits.core.crud.users import get_user
 from lnbits.core.crud.wallets import create_wallet
 from lnbits.core.models.payments import CreateInvoice, Payment, PaymentState
@@ -1752,6 +1752,51 @@ async def test_check_fiat_status_handles_internal_states(mocker: MockerFixture):
     assert queue_put.await_count == 1
 
 
+@pytest.mark.anyio
+async def test_check_fiat_status_persists_successful_payment(
+    to_wallet: Wallet, settings: Settings, mocker: MockerFixture
+):
+    settings.stripe_enabled = True
+    settings.stripe_api_secret_key = "mock_sk_test_4eC39HqLyjWDarjtT1zdp7dc"
+    settings.stripe_limits.service_min_amount_sats = 0
+    settings.stripe_limits.service_max_amount_sats = 0
+    settings.stripe_limits.service_fee_wallet_id = None
+    settings.stripe_limits.service_faucet_wallet_id = None
+
+    invoice_data = CreateInvoice(
+        unit="USD", amount=1.0, memo="Test", fiat_provider="stripe"
+    )
+    fiat_mock_response = FiatInvoiceResponse(
+        ok=True,
+        checking_id=f"session_paid_{get_random_string(10)}",
+        payment_request="https://stripe.com/pay/session_paid",
+    )
+    mocker.patch(
+        "lnbits.fiat.StripeWallet.create_invoice",
+        AsyncMock(return_value=fiat_mock_response),
+    )
+    mocker.patch(
+        "lnbits.utils.exchange_rates.get_fiat_rate_satoshis",
+        AsyncMock(return_value=1000),
+    )
+    payment = await payments.create_fiat_invoice(to_wallet.id, invoice_data)
+    assert payment.status == PaymentState.PENDING
+
+    mocker.patch(
+        "lnbits.fiat.StripeWallet.get_invoice_status",
+        AsyncMock(return_value=FiatPaymentStatus(paid=True)),
+    )
+    queue_put = mocker.patch("lnbits.tasks.internal_invoice_queue.put", AsyncMock())
+
+    status = await check_fiat_status(payment)
+
+    assert status.success is True
+    assert payment.status == PaymentState.SUCCESS
+    updated_payment = await get_payment(payment.checking_id)
+    assert updated_payment.status == PaymentState.SUCCESS
+    queue_put.assert_awaited_once_with(payment.checking_id)
+
+
 @pytest.mark.anyio
 async def test_verify_paypal_webhook_requires_configuration(settings: Settings):
     settings.paypal_webhook_id = None

tests/wallets/test_nwc_wallets.py

@@ -1,3 +1,4 @@
+import asyncio
 import base64
 import hashlib
 import json
@@ -12,7 +13,7 @@ from Cryptodome.Util.Padding import pad, unpad
 from websockets import ServerConnection
 from websockets import serve as ws_serve
 
-from lnbits.wallets.nwc import NWCWallet
+from lnbits.wallets.nwc import NWCConnection, NWCWallet
 from tests.wallets.helpers import (
     WalletTest,
     build_test_id,
@@ -99,6 +100,8 @@ async def handle(  # noqa: C901
                     event,
                 )
                 await websocket.send(json.dumps(["EVENT", sub_id, event]))
+            elif 23195 in kinds:
+                assert sub_filter["authors"] == [mock_settings["service_public_key"]]
         elif msg[0] == "EVENT":
             event = msg[1]
             decrypted_content = decrypt_content(
@@ -177,6 +180,129 @@ async def run(data: WalletTest):
             await nwcwallet.cleanup()
 
