fundle

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.env.example

@@ -6,6 +6,14 @@
 # The following settings are ONLY set in your .env file.
 # They are NOT managed by the Admin UI and are not stored in the database.
 
+# === First Install Token ===
+# If set the user is required to enter this token on the /first_install page
+# FIRST_INSTALL_TOKEN="myaccesstoken"
+
+# === Security ===
+# When enabled (recommended), auth cookies require HTTPS and SSO will reject insecure HTTP.
+AUTH_HTTPS_ONLY=true
+
 # === Logging and Development ===
 
 DEBUG=False
@@ -20,6 +28,10 @@ LOG_ROTATION="100 MB"
 LOG_RETENTION="3 months"
 # for database cleanup commands
 # CLEANUP_WALLETS_DAYS=90
+# Hard limit for total created users. Set to 0 to disable the limit.
+# LNBITS_MAX_USERS=0
+# Hard limit for total installed extensions. Set to 0 to disable the limit.
+# LNBITS_MAX_EXTENSIONS=0
 
 # === Admin Settings ===
 
@@ -55,7 +67,7 @@ LNBITS_EXTENSIONS_DEFAULT_INSTALL="tpos"
 # LNBITS_EXT_GITHUB_TOKEN=github_pat_xxxxxxxxxxxxxxxxxx
 
 # which fundingsources are allowed in the admin ui
-# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet, StrikeWallet, CLNRestWallet"
+# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet, StrikeWallet, CLNRestWallet, SparkWallet, SparkL2Wallet"
 
 # uvicorn variable, allow https behind a proxy
 # IMPORTANT: this also needs the webserver to be configured to forward the headers
@@ -90,7 +102,7 @@ AUTH_SECRET_KEY=""
 ######################################
 
 AUTH_TOKEN_EXPIRE_MINUTES=525600
-# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth
+# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth, oidc-auth
 AUTH_ALLOWED_METHODS="user-id-only, username-password"
 # Set this flag if HTTP is used for OAuth
 # OAUTHLIB_INSECURE_TRANSPORT="1"
@@ -187,6 +199,15 @@ BOLTZ_CLIENT_MACAROON="/home/bob/.boltz/macaroons/admin.macaroon"
 # HEXSTRING instead of path also possible
 BOLTZ_CLIENT_CERT="/home/bob/.boltz/tls.cert"
 
+# SparkL2Wallet (external sidecar: https://github.com/lnbits/spark_sidecar)
+SPARK_L2_NETWORK=MAINNET
+SPARK_L2_EXTERNAL_ENDPOINT=http://127.0.0.1:8765
+SPARK_L2_EXTERNAL_API_KEY=
+# optional tuning
+# SPARK_L2_PAY_WAIT_MS=4000
+# SPARK_L2_PAY_POLL_MS=500
+# SPARK_L2_STREAM_KEEPALIVE_MS=15000
+
 # StrikeWallet
 STRIKE_API_ENDPOINT=https://api.strike.me/v1
 STRIKE_API_KEY=YOUR_STRIKE_API_KEY
@@ -258,6 +279,50 @@ KEYCLOAK_DISCOVERY_URL=""
 KEYCLOAK_CLIENT_CUSTOM_ORG=""
 KEYCLOAK_CLIENT_CUSTOM_ICON=""
 
+# OIDC OAuth Config
+# Generic OIDC provider configuration
+# Make sure that the redirect URI in your OIDC provider is set to: https://{domain}/api/v1/auth/oidc/token
+# Required scopes: openid, email, profile
+# The discovery URL must be accessible from your LNbits server
+# Always use HTTPS in production environments
+# The CUSTOM_ORG and CUSTOM_ICON settings allow you to customize the login button
+# For example: "Login via Zitadel" with the Zitadel logo
+OIDC_DISCOVERY_URL=""
+OIDC_CLIENT_ID=""
+OIDC_CLIENT_SECRET=""
+OIDC_CLIENT_CUSTOM_ORG=""
+OIDC_CLIENT_CUSTOM_ICON=""
+
+# Example OIDC configurations for various providers:
+#
+# ZITADEL:
+# OIDC_DISCOVERY_URL=https://login.yourdomain.de/.well-known/openid-configuration
+# OIDC_CLIENT_ID=your-zitadel-client-id@project-id
+# OIDC_CLIENT_SECRET=your-zitadel-client-secret
+# OIDC_CLIENT_CUSTOM_ORG=Zitadel
+# OIDC_CLIENT_CUSTOM_ICON=/static/images/zitadel.png
+#
+# AUTHENTIK:
+# OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/lnbits/.well-known/openid-configuration
+# OIDC_CLIENT_ID=your-authentik-client-id
+# OIDC_CLIENT_SECRET=your-authentik-client-secret
+# OIDC_CLIENT_CUSTOM_ORG=Authentik
+# OIDC_CLIENT_CUSTOM_ICON=/static/images/authentik.png
+#
+# AUTHELIA:
+# OIDC_DISCOVERY_URL=https://auth.yourdomain.com/.well-known/openid-configuration
+# OIDC_CLIENT_ID=your-authelia-client-id
+# OIDC_CLIENT_SECRET=your-authelia-client-secret
+# OIDC_CLIENT_CUSTOM_ORG=Authelia
+# OIDC_CLIENT_CUSTOM_ICON=/static/images/authelia.png
+#
+# OKTA:
+# OIDC_DISCOVERY_URL=https://your-domain.okta.com/.well-known/openid-configuration
+# OIDC_CLIENT_ID=your-okta-client-id
+# OIDC_CLIENT_SECRET=your-okta-client-secret
+# OIDC_CLIENT_CUSTOM_ORG=Okta
+# OIDC_CLIENT_CUSTOM_ICON=/static/images/okta.png
+
 
 ######################################
 
@@ -313,10 +378,12 @@ LNBITS_SERVICE_FEE=0.0
 # disable fees for internal transactions
 # LNBITS_SERVICE_FEE_IGNORE_INTERNAL=true
 
-# value in millisats
+# The minimum fee reserved per payment (millisats)
 LNBITS_RESERVE_FEE_MIN=2000
-# value in percent
+# The percentage of the payment amount to reserve for routing fees (percent)
 LNBITS_RESERVE_FEE_PERCENT=1.0
+# The default time to wait to for status response from the funding source when paying an invoice
+LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS=5
 
 # limit the maximum balance for each wallet
 # throw an error if the wallet attempts to create a new invoice

.github/workflows/appimage.yml

@@ -69,7 +69,10 @@ jobs:
             --onefile \
             --name lnbits \
             --hidden-import=embit \
+            --hidden-import=bitstring.bitstore_bitarray \
             --collect-all embit \
+            --collect-all bitstring \
+            --collect-all bitarray \
             --collect-all lnbits \
             --collect-all sqlalchemy \
             --collect-all breez_sdk \

.github/workflows/bundle.yml

@@ -0,0 +1,29 @@
+name: bundle
+on:
+  workflow_call:
+
+jobs:
+  bundle:
+    permissions:
+      contents: write
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+      - uses: lnbits/lnbits/.github/actions/prepare@dev
+        with:
+          python-version: "3.10"
+          node-version: "24.x"
+          npm: true
+      - run: make bundle
+      - name: Commit and push bundle changes
+        run: |
+          git config user.name "alan"
+          git config user.email "alan@lnbits.com"
+          git add lnbits/static
+          if git diff --cached --quiet; then
+            exit 0
+          fi
+          git commit -m "chore: make bundle [skip ci]"
+          git push

.github/workflows/ci.yml

@@ -1,14 +1,9 @@
 name: LNbits CI
 on:
-  push:
-    branches:
-      - main
-      - dev
   pull_request:
 
 
 jobs:
-
   lint:
     uses: ./.github/workflows/lint.yml
 
@@ -16,7 +11,7 @@ jobs:
     needs: [ lint ]
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.12"]
         db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
     uses: ./.github/workflows/tests.yml
     with:
@@ -30,7 +25,7 @@ jobs:
     needs: [ lint ]
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.12"]
         db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
     uses: ./.github/workflows/tests.yml
     with:
@@ -44,7 +39,7 @@ jobs:
     needs: [ lint ]
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.12"]
         db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
     uses: ./.github/workflows/tests.yml
     with:
@@ -58,7 +53,7 @@ jobs:
     needs: [ lint ]
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.12"]
     uses: ./.github/workflows/migration.yml
     with:
       python-version: ${{ matrix.python-version }}
@@ -74,7 +69,7 @@ jobs:
     uses: ./.github/workflows/regtest.yml
     strategy:
       matrix:
-        python-version: ["3.10"]
+        python-version: ["3.12"]
         backend-wallet-class:
           - BoltzWallet
           - LndRestWallet
@@ -94,7 +89,11 @@ jobs:
     needs: [ lint ]
     strategy:
       matrix:
-        python-version: ["3.10"]
+        python-version: ["3.12"]
     uses: ./.github/workflows/jmeter.yml
     with:
       python-version: ${{ matrix.python-version }}
+
+  bundle:
+    needs: [ lint, test-api, test-wallets, test-unit, migration, openapi, regtest, jmeter ]
+    uses: ./.github/workflows/bundle.yml

.github/workflows/docker.yml

@@ -55,11 +55,21 @@ jobs:
       - name: Build and push boltz
         uses: docker/build-push-action@v5
         with:
-            context: .
-            file: Dockerfile.boltz
+            context: docker/boltzclient
             push: true
             tags: ${{ secrets.DOCKER_USERNAME }}/lnbits-boltz:${{ inputs.tag }}
             platforms: linux/amd64,linux/arm64
             cache-from: type=local,src=/tmp/.buildx-cache
             cache-to: type=local,dest=/tmp/.buildx-cache
             build-args: LNBITS_TAG=${{ inputs.tag }}
+
+      - name: Build and push sparkl2
+        uses: docker/build-push-action@v5
+        with:
+            context: docker/sparkl2
+            push: true
+            tags: ${{ secrets.DOCKER_USERNAME }}/lnbits-sparkl2:${{ inputs.tag }}
+            platforms: linux/amd64,linux/arm64
+            cache-from: type=local,src=/tmp/.buildx-cache
+            cache-to: type=local,dest=/tmp/.buildx-cache
+            build-args: LNBITS_TAG=${{ inputs.tag }}

.github/workflows/jmeter.yml

@@ -22,6 +22,7 @@ jobs:
       - name: run LNbits
         env:
           LNBITS_ADMIN_UI: true
+          AUTH_HTTPS_ONLY: false
           LNBITS_EXTENSIONS_DEFAULT_INSTALL: "watchonly, satspay, tipjar, tpos, lnurlp, withdraw"
           LNBITS_BACKEND_WALLET_CLASS: FakeWallet
         run: |

.github/workflows/lint.yml

@@ -6,53 +6,30 @@ jobs:
 
   black:
     uses: ./.github/workflows/make.yml
-    strategy:
-      matrix:
-        python-version: ["3.10", "3.11", "3.12"]
     with:
       make: checkblack
-      python-version: ${{ matrix.python-version }}
 
   ruff:
     uses: ./.github/workflows/make.yml
-    strategy:
-      matrix:
-        python-version: ["3.10", "3.11", "3.12"]
     with:
       make: checkruff
-      python-version: ${{ matrix.python-version }}
 
   mypy:
     uses: ./.github/workflows/make.yml
-    strategy:
-      matrix:
-        python-version: ["3.10", "3.11", "3.12"]
     with:
       make: mypy
-      python-version: ${{ matrix.python-version }}
 
   pyright:
     uses: ./.github/workflows/make.yml
-    strategy:
-      matrix:
-        python-version: ["3.10", "3.11", "3.12"]
     with:
       make: pyright
-      python-version: ${{ matrix.python-version }}
       npm: true
 
-
   prettier:
     uses: ./.github/workflows/make.yml
     with:
       make: checkprettier
       npm: true
 
-  bundle:
-    uses: ./.github/workflows/make.yml
-    with:
-      make: checkbundle
-      npm: true
-
   poetry:
     uses: ./.github/workflows/poetry.yml

.github/workflows/make.yml

@@ -14,7 +14,7 @@ on:
       python-version:
         description: "python version"
         type: string
-        default: "3.10"
+        default: "3.12"
 
 jobs:
   make:
@@ -22,7 +22,7 @@ jobs:
     strategy:
       matrix:
         os-version: ["ubuntu-24.04"]
-        node-version: ["18.x"]
+        node-version: ["24.x"]
     runs-on: ${{ matrix.os-version }}
     steps:
       - uses: actions/checkout@v4

.github/workflows/regtest.yml

@@ -8,7 +8,7 @@ on:
         required: true
         type: string
       python-version:
-        default: "3.10"
+        default: "3.12"
         type: string
       os-version:
         default: "ubuntu-24.04"
@@ -38,8 +38,7 @@ jobs:
 
       - name: Setup Regtest
         run: |
-          git clone https://github.com/lnbits/legend-regtest-enviroment.git docker
-          cd docker
+          cd docker/regtest
           chmod +x ./start-regtest
           ./start-regtest
           sudo chmod -R a+rwx .
@@ -50,16 +49,16 @@ jobs:
           LNBITS_DATABASE_URL: ${{ inputs.db-url }}
           LNBITS_BACKEND_WALLET_CLASS: ${{ inputs.backend-wallet-class }}
           LND_REST_ENDPOINT: https://localhost:8081/
-          LND_REST_CERT: ./docker/data/lnd-3/tls.cert
-          LND_REST_MACAROON: ./docker/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
+          LND_REST_CERT: ./docker/regtest/data/lnd-3/tls.cert
+          LND_REST_MACAROON: ./docker/regtest/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
           LND_GRPC_ENDPOINT: localhost
           LND_GRPC_PORT: 10009
-          LND_GRPC_CERT: docker/data/lnd-3/tls.cert
-          LND_GRPC_MACAROON: docker/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
-          CORELIGHTNING_RPC: ./docker/data/clightning-1/regtest/lightning-rpc
+          LND_GRPC_CERT: ./docker/regtest/data/lnd-3/tls.cert
+          LND_GRPC_MACAROON: ./docker/regtest/data/lnd-3/data/chain/bitcoin/regtest/admin.macaroon
+          CORELIGHTNING_RPC: ./docker/regtest/data/clightning-1/regtest/lightning-rpc
           CORELIGHTNING_REST_URL: https://localhost:3001
-          CORELIGHTNING_REST_MACAROON: ./docker/data/clightning-2-rest/access.macaroon
-          CORELIGHTNING_REST_CERT: ./docker/data/clightning-2-rest/certificate.pem
+          CORELIGHTNING_REST_MACAROON: ./docker/regtest/data/clightning-2-rest/access.macaroon
+          CORELIGHTNING_REST_CERT: ./docker/regtest/data/clightning-2-rest/certificate.pem
           LNBITS_ENDPOINT: http://localhost:5001
           LNBITS_KEY: "d08a3313322a4514af75d488bcc27eee"
           ECLAIR_URL: http://127.0.0.1:8082

.github/workflows/release-rc.yml

@@ -33,6 +33,7 @@ jobs:
 
   docker:
     if: github.repository == 'lnbits/lnbits'
+    needs: [ release ]
     uses: ./.github/workflows/docker.yml
     with:
       tag: ${{ github.ref_name }}
@@ -40,6 +41,16 @@ jobs:
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
 
+  docker-latest-rc:
+    if: github.repository == 'lnbits/lnbits'
+    needs: [ release ]
+    uses: ./.github/workflows/docker.yml
+    with:
+      tag: latest-rc
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+
   pypi:
     if: github.repository == 'lnbits/lnbits'
     runs-on: ubuntu-24.04

.github/workflows/release.yml

@@ -52,6 +52,16 @@ jobs:
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
 
+  docker-latest-rc:
+    if: github.repository == 'lnbits/lnbits'
+    needs: [ release ]
+    uses: ./.github/workflows/docker.yml
+    with:
+      tag: latest-rc
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+
   pypi:
     if: github.repository == 'lnbits/lnbits'
     runs-on: ubuntu-24.04

.github/workflows/tests.yml

@@ -8,7 +8,7 @@ on:
         required: true
         type: string
       python-version:
-        default: "3.10"
+        default: "3.12"
         type: string
       os-version:
         default: "ubuntu-24.04"

.gitignore

@@ -6,6 +6,7 @@ __pycache__
 *$py.class
 .mypy_cache
 .vscode
+.codex
 *-lock.json
 .python-version
 
@@ -42,7 +43,6 @@ lnbits/static/bundle.min.js.old
 lnbits/static/bundle.min.css.old
 lnbits/static/bundle-components.min.js.old
 lnbits/upgrades
-docker
 
 # Nix
 *result*

.pre-commit-config.yaml

@@ -14,11 +14,11 @@ repos:
       - id: mixed-line-ending
       - id: check-case-conflict
   - repo: https://github.com/psf/black
-    rev: 25.1.0
+    rev: 26.3.1
     hooks:
       - id: black
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.10
+    rev: v0.14.10
     hooks:
       - id: ruff
         args: [ --fix, --exit-non-zero-on-fix ]

Dockerfile

@@ -43,4 +43,4 @@ ENV LNBITS_HOST="0.0.0.0"
 
 EXPOSE 5000
 
-CMD ["sh", "-c", "uv run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
+CMD ["sh", "-c", "uv --offline run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]

Makefile

@@ -66,6 +66,7 @@ test-regtest:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
+	rm -rf ./tests/data \
 	uv run pytest tests/regtest
 
 test-migration:

README.md

@@ -1,12 +1,12 @@
 <a href="https://lnbits.com" target="_blank" rel="noopener noreferrer">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://i.imgur.com/QE6SIrs.png">
-    <img src="https://i.imgur.com/fyKPgVT.png" alt="LNbits" style="width:300px">
+    <source media="(prefers-color-scheme: dark)" srcset="docs/logos/lnbits-full-inverse.svg">
+    <img src="docs/logos/lnbits-full.svg" alt="LNbits" style="width:300px">
   </picture>
 </a>
 
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) [<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)  
-<img width="2000" height="203" alt="lnbits_head" src="https://github.com/user-attachments/assets/77669718-ac10-43c7-ae95-6ce236c77401" />  
+<img alt="lnbits_head" src="docs/assets/header.jpg" />  
 [![tip-hero](https://img.shields.io/badge/TipJar-LNBits%20Hero-9b5cff?labelColor=6b7280&logo=lightning&logoColor=white)](https://demo.lnbits.com/tipjar/DwaUiE4kBX6mUW6pj3X5Kg)
 
 # LNbits — The most powerful Bitcoin & Lightning toolkit
@@ -46,7 +46,7 @@ Get yourself familiar and test on our demo server [demo.lnbits.com](https://demo
 
 LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending, export to csv. Each wallet also comes with its own API keys, to help partition the exposure of your funding source.
 
-<img src="https://i.imgur.com/w8jdGpF.png" style="width:800px">
+<img alt="lnbits_wallet" src="docs/assets/wallet.jpg" />
 
 ## LNbits extension universe
 
@@ -54,25 +54,25 @@ Extend YOUR LNbits to meet YOUR needs.
 
 All non-core features are installed as extensions, reducing your code base and making your LNbits unique to you. Extend your LNbits install in any direction, and even create and share your own extensions.
 
-<img src="https://i.imgur.com/aEBpwJF.png" style="width:800px">
+<img alt="lnbits_extensions" src="docs/assets/extensions.jpg" />
 
 ## LNbits API
 
 LNbits has a powerful API, many projects use LNbits to do the heavy lifting for their bitcoin/lightning services.
 
-<img src="https://i.imgur.com/V742sb9.png" style="width:800px">
+<img alt="lnbits_api" src="docs/assets/api.jpg" />
 
 ## LNbits node manager
 
 LNbits comes packaged with a light node management UI, to make running your node that much easier.
 
-<img src="https://i.imgur.com/TYqIK60.png" style="width:800px">
+<img alt="lnbits_api" src="docs/assets/lightning_node.jpg" />
 
-## LNbits across all your devices
+## LNbits merchant tools
 
-As well as working great in a browser, LNbits has native IoS and Android apps as well as a chrome extension. So you can enjoy the same UI across ALL your devices.
+The LNbits stack can process both bitcoin and fiat payments, making it a turnkey, all-in-one solution for merchants. With orders and inventory shared across extensions, and built-in notifications for Nostr, Telegram, and email, LNbits keeps everything in sync, freeing merchants to focus on their business.
 
-<img src="https://i.imgur.com/J96EbRf.png" style="width:800px">
+<img alt="lnbits_merchants" src="docs/assets/merchants_small.webp" />
 
 ## Powered by LNbits
 

docker/boltzclient/Dockerfile

@@ -14,11 +14,13 @@ ENV PATH="/root/.local/bin:$PATH"
 # Reinstall dependencies just in case (needed for CMD usage)
 RUN uv sync --all-extras
 
-# LNbits + boltzd configuration
+# LNbits
 ENV LNBITS_PORT="5000"
 ENV LNBITS_HOST="0.0.0.0"
 ENV LNBITS_BACKEND_WALLET_CLASS="BoltzWallet"
-ENV FUNDING_SOURCE_MAX_RETRIES=10
+ENV FUNDING_SOURCE_MAX_RETRIES="10"
+
+# Boltzd
 ENV BOLTZ_CLIENT_ENDPOINT="127.0.0.1:9002"
 ENV BOLTZ_CLIENT_MACAROON="/root/.boltz/macaroons/admin.macaroon"
 ENV BOLTZ_CLIENT_CERT="/root/.boltz/tls.cert"
@@ -26,8 +28,7 @@ ENV BOLTZ_CLIENT_WALLET="lnbits"
 
 EXPOSE 5000
 
-# Entrypoint to start boltzd and LNbits
-COPY dockerboltz.sh /dockerboltz.sh
-RUN chmod +x /dockerboltz.sh
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
-CMD ["/dockerboltz.sh"]
+CMD ["/entrypoint.sh"]

docker/regtest/.gitignore

@@ -0,0 +1,18 @@
+!data
+data/*
+
+!data/boltz
+data/boltz/*
+!data/boltz/boltz.conf
+
+!data/boltz-client
+data/boltz-client/*
+!data/boltz-client/boltz.toml
+
+!data/boltz-nginx
+data/boltz-nginx/*
+!data/boltz-nginx/default.conf
+
+!data/eclair
+data/eclair/*
+!data/eclair/eclair.conf

docker/regtest/README.md

@@ -0,0 +1,99 @@
+![TESTS](https://github.com/lnbits/legend-regtest-enviroment/actions/workflows/ci.yml/badge.svg)
+
+# nodes
+
+- lnd-1: for locally testing your current lnbits
+- lnd-2: used for boltz backend
+- lnd-3: used for lnbits inside docker
+- cln-1: for locally testing your current lnbits
+- cln-2: used for clightning-REST
+- eclair-1: for locally testing your current lnbits
+
+# Installing regtest
+
+get the regtest enviroment ready
+
+```sh
+# Install docker https://docs.docker.com/engine/install/
+# Make sure your user has permission to use docker 'sudo usermod -aG docker ${USER}' then reboot
+# Stop/start docker 'sudo systemctl stop docker' 'sudo systemctl start docker'
+
+sudo apt install jq
+git clone https://github.com/lnbits/lnbits.git
+cd lnbits
+docker build -t lnbits/lnbits .
+mkdir docker
+git clone https://github.com/lnbits/legend-regtest-enviroment.git docker
+cd docker
+chmod +x ./start-regtest
+./start-regtest # start the regtest and also run tests
+sudo chown -R $USER ./data # Give the data file permissions for user
+```
+
+# Running LNbits on regtest
+
+add this ENV variables to your `.env` file
+
+```sh
+DEBUG=true
+
+# LND
+LNBITS_BACKEND_WALLET_CLASS="LndRestWallet"
+LND_REST_ENDPOINT=https://127.0.0.1:8081/
+LND_REST_CERT=/home/user/repos/lnbits/docker/data/lnd-1/tls.cert
+LND_REST_MACAROON=/home/user/repos/lnbits/docker/data/lnd-1/data/chain/bitcoin/regtest/admin.macaroon
+
+# CLN
+LNBITS_BACKEND_WALLET_CLASS="CoreLightningWallet"
+CORELIGHTNING_RPC=./docker/data/clightning-1/regtest/lightning-rpc
+
+
+# Run LNbits
+uv run lnbits
+
+# Run LNbits with hot reload
+make dev
+```
+
+# testing
+
+```sh
+chmod +x ./start-regtest
+./start-regtest
+# short answer :)
+./start-regtest && echo "PASSED" || echo "FAILED" > /dev/null
+```
+
+usage of the `bitcoin-cli-sim`, `lightning-cli-sim` and `lncli-sim` aliases
+
+```sh
+cd ~/lnbits/docker
+source docker-scripts.sh
+# use bitcoin core, mine a block
+bitcoin-cli-sim -generate 1
+
+# use c-lightning nodes
+lightning-cli-sim 1 newaddr | jq -r '.bech32' # use node 1
+lightning-cli-sim 2 getinfo # use node 2
+lightning-cli-sim 3 getinfo # use node 3
+
+# use lnd nodes
+lncli-sim 1 newaddr p2wsh
+lncli-sim 2 listpeers
+```
+
+# urls
+
+- mempool: http://localhost:8080/
+- boltz api: http://localhost:9001/
+- lnd-1 rest: http://localhost:8081/
+- lnbits: http://localhost:5001/
+
+# debugging docker logs
+
+```sh
+docker logs lnbits-lnbits-1 -f
+docker logs lnbits-boltz-1 -f
+docker logs lnbits-clightning-1-1 -f
+docker logs lnbits-lnd-2-1 -f
+```

docker/regtest/data/boltz-client/boltz.toml

@@ -0,0 +1,49 @@
+standalone = true
+network = "regtest"
+
+# Path the the log file
+logfile = ""
+
+electrumUrl = "electrs:19001"
+electrumLiquidUrl = "electrs-liquid:19002"
+
+[BOLTZ]
+# By default the daemon automatically connects to the official Boltz instance for the network LND is on
+# This value is used to override that
+url = "http://boltz-nginx:9001"
+
+[DATABASE]
+# Path to the SQLite database file
+# path = "/home/michael/test.db"
+
+[RPC]
+# Host of
+host = "0.0.0.0"
+
+# Port of the gRPC interface
+port = 9002
+
+# Whether the REST proxy for the gRPC interface should be disabled
+restDisabled = false
+
+# Host of the REST proxy
+restHost = "0.0.0.0"
+
+# Port of the REST proxy
+restPort = 9003
+
+# Path to the TLS cert for the gRPC and REST interface
+tlsCert = ""
+
+# Path to the TLS private key for the gRPC and REST interface
+tlsKey = ""
+noTls = true
+
+# Whether the macaroon authentication for the gRPC and REST interface should be disabled
+noMacaroons = true
+
+# Path to the admin macaroon for the gRPC and REST interface
+adminMacaroonPath = ""
+
+# Path to the read only macaroon for the gRPC and REST interface
+readOnlyMacaroonPath = ""

docker/regtest/data/boltz-nginx/default.conf

@@ -0,0 +1,49 @@
+upstream boltz {
+    server boltz:9001;
+}
+
+upstream boltzr {
+    server boltz:9005;
+}
+
+upstream ws {
+    server boltz:9004;
+}
+
+server {
+    listen 9001;
+    listen [::]:9001;
+    server_name localhost;
+
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Access-Control-Allow-Methods 'GET, PATCH, DELETE, POST, OPTIONS' always;
+    add_header Access-Control-Allow-Headers "*" always;
+
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    if ($request_method = OPTIONS) {
+        return 204;
+    }
+
+    location /v2/ws {
+        proxy_pass http://ws/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+    }
+
+    location ~ ^/v2/(lightning|swap/rescue|swap/restore) {
+        proxy_pass http://boltzr;
+    }
+
+    location /streamswapstatus {
+        proxy_pass http://boltzr;
+    }
+
+    location / {
+        proxy_pass http://boltz;
+    }
+}

docker/regtest/data/boltz/boltz.conf

@@ -0,0 +1,114 @@
+[api]
+host = "0.0.0.0"
+port = 9_001
+
+[grpc]
+host = "0.0.0.0"
+port = 9_000
+
+[postgres]
+host = "boltz-postgres"
+port = 5432
+database = "boltz"
+username = "boltz"
+password = "boltz"
+
+[sidecar]
+  [sidecar.grpc]
+  host = "127.0.0.1"
+  port = 9003
+
+  [sidecar.ws]
+  host = "0.0.0.0"
+  port = 9004
+
+  [sidecar.api]
+  host = "0.0.0.0"
+  port = 9005
+
+[swap]
+deferredClaimSymbols = ["BTC", "L-BTC"]
+
+[[pairs]]
+base = "BTC"
+quote = "BTC"
+rate = 1
+fee = 0.5
+swapInFee = 0.1
+maxSwapAmount = 40_294_967
+minSwapAmount = 50_000
+
+  [pairs.timeoutDelta]
+  chain = 1440
+  reverse = 1440
+  swapMinimal = 1440
+  swapMaximal = 2880
+  swapTaproot = 10080
+
+[[pairs]]
+base = "L-BTC"
+quote = "BTC"
+fee = 0.25
+swapInFee = 0.1
+rate = 1
+maxSwapAmount = 40_294_967
+minSwapAmount = 100
+
+  [pairs.submarineSwap]
+  minSwapAmount = 1_000
+  minBatchedAmount = 21
+
+  [pairs.chainSwap]
+  minSwapAmount = 25_000
+
+  [pairs.timeoutDelta]
+  chain = 1440
+  reverse = 1440
+  swapMinimal = 1440
+  swapMaximal = 2880
+  swapTaproot = 10080
+
+[[currencies]]
+symbol = "BTC"
+network = "bitcoinRegtest"
+minWalletBalance = 10_000_000
+minChannelBalance = 10_000_000
+maxSwapAmount = 40_294_967
+minSwapAmount = 10_000
+maxZeroConfAmount = 0
+
+  [currencies.chain]
+  # mempoolSpace = "http://mempool-web:8090/api"
+  host = "bitcoind"
+  zmqpubrawtx = "tcp://bitcoind:29000"
+  zmqpubrawblock = "tcp://bitcoind:29001"
+  port = 18_443
+  cookie = "/root/.bitcoin/regtest/.cookie"
+  feeFloor = 0.2
+
+  wallet = "lnbits"
+
+  [currencies.lnd]
+  host = "lnd-2"
+  port = 10_009
+  certpath = "/data/lnd/tls.cert"
+  macaroonpath = "/data/lnd/data/chain/bitcoin/regtest/admin.macaroon"
+
+
+[liquid]
+symbol = "L-BTC"
+network = "liquidRegtest"
+
+maxSwapAmount = 40_294_967
+minSwapAmount = 10_000
+maxZeroConfAmount = 40_294_967
+
+
+  [liquid.chain]
+  host = "elementsd"
+  port = 18884
+  cookie = "/root/.elements/liquidregtest/.cookie"
+  zmqpubrawtx = "tcp://elementsd:31000"
+  zmqpubhashblock = "tcp://elementsd:31002"
+
+  wallet = "lnbits"

docker/regtest/data/eclair/eclair.conf

@@ -0,0 +1,28 @@
+eclair {
+  chain = "regtest"
+
+  api {
+    binding-ip = "0.0.0.0"
+    enabled = true
+    port = 8080
+    password = "lnbits"
+  }
+
+  bitcoind {
+    host = "bitcoind"
+    rpcport = 18443
+    auth = "safecookie"
+    cookie = "/root/.bitcoin/regtest/.cookie"
+
+    zmqblock = "tcp://bitcoind:29002"
+    zmqtx = "tcp://bitcoind:29000"
+  }
+
+  channel {
+    max-funding-satoshis = 10000000000
+  }
+
+  features {
+    option_support_large_channel = mandatory
+  }
+}

docker/regtest/docker-compose.yml

@@ -0,0 +1,434 @@
+services:
+
+  lnbits:
+    hostname: lnbits
+    depends_on:
+      - lnd-3
+    image: lnbits/lnbits
+    restart: on-failure
+    user: "0:0"
+    environment:
+      LNBITS_PORT: 5001
+      DEBUG: true
+      LNBITS_ADMIN_UI: false
+      LNBITS_BACKEND_WALLET_CLASS: "LndRestWallet"
+      LNBITS_DATA_FOLDER: "./data"
+      LND_REST_ENDPOINT: "https://lnd-3:8081/"
+      LND_REST_CERT: "./lnd/tls.cert"
+      LND_REST_MACAROON: "./lnd/data/chain/bitcoin/regtest/admin.macaroon"
+    ports:
+      - 5001:5001
+    volumes:
+      - lnbits-data:/app/data
+      - ./data/lnd-3:/app/lnd:uid=1000,gid=1000
+
+  boltz:
+    hostname: boltz
+    depends_on:
+      - lnd-2
+      - boltz-postgres
+    restart: always
+    image: boltz/boltz:v3.12.1
+    ports:
+      - 9000:9000
+    entrypoint: "sh -c 'sleep 30; /boltz-backend/bin/boltzd'"
+    volumes:
+      - ./data/lnd-2:/data/lnd/
+      - ./data/boltz/:/root/.boltz/
+      - elements-data:/root/.elements
+      - bitcoin-data:/root/.bitcoin
+
+  boltz-client:
+    hostname: boltz-client
+    depends_on:
+      - boltz
+    restart: always
+    image: boltz/boltz-client:latest
+    ports:
+      - 9002:9002
+      - 9003:9003
+    expose:
+      - 9002
+    healthcheck:
+      test: ['CMD', 'boltzcli', '--host', 'boltz-client', 'getinfo']
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 0s
+    volumes:
+      - elements-data:/root/.elements
+      - ./data/boltz-client:/root/.boltz
+
+  boltz-backend-nginx:
+    hostname: boltz-nginx
+    restart: always
+    image: nginx:latest
+    ports:
+      - 9001:9001
+    volumes:
+      - nginx-data:/etc/nginx/conf.d
+    healthcheck:
+      test: ['CMD-SHELL', 'curl http://localhost:9001/version']
+      timeout: 1s
+      retries: 10
+      interval: 1s
+      start_period: 0s
+
+  boltz-postgres:
+    hostname: boltz-postgres
+    restart: always
+    image: postgres:14-alpine
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready --dbname boltz --username boltz"]
+      interval: 5s
+      timeout: 30s
+      retries: 10
+      start_period: 5s
+    environment:
+      - POSTGRES_DB=boltz
+      - POSTGRES_USER=boltz
+      - POSTGRES_PASSWORD=boltz
+    expose:
+      - 5432
+
+  bitcoind:
+    hostname: bitcoind
+    image: boltz/bitcoin-core:25.0
+    command:
+      - -regtest
+      - -fallbackfee=0.00000253
+      - -zmqpubrawtx=tcp://0.0.0.0:29000
+      - -zmqpubrawblock=tcp://0.0.0.0:29001
+      - -zmqpubhashblock=tcp://0.0.0.0:29002
+      - -txindex
+      - -rpcallowip=0.0.0.0/0
+      - -rpcbind=0.0.0.0
+      - -addresstype=bech32
+      - -changetype=bech32
+      - -dbcache=2048
+      - -rpcworkqueue=256
+    volumes:
+      - bitcoin-data:/root/.bitcoin
+    expose:
+      - 29000
+      - 29001
+      - 29002
+      - 18443
+      - 18444
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "bitcoin-cli",
+          "--rpccookiefile=/root/.bitcoin/regtest/.cookie",
+          "-regtest",
+          "getblockchaininfo",
+        ]
+      timeout: 1s
+      retries: 1
+      interval: 1s
+      start_period: 0s
+
+  clightning-1:
+    hostname: clightning-1
+    depends_on:
+      - bitcoind
+    image: boltz/c-lightning:24.11
+    command:
+      - --large-channels
+      - --network=regtest
+      - --grpc-port=9736
+      - --bind-addr=0.0.0.0:9735
+      - --bitcoin-rpcconnect=bitcoind
+      - --bitcoin-rpcport=18443
+      - --clnrest-host=0.0.0.0
+      - --clnrest-port=3010
+    expose:
+      - 9735
+    ports:
+      - 9736:9736
+      - 3010:3010
+    volumes:
+      - ./data/clightning-1:/root/.lightning/
+      - bitcoin-data:/root/.bitcoin
+
+  clightning-2:
+    hostname: clightning-2
+    depends_on:
+      - bitcoind
+    image: boltz/c-lightning:22.11.1
+    command:
+      - --large-channels
+      - --network=regtest
+      - --grpc-port=9737
+      - --bind-addr=0.0.0.0:9735
+      - --bitcoin-rpcconnect=bitcoind
+      - --bitcoin-rpcport=18443
+    expose:
+      - 9735
+    ports:
+      - 9737:9737
+    volumes:
+      - ./data/clightning-2:/root/.lightning/
+      - bitcoin-data:/root/.bitcoin
+
+  clightning-2-rest:
+    hostname: clightning-2-rest
+    depends_on:
+      - clightning-2
+    image: saubyk/c-lightning-rest:0.10.7
+    entrypoint: "sh -c 'sleep 35 && /sbin/tini -g -- ./docker-entrypoint.sh'"
+    ports:
+      - 3001:3001
+    expose:
+      - 3001
+    volumes:
+      - ./data/clightning-2:/root/.lightning/:uid=1000,gid=1000
+      - ./data/clightning-2-rest:/usr/src/app/certs/
+      - bitcoin-data:/root/.bitcoin
+
+  clightning-3:
+    hostname: clightning-3
+    depends_on:
+      - bitcoind
+    image: boltz/c-lightning:24.11
+    command:
+      - --large-channels
+      - --network=regtest
+      - --grpc-port=9738
+      - --bind-addr=0.0.0.0:9735
+      - --bitcoin-rpcconnect=bitcoind
+      - --bitcoin-rpcport=18443
+    expose:
+      - 9735
+    ports:
+      - 9738:9738
+    volumes:
+      - ./data/clightning-3:/root/.lightning/
+      - bitcoin-data:/root/.bitcoin
+
+  lnd-1:
+    hostname: lnd-1
+    depends_on:
+      - bitcoind
+    image: boltz/lnd:0.18.4-beta
+    restart: on-failure
+    command:
+      - --listen=lnd-1:9735
+      - --rpclisten=lnd-1:10009
+      - --restlisten=lnd-1:8081
+      - --bitcoin.active
+      - --bitcoin.regtest
+      - --bitcoin.node=bitcoind
+      - --bitcoind.rpchost=bitcoind
+      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
+      - --bitcoind.zmqpubrawtx=bitcoind:29000
+      - --bitcoind.zmqpubrawblock=bitcoind:29001
+      - --noseedbackup
+      - --protocol.wumbo-channels
+    expose:
+      - 8081
+      - 9735
+      - 10009
+    volumes:
+      - ./data/lnd-1:/root/.lnd/
+      - bitcoin-data:/root/.bitcoin
+
+  lnd-2:
+    hostname: lnd-2
+    depends_on:
+      - bitcoind
+    image: boltz/lnd:0.19.3-beta
+    restart: on-failure
+    command:
+      - --listen=lnd-2:9735
+      - --rpclisten=lnd-2:10009
+      - --restlisten=lnd-2:8081
+      - --bitcoin.active
+      - --bitcoin.regtest
+      - --bitcoin.node=bitcoind
+      - --bitcoind.rpchost=bitcoind
+      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
+      - --bitcoind.zmqpubrawtx=bitcoind:29000
+      - --bitcoind.zmqpubrawblock=bitcoind:29001
+      - --noseedbackup
+      - --protocol.wumbo-channels
+    expose:
+      - 8081
+      - 9735
+      - 10009
+    volumes:
+      - ./data/lnd-2:/root/.lnd/
+      - bitcoin-data:/root/.bitcoin
+
+  lnd-3:
+    hostname: lnd-3
+    depends_on:
+      - bitcoind
+    image: boltz/lnd:0.18.4-beta
+    restart: on-failure
+    command:
+      - --listen=lnd-3:9735
+      - --rpclisten=lnd-3:10009
+      - --restlisten=lnd-3:8081
+      - --bitcoin.active
+      - --bitcoin.regtest
+      - --bitcoin.node=bitcoind
+      - --bitcoind.rpchost=bitcoind
+      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
+      - --bitcoind.zmqpubrawtx=bitcoind:29000
+      - --bitcoind.zmqpubrawblock=bitcoind:29001
+      - --noseedbackup
+      - --protocol.wumbo-channels
+    ports:
+      - 8081:8081
+      - 10009:10009
+    expose:
+      - 8081
+      - 9735
+      - 10009
+    volumes:
+      - ./data/lnd-3:/root/.lnd/
+      - bitcoin-data:/root/.bitcoin
+
+  lnd-4:
+    hostname: lnd-4
+    depends_on:
+      - bitcoind
+    image: boltz/lnd:0.18.4-beta
+    restart: on-failure
+    command:
+      - --listen=lnd-4:9735
+      - --rpclisten=lnd-4:10009
+      - --restlisten=lnd-4:8081
+      - --bitcoin.active
+      - --bitcoin.regtest
+      - --bitcoin.node=bitcoind
+      - --bitcoind.rpchost=bitcoind
+      - --bitcoind.rpccookie=/root/.bitcoin/regtest/.cookie
+      - --bitcoind.zmqpubrawtx=bitcoind:29000
+      - --bitcoind.zmqpubrawblock=bitcoind:29001
+      - --noseedbackup
+      - --protocol.wumbo-channels
+    expose:
+      - 8081
+      - 9735
+      - 10009
+    volumes:
+      - ./data/lnd-4:/root/.lnd/
+      - bitcoin-data:/root/.bitcoin
+
+  eclair:
+    hostname: eclair
+    depends_on:
+      - bitcoind
+    image: boltz/eclair:0.8.0
+    restart: on-failure
+    entrypoint: "sh -c 'JAVA_OPTS=-Xmx512m /eclair-node/bin/eclair-node.sh -Declair.datadir=/root/eclair -Declair.printToConsole'"
+    ports:
+      - 8082:8080
+    expose:
+      - 9735
+      - 8080
+    volumes:
+      - ./data/eclair:/root/eclair
+      - bitcoin-data:/root/.bitcoin
+
+  electrs:
+    hostname: electrs
+    restart: always
+    image: boltz/electrs:latest
+    entrypoint: ["electrs-bitcoin"]
+    command:
+      - --electrum-rpc-addr
+      - electrs:19001
+      - --http-addr
+      - electrs:3002
+      - --daemon-rpc-addr
+      - bitcoind:18443
+      - --network
+      - regtest
+      - --jsonrpc-import
+    healthcheck:
+      test: ["CMD-SHELL", "curl -s $(hostname):3002/blocks/tip/height"]
+      timeout: 1s
+      retries: 20
+      interval: 2s
+      start_period: 5s
+    ports:
+      - 19001:19001
+      - 3002:3002
+    volumes:
+      - bitcoin-data:/root/.bitcoin
+
+  elementsd:
+    hostname: elementsd
+    restart: always
+    image: boltz/elements:latest
+    expose:
+      - 31001
+    ports:
+      - 31000:31000
+      - 31002:31002
+      - 18884:18884
+    command:
+    - -chain=liquidregtest
+    - -txindex=1
+    - -rest=1
+    - -server=1
+    - -rpcallowip=0.0.0.0/0
+    - -validatepegin=0
+    - -initialfreecoins=2100000000000000
+    - -fallbackfee=0.000001
+    - -rpcbind=0.0.0.0
+    - -rpcport=18884
+    - -zmqpubrawtx=tcp://0.0.0.0:31000
+    - -zmqpubrawblock=tcp://0.0.0.0:31001
+    - -zmqpubhashblock=tcp://0.0.0.0:31002
+    - -acceptdiscountct=1
+    - -creatediscountct=1
+    volumes:
+      - elements-data:/root/.elements
+
+  electrs-liquid:
+    hostname: electrs-liquid
+    restart: always
+    image: boltz/electrs:latest
+    entrypoint: ["electrs-liquid"]
+    command:
+      - --electrum-rpc-addr
+      - electrs-liquid:19002
+      - --http-addr
+      - electrs-liquid:3003
+      - --daemon-rpc-addr
+      - elementsd:18884
+      - --daemon-dir
+      - /root/.elements
+      - --network
+      - liquidregtest
+      - --parent-network
+      - regtest
+      - --jsonrpc-import
+    healthcheck:
+      test: ["CMD-SHELL", "curl -s $(hostname):3003/blocks/tip/height"]
+      timeout: 15s
+      retries: 20
+      interval: 2s
+      start_period: 5s
+    ports:
+      - 19002:19002
+      - 3003:3003
+    volumes:
+      - elements-data:/root/.elements
+
+volumes:
+  lnbits-data:
+  bitcoin-data:
+  elements-data:
+  nginx-data:
+    name: nginx-data
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ./data/boltz-nginx/

docker/regtest/docker-scripts.sh

@@ -0,0 +1,322 @@
+#!/bin/sh
+export COMPOSE_PROJECT_NAME=lnbits
+
+boltzcli-sim() {
+  docker exec -it lnbits-boltz-client-1 boltzcli "$@"
+}
+
+bitcoin-cli-sim() {
+  docker exec lnbits-bitcoind-1 bitcoin-cli -regtest "$@"
+}
+
+elements-cli-sim() {
+  docker exec lnbits-elementsd-1 elements-cli -rpcport=18884 -chain=liquidregtest "$@"
+}
+
+# args(i, cmd)
+lightning-cli-sim() {
+  i=$1
+  shift # shift first argument so we can use $@
+  docker exec lnbits-clightning-$i-1 lightning-cli --network regtest "$@"
+}
+
+# args(i, cmd)
+lncli-sim() {
+  i=$1
+  shift # shift first argument so we can use $@
+  docker exec lnbits-lnd-$i-1 lncli --network regtest --rpcserver=lnd-$i:10009 "$@"
+}
+
+get-eclair-pubkey() {
+  while true; do
+    pubkey=$(docker exec lnbits-eclair-1 curl http://localhost:8080/getinfo -X POST -s -u :lnbits | jq -r .nodeId 2> /dev/null)
+    pubkeyPrefix=$(echo $pubkey | cut -c1,2)
+    if [[ "$pubkeyPrefix" == "02" || "$pubkeyPrefix" == "03" ]]; then
+      echo $pubkey
+      break
+    fi
+    sleep 1
+  done
+}
+
+wait-for-eclair-channel() {
+  while true; do
+    state=$(docker exec lnbits-eclair-1 curl http://localhost:8080/channels -X POST -s -u :lnbits | jq -r ".[0].state")
+    pending=$(docker exec lnbits-eclair-1 curl -s http://localhost:8080/channels -X POST -u :lnbits| jq '. | length')
+    echo "eclair-1 pendingchannels: $pending, current state: $state"
+    if [[ "$state" == "NORMAL" ]]; then
+      break
+    fi
+    sleep 1
+  done
+}
+
+# args(i)
+fund_boltz_client() {
+  # first address of seed: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
+  address="el1qq2xvpcvfup5j8zscjq05u2wxxjcyewk7979f3mmz5l7uw5pqmx6xf5xy50hsn6vhkm5euwt72x878eq6zxx2z0z676mna6kdq"
+  echo "funding: $address on boltz-client"
+  elements-cli-sim -named sendtoaddress address=$address amount=30 fee_rate=100 > /dev/null
+}
+
+
+# args(i)
+fund_clightning_node() {
+  address=$(lightning-cli-sim $1 newaddr | jq -r .bech32)
+  echo "funding: $address on clightning-node: $1"
+  bitcoin-cli-sim -named sendtoaddress address=$address amount=30 fee_rate=100 > /dev/null
+}
+
+# args(i)
+fund_lnd_node() {
+  address=$(lncli-sim $1 newaddress p2wkh | jq -r .address)
+  echo "funding: $address on lnd-node: $1"
+  bitcoin-cli-sim -named sendtoaddress address=$address amount=30 fee_rate=100 > /dev/null
+}
+
+# args(i, j)
+connect_clightning_node() {
+  pubkey=$(lightning-cli-sim $2 getinfo | jq -r '.id')
+  lightning-cli-sim $1 connect $pubkey@lnbits-clightning-$2-1:9735 | jq -r '.id'
+}
+
+lnbits-regtest-start(){
+  if ! command -v jq &> /dev/null
+  then
+      echo "jq is not installed"
+      exit
+  fi
+  if ! command -v docker &> /dev/null
+  then
+      echo "docker is not installed"
+      exit
+  fi
+  if ! command -v docker version &> /dev/null
+  then
+      echo "dockerd is not running"
+      exit
+  fi
+  lnbits-regtest-stop
+  docker compose up -d --remove-orphans
+  lnbits-regtest-init
+}
+
+lnbits-regtest-start-log(){
+  lnbits-regtest-stop
+  docker compose up --remove-orphans
+  lnbits-regtest-init
+}
+
+lnbits-regtest-stop(){
+  docker compose down --volumes
+  # clean up lightning node data
+  sudo rm -rf ./data/clightning-1 ./data/clightning-2 ./data/clightning-3 ./data/lnd-1  ./data/lnd-2 ./data/lnd-3 ./data/lnd-4 ./data/boltz/boltz.db ./data/eclair/regtest ./data/boltz-client/liquid-wallet ./data/boltz-client/bitcoin-wallet ./data/boltz-client/wallet ./data/boltz-client/boltz.db
+  # recreate lightning node data folders preventing permission errors
+  mkdir ./data/clightning-1 ./data/clightning-2 ./data/clightning-3 ./data/lnd-1 ./data/lnd-2 ./data/lnd-3 ./data/lnd-4
+}
+
+lnbits-regtest-restart(){
+  lnbits-regtest-stop
+  lnbits-regtest-start
+}
+
+boltz-client-init(){
+  for i in 0 1 2; do
+    fund_boltz_client
+  done
+  elements-cli-sim -generate 3 > /dev/null
+}
+
+lnbits-bitcoin-init(){
+  echo "init_bitcoin_wallet..."
+  bitcoin-cli-sim createwallet lnbits || bitcoin-cli-sim loadwallet lnbits
+  echo "mining 150 blocks..."
+  bitcoin-cli-sim -generate 150 > /dev/null
+}
+
+lnbits-elements-init(){
+  echo "init_elements_wallet..."
+  elements-cli-sim createwallet lnbits || elements-cli-sim loadwallet lnbits
+  echo "mining 150 blocks..."
+  elements-cli-sim -generate 150 > /dev/null
+  elements-cli-sim rescanblockchain
+}
+
+lnbits-init(){
+  echo "init_lnbits..."
+  docker exec lnbits-lnbits-1 uv run python tools/create_fake_admin.py
+}
+
+lnbits-regtest-init(){
+  lnbits-bitcoin-init
+  lnbits-elements-init
+  lnbits-lightning-sync
+  lnbits-lightning-init
+  boltz-client-init
+  lnbits-init
+}
+
+lnbits-lightning-sync(){
+  wait-for-clightning-sync 1
+  wait-for-clightning-sync 2
+  wait-for-clightning-sync 3
+  wait-for-lnd-sync 1
+  wait-for-lnd-sync 2
+  wait-for-lnd-sync 3
+  wait-for-lnd-sync 4
+}
+
+lnbits-lightning-init(){
+
+  # create 10 UTXOs for each node
+  for i in 0 1 2; do
+    fund_clightning_node 1
+    fund_clightning_node 2
+    fund_clightning_node 3
+    fund_lnd_node 1
+    fund_lnd_node 2
+    fund_lnd_node 3
+    fund_lnd_node 4
+  done
+
+  echo "mining 3 blocks..."
+  bitcoin-cli-sim -generate 3 > /dev/null
+
+  lnbits-lightning-sync
+
+  channel_confirms=6
+  channel_size=24000000 # 0.024 btc
+  balance_size=12000000 # 0.12 btc
+  balance_size_msat=12000000000 # 0.12 btc
+
+  # lnd-1 -> lnd-2
+  lncli-sim 1 connect $(lncli-sim 2 getinfo | jq -r '.identity_pubkey')@lnbits-lnd-2-1 > /dev/null
+  echo "open channel from lnd-1 to lnd-2"
+  lncli-sim 1 openchannel $(lncli-sim 2 getinfo | jq -r '.identity_pubkey') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 1
+
+  # lnd-1 -> lnd-3
+  lncli-sim 1 connect $(lncli-sim 3 getinfo | jq -r '.identity_pubkey')@lnbits-lnd-3-1 > /dev/null
+  echo "open channel from lnd-1 to lnd-3"
+  lncli-sim 1 openchannel $(lncli-sim 3 getinfo | jq -r '.identity_pubkey') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 1
+
+  # lnd-1 -> cln-1
+  lncli-sim 1 connect $(lightning-cli-sim 1 getinfo | jq -r '.id')@lnbits-clightning-1-1 > /dev/null
+  echo "open channel from lnd-1 to cln-1"
+  lncli-sim 1 openchannel $(lightning-cli-sim 1 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 1
+
+  # lnd-1 -> cln-2
+  lncli-sim 1 connect $(lightning-cli-sim 2 getinfo | jq -r '.id')@lnbits-clightning-2-1 > /dev/null
+  echo "open channel from lnd-1 to cln-2"
+  lncli-sim 1 openchannel $(lightning-cli-sim 2 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 1
+
+  # lnd-1 -> cln-3
+  lncli-sim 1 connect $(lightning-cli-sim 3 getinfo | jq -r '.id')@lnbits-clightning-3-1 > /dev/null
+  echo "open channel from lnd-1 to cln-3"
+  lncli-sim 1 openchannel $(lightning-cli-sim 3 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 1
+
+  # lnd-2 -> cln-2
+  lncli-sim 2 connect $(lightning-cli-sim 2 getinfo | jq -r '.id')@lnbits-clightning-2-1 > /dev/null
+  echo "open channel from lnd-2 to cln-2"
+  lncli-sim 2 openchannel $(lightning-cli-sim 2 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 2
+
+  # lnd-3 -> cln-3
+  lncli-sim 3 connect $(lightning-cli-sim 3 getinfo | jq -r '.id')@lnbits-clightning-3-1 > /dev/null
+  echo "open channel from lnd-3 to cln-1"
+  lncli-sim 3 openchannel $(lightning-cli-sim 3 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 3
+
+  # lnd-3 -> cln-1
+  lncli-sim 3 connect $(lightning-cli-sim 1 getinfo | jq -r '.id')@lnbits-clightning-1-1 > /dev/null
+  echo "open channel from lnd-3 to cln-1"
+  lncli-sim 3 openchannel $(lightning-cli-sim 1 getinfo | jq -r '.id') $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 3
+
+  # lnd-1 -> eclair-1
+  lncli-sim 1 connect $(get-eclair-pubkey)@lnbits-eclair-1 > /dev/null
+  echo "open channel from lnd-2 to eclair-1"
+  lncli-sim 1 openchannel $(get-eclair-pubkey) $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 1
+
+  # lnd-2 -> eclair-1
+  lncli-sim 2 connect $(get-eclair-pubkey)@lnbits-eclair-1 > /dev/null
+  echo "open channel from lnd-2 to eclair-1"
+  lncli-sim 2 openchannel $(get-eclair-pubkey) $channel_size $balance_size > /dev/null
+  bitcoin-cli-sim -generate $channel_confirms > /dev/null
+  wait-for-lnd-channel 2
+
+  wait-for-clightning-channel 1
+  wait-for-clightning-channel 2
+  wait-for-clightning-channel 3
+
+  wait-for-eclair-channel
+
+  lnbits-lightning-sync
+
+}
+
+wait-for-lnd-channel(){
+  while true; do
+    pending=$(lncli-sim $1 pendingchannels | jq -r '.pending_open_channels | length')
+    echo "lnd-$1 pendingchannels: $pending"
+    if [[ "$pending" == "0" ]]; then
+      break
+    fi
+    sleep 1
+  done
+}
+
+wait-for-lnd-sync(){
+  while true; do
+    if [[ "$(lncli-sim $1 getinfo 2>&1 | jq -r '.synced_to_chain' 2> /dev/null)" == "true" ]]; then
+      echo "lnd-$1 is synced!"
+      break
+    fi
+    echo "waiting for lnd-$1 to sync..."
+    sleep 1
+  done
+}
+
+wait-for-clightning-channel(){
+  while true; do
+    pending=$(lightning-cli-sim $1 getinfo | jq -r '.num_pending_channels | length')
+    echo "cln-$1 pendingchannels: $pending"
+    if [[ "$pending" == "0" ]]; then
+      if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_bitcoind_sync' 2> /dev/null)" == "null" ]]; then
+        if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_lightningd_sync' 2> /dev/null)" == "null" ]]; then
+          break
+        fi
+      fi
+    fi
+    sleep 1
+  done
+}
+
+wait-for-clightning-sync(){
+  while true; do
+    if [[ ! "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.id' 2> /dev/null)" == "null" ]]; then
+      if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_bitcoind_sync' 2> /dev/null)" == "null" ]]; then
+        if [[ "$(lightning-cli-sim $1 getinfo 2>&1 | jq -r '.warning_lightningd_sync' 2> /dev/null)" == "null" ]]; then
+          echo "cln-$1 is synced!"
+          break
+        fi
+      fi
+    fi
+    echo "waiting for cln-$1 to sync..."
+    sleep 1
+  done
+}

docker/regtest/start-regtest

@@ -0,0 +1,74 @@
+#!/bin/bash
+print_success() {
+  printf "\033[;1;32mPASSED\033[;0m $1\n"
+}
+
+print_error() {
+  printf "\033[;1;31mFAILED\033[;0m $1\n"
+}
+
+run(){
+  label=$1
+  value=$2
+  cmd=$3
+  if [[ "$cmd" == "$value" ]]; then
+    print_success "$label is $cmd"
+  else
+    print_error "$label is $cmd, should be $value"
+    failed="true"
+  fi
+}
+
+failed="false"
+blockheight=213
+utxos=3
+channel_size=24000000 # 0.024 btc
+balance_size=12000000 # 0.012 btc
+
+source $(pwd)/docker-scripts.sh
+lnbits-regtest-start
+echo "=================================="
+printf "\033[;1;36mregtest started! starting tests...\033[;0m\n"
+echo "=================================="
+echo ""
+
+for i in 1 2 3; do
+  run "lnd-$i .synced_to_chain" "true" $(lncli-sim $i getinfo | jq -r ".synced_to_chain")
+  run "lnd-$i utxo count" $utxos $(lncli-sim $i listunspent | jq -r ".utxos | length")
+  run "lnd-$i .block_height" $blockheight $(lncli-sim $i getinfo | jq -r ".block_height")
+  if [[ "$i" == "1" ]]; then
+    channel_count=6
+  else
+    channel_count=3
+  fi
+  run "lnd-$i openchannels" $channel_count $(lncli-sim $i listchannels | jq -r ".channels | length")
+  run "lnd-$i .channels[0].capacity" $channel_size $(lncli-sim $i listchannels | jq -r ".channels[0].capacity")
+  run "lnd-$i .channels[0].push_amount_sat" $balance_size $(lncli-sim $i listchannels | jq -r ".channels[0].push_amount_sat")
+done
+for i in 1 2 3; do
+  # run "cln-$i blockheight" $blockheight $(lightning-cli-sim $i getinfo | jq -r ".blockheight")
+  run "cln-$i utxo count" $utxos $(lightning-cli-sim $i listfunds | jq -r ".outputs | length")
+  run "cln-$i openchannels" 2 $(lightning-cli-sim $i getinfo | jq -r ".num_active_channels")
+  run "cln-$i channel[0].state" "CHANNELD_NORMAL" $(lightning-cli-sim $i listfunds | jq -r ".channels[0].state")
+  run "cln-$i channel[0].amount_msat" $(($channel_size * 1000)) $(lightning-cli-sim $i listfunds | jq -r ".channels[0].amount_msat" | sed 's/msat//g')
+  run "cln-$i channel[0].our_amount_msat" $(($balance_size * 1000)) $(lightning-cli-sim $i listfunds | jq -r ".channels[0].our_amount_msat" | sed 's/msat//g')
+done
+
+run "eclair-1 openchannels" 2 $(docker exec lnbits-eclair-1 curl -s http://localhost:8080/channels -X POST -u :lnbits| jq '. | length')
+run "eclair-1 blockHeight" $blockheight $(docker exec lnbits-eclair-1 curl -s http://localhost:8080/getinfo -X POST -u :lnbits| jq '.blockHeight')
+run "lnbits service status" "200" $(curl -s -o /dev/null -w "%{http_code}" "http://localhost:5001/")
+run "boltz service status" "200" $(curl -s -o /dev/null --head -w "%{http_code}" "http://localhost:9001/version")
+
+# return non-zero exit code if a test fails
+if [[ "$failed" == "true" ]]; then
+  echo ""
+  echo "=================================="
+  print_error "one more more tests failed"
+  echo "=================================="
+  exit 1
+else
+  echo ""
+  echo "=================================="
+  print_success "all tests passed! yay!"
+  echo "=================================="
+fi

docker/sparkl2/Dockerfile

@@ -0,0 +1,41 @@
+ARG LNBITS_TAG=latest
+
+FROM lnbits/lnbits:${LNBITS_TAG}
+
+RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
+
+RUN apt-get update && apt-get -y upgrade
+RUN apt-get install -y ca-certificates curl gnupg netcat-openbsd git nodejs
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
+ENV PATH="/root/.local/bin:$PATH"
+
+# install sparksidecar
+RUN git clone https://github.com/lnbits/spark_sidecar
+RUN cd spark_sidecar && npm ci
+
+# Reinstall dependencies for lnbits just in case (needed for CMD usage)
+RUN uv sync --all-extras
+
+# LNBITS
+ENV LNBITS_PORT="5000"
+ENV LNBITS_HOST="0.0.0.0"
+ENV LNBITS_BACKEND_WALLET_CLASS="SparkL2Wallet"
+ENV LNBITS_RESERVE_FEE_MIN="20000"
+ENV LNBITS_RESERVE_FEE_PERCENT="1"
+ENV LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS="20"
+ENV FUNDING_SOURCE_MAX_RETRIES="10"
+
+# spark sidecar
+ENV SPARK_NETWORK="MAINNET"
+ENV SPARK_SIDECAR_PORT="8765"
+ENV SPARK_PAY_WAIT_MS="20000"
+ENV SPARK_MULTIPLICITY="3"
+
+EXPOSE 5000
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Entrypoint to start sparksidebar and LNbits
+CMD ["/entrypoint.sh"]

docker/sparkl2/entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -e
+
+node spark_sidecar/server.mjs &
+
+SIDECAR_PID=$!
+
+# Wait for startup
+for i in {1..10}; do
+  if nc -z localhost $SPARK_SIDECAR_PORT; then
+    echo "sparksidebar is up!"
+    break
+  fi
+  echo "Waiting for sparksidebar to start..."
+  sleep 1
+done
+
+# Optional: check if still not up
+if ! nc -z localhost $SPARK_SIDECAR_PORT; then
+  echo "sparksidebar did not start successfully."
+  exit 1
+fi
+
+echo "Starting LNbits on $LNBITS_HOST:$LNBITS_PORT..."
+exec uv run lnbits --port "$LNBITS_PORT" --host "$LNBITS_HOST" --forwarded-allow-ips='*'

docs/guide/funding-sources-table.md

@@ -50,6 +50,7 @@ Below is a side-by-side comparison of Lightning funding sources you can use with
 | **Blink**                      | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; focuses on mobile integrations.                                       |
 | **ZBD**                        | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Gaming-focused payment platform.                                                           |
 | **Spark (CLN)**                | Self-custodial           | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | Web interface for CLN; requires Spark server setup.                                        |
+| **Spark (L2)**                 | Self-custodial           | ❌                  | Medium                         | ❌                        | High              | Automatic                | Easy              | Low                    | Minimal fees                                 | Medium          | Runs via Spark sidecar; seed-based self-custody.                                           |
 | **Cliche Wallet**              | Self-custodial           | ❌                  | Medium                         | ❌                        | Medium            | Manual                   | Moderate          | Moderate               | Minimal fees                                 | Medium          | Lightweight wallet; suitable for embedded systems.                                         |
 | **Strike**                     | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                                            |
 | **LNPay**                      | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                                            |
@@ -57,7 +58,9 @@ Below is a side-by-side comparison of Lightning funding sources you can use with
 | **LN.tips**                    | Custodial/Self-Custodial | Depends on provider | Medium                         | ❌                        | Low               | Provider-managed         | Moderate          | Low                    | Transaction fees may apply                   | Medium          | Simple hosted service; use LN.tips API as your backend.                                    |
 | **Fake Wallet**                | Testing (simulated)      | ❌                  | Low                            | ❌                        | N/A               | N/A                      | Easy              | Low                    | None (test only)                             | N/A             | For testing only; mints accounting units in LNbits (no real sats, unit name configurable). |
 
----
+## Spark (L2)
+
+Spark L2 uses a local Node.js sidecar to expose an HTTP API that LNbits can use as a funding source. It is self-custodial and secured by a standard mnemonic seed. Sidecar repo `https://github.com/lnbits/spark_sidecar`.
 
 ### Notes for readers
 

docs/guide/oidc-authentication.md

@@ -0,0 +1,139 @@
+# Generic OIDC Authentication Configuration
+
+This document explains how to configure generic OIDC authentication for LNbits, which allows integration with various OIDC-compliant authentication providers such as Zitadel, Authentik, and others.
+
+## Overview
+
+The generic OIDC provider (`oidc`) complements the existing Keycloak provider and allows you to integrate any OIDC-compliant authentication service. You can customize the login button with your own organization name and icon.
+
+## Configuration
+
+Add the following environment variables to your `.env` file or system environment:
+
+### Required Settings
+
+```bash
+# Enable OIDC authentication
+LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
+
+# OIDC Discovery URL (well-known endpoint)
+LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
+
+# Client credentials from your OIDC provider
+LNBITS_OIDC_CLIENT_ID=your-client-id
+LNBITS_OIDC_CLIENT_SECRET=your-client-secret
+```
+
+### Optional Settings - Customize the Login Button
+
+You can customize how the OIDC login button appears to your users:
+
+```bash
+# Custom organization name (displayed on the login button)
+# Example: "Login via Zitadel" or "Login via Authentik"
+LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
+
+# Custom icon URL (displayed on the login button)
+# Can be a full URL or a path to a local image
+LNBITS_OIDC_CLIENT_CUSTOM_ICON=https://zitadel.com/favicon.svg
+```
+
+If not set, the button will display "Login via OIDC" with a generic lock icon.
+
+## Zitadel Configuration Example
+
+For Zitadel, configure as follows:
+
+1. Create a new application in Zitadel
+2. Choose "Web" application type
+3. Configure the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
+4. Save the Client ID and Client Secret
+5. Use these environment variables:
+
+```bash
+LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
+LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
+LNBITS_OIDC_CLIENT_ID=your-zitadel-client-id
+LNBITS_OIDC_CLIENT_SECRET=your-zitadel-client-secret
+# Customize the button to show "Login via Zitadel" with Zitadel's logo
+LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
+LNBITS_OIDC_CLIENT_CUSTOM_ICON="https://zitadel.com/favicon.svg"
+```
+
+**Result**: The login page will display a button with the text "Login via Zitadel" and the Zitadel logo.
+
+## Authentik Configuration Example
+
+For Authentik:
+
+1. Create a new OAuth2/OpenID Provider
+2. Set the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
+3. Configure scopes: `openid`, `email`, `profile`
+4. Get the Client ID and Client Secret
+
+```bash
+LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
+LNBITS_OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/your-app/.well-known/openid-configuration
+LNBITS_OIDC_CLIENT_ID=your-authentik-client-id
+LNBITS_OIDC_CLIENT_SECRET=your-authentik-client-secret
+LNBITS_OIDC_CLIENT_CUSTOM_ORG="Authentik"
+```
+
+## Multiple Auth Methods
+
+You can enable multiple authentication methods simultaneously:
+
+```bash
+LNBITS_AUTH_ALLOWED_METHODS=username-password,oidc-auth,keycloak-auth
+```
+
+## Discovery Endpoint Requirements
+
+Your OIDC provider must expose a standard discovery endpoint (`.well-known/openid-configuration`) that includes:
+
+- `authorization_endpoint`
+- `token_endpoint`
+- `userinfo_endpoint`
+- `jwks_uri` (JSON Web Key Set)
+
+The OIDC implementation will automatically fetch these endpoints from the discovery URL.
+
+## User Mapping
+
+The OIDC provider maps user information from the OIDC userinfo endpoint:
+
+- `sub` → User ID
+- `email` → Email address
+- `given_name` → First name
+- `family_name` → Last name
+- `name` or `preferred_username` → Display name
+- `picture` → Profile picture URL
+
+## Troubleshooting
+
+### Authentication fails
+
+1. Verify the discovery URL is accessible
+2. Check that Client ID and Client Secret are correct
+3. Ensure redirect URI in your OIDC provider matches: `https://your-lnbits-domain/api/v1/auth/oidc/token`
+4. Check LNbits logs for detailed error messages
+
+### User info not populated
+
+Some OIDC providers may use different claim names. If user information is not correctly populated, check your provider's userinfo endpoint response format and adjust the provider class if needed.
+
+## Security Considerations
+
+- Always use HTTPS in production
+- Keep client secrets secure and never commit them to version control
+- Use environment variables or secure configuration management
+- Regularly rotate client secrets
+- Review OIDC provider's security best practices
+
+## Implementation Details
+
+The OIDC provider is implemented in `lnbits/core/models/sso/oidc.py` and extends the `fastapi_sso` library's `SSOBase` class. It uses the standard OpenID Connect flow with:
+
+- Scopes: `openid`, `email`, `profile`
+- Response type: `code` (authorization code flow)
+- Discovery document for automatic endpoint resolution

docs/guide/wallets.md

@@ -41,7 +41,8 @@ A backend wallet is selected and configured entirely through LNbits environment
 | [CoreLightning](#corelightning)                 | [LND (gRPC)](#lnd-grpc)               | [Blink](#blink)                                   |
 | [CoreLightning REST](#corelightning-rest)       | [LNbits](#lnbits)                     | [Alby](#alby)                                     |
 | [Spark (Core Lightning)](#spark-core-lightning) | [LNPay](#lnpay)                       | [Boltz](#boltz)                                   |
-| [Cliche Wallet](#cliche-wallet)                 | [ZBD](#zbd)                           | [Phoenixd](#phoenixd)                             |
+| [Spark L2](#spark-l2)                           | [ZBD](#zbd)                           | [Phoenixd](#phoenixd)                             |
+| [Cliche Wallet](#cliche-wallet)                 |                                       |                                                   |
 | [Breez SDK](#breez-sdk)                         | [Breez Liquid SDK](#breez-liquid-sdk) | [Nostr Wallet Connect](#nostr-wallet-connect-nwc) |
 | [Strike](#strike)                               | [Eclair (ACINQ)](#eclair-acinq)       | [LN.tips](#lntips)                                |
 | [Fake Wallet](#fake-wallet)                     |                                       |                                                   |
@@ -52,7 +53,7 @@ A backend wallet is selected and configured entirely through LNbits environment
 
 ### CLNRest (using [runes](https://docs.corelightning.org/reference/lightning-createrune))
 
-[Core Lightning REST API docs](https://docs.corelightning.org/docs/rest)  
+[Core Lightning REST API docs](https://docs.corelightning.org/docs/rest)
 Should also work with the [Rust version of CLNRest](https://github.com/daywalker90/clnrest-rs)
 
 **Environment variables**
@@ -127,6 +128,33 @@ Old REST interface using [RTL c-lightning-REST](https://github.com/Ride-The-Ligh
 - `SPARK_URL`: `http://10.147.17.230:9737/rpc`
 - `SPARK_TOKEN`: `secret_access_key`
 
+## Spark L2
+
+Self-custodial funding source using the [Spark L2](https://docs.spark.money/start/overview) network. Requires a Node.js [sidecar](https://github.com/lnbits/spark_sidecar) that bridges lnbits talking to Spark. Works in addition with any Spark-compatible seed (Wallet of Satoshi, BuhoGO, BlitzWallet).
+If the sidecar is started with a `mnemonic` then that mnemonic will be used. Otherwhise if a mnemonic is set for the `Spark L2` LNbits funding source then that mnemonic will be used.
+
+### Optional tuning
+
+- `SPARK_L2_PAY_WAIT_MS`: `4000` _(payment timeout in ms)_
+- `SPARK_L2_PAY_POLL_MS`: `500` _(polling interval in ms)_
+- `SPARK_L2_STREAM_KEEPALIVE_MS`: `15000` _(SSE keepalive in ms)_
+
+### Example: run the sidecar
+
+```bash
+git clone https://github.com/lnbits/spark_sidecar.git
+cd spark_sidecar
+npm install
+
+SPARK_MNEMONIC="bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom" \
+SPARK_NETWORK=MAINNET \
+SPARK_SIDECAR_PORT=8765 \
+SPARK_PAY_WAIT_MS=20000 \
+node server.mjs
+```
+
+For testing, you can generate a 12-word mnemonic at https://iancoleman.io/bip39/. Store it securely — it controls your funds. Then select Spark (L2) as the funding source in LNbits.
+
 ## LND (REST)
 
 **Required env vars**

lnbits/app.py

@@ -66,7 +66,6 @@ from .middleware import (
     add_first_install_middleware,
     add_ip_block_middleware,
     add_ratelimit_middleware,
-    add_route_access_middleware,
 )
 from .tasks import internal_invoice_listener, invoice_listener, run_interval
 
@@ -193,7 +192,6 @@ def create_app() -> FastAPI:
 
     # adds security middleware
     add_ip_block_middleware(app)
-    add_route_access_middleware(app)
     add_ratelimit_middleware(app)
 
     register_exception_handlers(app)
@@ -470,7 +468,12 @@ def register_async_tasks() -> None:
     create_permanent_task(wait_for_audit_data)
     create_permanent_task(wait_notification_messages)
 
-    create_permanent_task(run_interval(30 * 60, check_pending_payments))
+    create_permanent_task(
+        run_interval(
+            settings.lnbits_funding_source_pending_interval_seconds,
+            check_pending_payments,
+        )
+    )
     create_permanent_task(invoice_listener)
     create_permanent_task(internal_invoice_listener)
     create_permanent_task(cache.invalidate_forever)

lnbits/core/crud/__init__.py

@@ -12,6 +12,7 @@ from .extensions import (
     drop_extension_db,
     get_installed_extension,
     get_installed_extensions,
+    get_installed_extensions_count,
     get_user_active_extensions_ids,
     get_user_extension,
     get_user_extensions,
@@ -58,6 +59,7 @@ from .users import (
     get_account_by_username,
     get_account_by_username_or_email,
     get_accounts,
+    get_accounts_count,
     get_user,
     get_user_access_control_lists,
     get_user_from_account,
@@ -117,11 +119,13 @@ __all__ = [
     "get_account_by_username",
     "get_account_by_username_or_email",
     "get_accounts",
+    "get_accounts_count",
     "get_admin_settings",
     "get_db_version",
     "get_db_versions",
     "get_installed_extension",
     "get_installed_extensions",
+    "get_installed_extensions_count",
     "get_latest_payments_by_extension",
     "get_payment",
     "get_payments",

lnbits/core/crud/extensions.py

@@ -90,6 +90,13 @@ async def get_installed_extensions(
     return all_extensions
 
 
+async def get_installed_extensions_count(conn: Connection | None = None) -> int:
+    row: dict | None = await (conn or db).fetchone(
+        "SELECT COUNT(*) as count FROM installed_extensions"
+    )
+    return int(row["count"]) if row else 0
+
+
 async def get_user_extension(
     user_id: str, extension: str, conn: Connection | None = None
 ) -> UserExtension | None:

lnbits/core/crud/payments.py

@@ -149,14 +149,12 @@ async def get_payments_paginated(  # noqa: C901
             f"(status = '{PaymentState.SUCCESS}' OR status = '{PaymentState.PENDING}')"
         )
     elif complete:
-        clause.append(
-            f"""
+        clause.append(f"""
             (
                 status = '{PaymentState.SUCCESS}'
                 OR (amount < 0 AND status = '{PaymentState.PENDING}')
             )
-            """
-        )
+            """)
     elif pending:
         clause.append(f"status = '{PaymentState.PENDING}'")
     elif failed:
@@ -346,14 +344,12 @@ async def get_payments_history(
         "wallet_id": wallet_id,
     }
     # count outgoing payments if they are still pending
-    where = [
-        f"""
+    where = [f"""
         wallet_id = :wallet_id AND (
             status = '{PaymentState.SUCCESS}'
             OR (amount < 0 AND status = '{PaymentState.PENDING}')
         )
-        """
-    ]
+        """]
     clause = filters.where(where)
     transactions: list[dict] = await db.fetchall(
         # This query is safe from SQL injection:

lnbits/core/crud/settings.py

@@ -105,7 +105,8 @@ async def get_settings_field(
     )
     if not row:
         return None
-    return SettingsField(id=row["id"], value=json.loads(row["value"]), tag=row["tag"])
+    value = json.loads(row["value"]) if row["value"] else None
+    return SettingsField(id=row["id"], value=value, tag=row["tag"])
 
 
 async def set_settings_field(id_: str, value: Any | None, tag: str | None = "core"):

lnbits/core/crud/users.py

@@ -4,10 +4,17 @@ from typing import Any
 from uuid import uuid4
 
 from lnbits.core.crud.extensions import get_user_active