 
+@pytest.mark.anyio
+async def test_nwc_rejects_event_from_unexpected_pubkey(mocker):
+    async def _noop(*args, **kwargs):
+        return None
+
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._connect_to_relay", new=_noop)
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._handle_timeouts", new=_noop)
+
+    service_private_key = PrivateKey()
+    service_public_key = service_private_key.public_key.format().hex()[2:]
+    attacker_private_key = PrivateKey()
+    attacker_public_key = attacker_private_key.public_key.format().hex()[2:]
+    account_private_key = PrivateKey()
+
+    conn = NWCConnection(
+        service_public_key,
+        account_private_key.secret.hex(),
+        "ws://127.0.0.1:8555",
+    )
+    try:
+        event = {
+            "kind": 23195,
+            "content": "{}",
+            "created_at": int(time.time()),
+            "tags": [["e", "request-event-id"]],
+        }
+        sign_event(attacker_public_key, attacker_private_key.secret.hex(), event)
+
+        with pytest.raises(Exception, match="Invalid event signature"):
+            await conn._on_event_message(["EVENT", "subid", event])
+    finally:
+        await conn.close()
+
+
+@pytest.mark.anyio
+async def test_nwc_marks_pending_invoice_settled_only_once():
+    wallet = NWCWallet.__new__(NWCWallet)
+    wallet.pending_invoice_details = {"checking-id": {"checking_id": "checking-id"}}
+    wallet.pending_invoices = ["checking-id"]
+    wallet.paid_invoices_queue = asyncio.Queue(0)
+
+    wallet._mark_invoice_settled("checking-id", source="notification")
+    wallet._mark_invoice_settled("checking-id", source="notification")
+
+    assert wallet.paid_invoices_queue.qsize() == 1
+    assert await wallet.paid_invoices_queue.get() == "checking-id"
+
+
+@pytest.mark.anyio
+async def test_nwc_registers_notification_subscriptions(mocker):
+    async def _noop(*args, **kwargs):
+        return None
+
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._connect_to_relay", new=_noop)
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._handle_timeouts", new=_noop)
+
+    service_private_key = PrivateKey()
+    service_public_key = service_private_key.public_key.format().hex()[2:]
+    account_private_key = PrivateKey()
+
+    conn = NWCConnection(
+        service_public_key,
+        account_private_key.secret.hex(),
+        "ws://127.0.0.1:8555",
+    )
+    send_mock = mocker.patch.object(conn, "_send", mocker.AsyncMock())
+
+    try:
+        await conn._subscribe_to_notifications()
+
+        assert len(conn.notification_subscription_ids) == 2
+        assert len(conn.subscriptions) == 2
+        assert set(conn.subscriptions.keys()) == conn.notification_subscription_ids
+        assert all(
+            subscription["method"] == "notification_sub"
+            and subscription["event_id"] == subscription["sub_id"]
+            for subscription in conn.subscriptions.values()
+        )
+        assert send_mock.await_count == 2
+    finally:
+        await conn.close()
+
+
+@pytest.mark.anyio
+async def test_nwc_spreads_fallback_lookups_with_cooldown(mocker):
+    def _schedule_next_lookup(
+        invoice: dict[str, object], now: float | None = None
+    ) -> None:
+        assert now is not None
+        invoice["next_lookup_at"] = now + 1
+
+    wallet = NWCWallet.__new__(NWCWallet)
+    wallet.shutdown = False
+    wallet.pending_invoices = ["checking-1", "checking-2"]
+    wallet.pending_invoice_details = {
+        "checking-1": {
+            "checking_id": "checking-1",
+            "next_lookup_at": 0.0,
+            "lookup_attempts": 0,
+        },
+        "checking-2": {
+            "checking_id": "checking-2",
+            "next_lookup_at": 0.0,
+            "lookup_attempts": 0,
+        },
+    }
+    wallet.pending_invoices_lookup_cooldown = 1.0
+    wallet._is_shutting_down = lambda: False
+    wallet._payment_data_is_settled = lambda payment_data: False
+    wallet._cache_payment_data = lambda *args, **kwargs: None
+    wallet._schedule_next_lookup = _schedule_next_lookup
+    wallet.conn = mocker.Mock()
+    wallet.conn.get_info = mocker.AsyncMock()
+    wallet.conn.supports_method = mocker.Mock(return_value=True)
+    wallet.conn.call = mocker.AsyncMock(return_value={"settled_at": None})
+    sleep_mock = mocker.patch("lnbits.wallets.nwc.asyncio.sleep", mocker.AsyncMock())
+
+    await wallet._run_fallback_lookups(100.0)
+
+    assert wallet.conn.call.await_count == 2
+    sleep_mock.assert_awaited_once_with(1.0)
+
+
 @pytest.mark.anyio
 @pytest.mark.parametrize(
     "test_data",

uv.lock

@@ -1288,7 +1288,7 @@ wheels = [
 
 [[package]]
 name = "lnbits"
-version = "1.5.5rc2"
+version = "1.5.5"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },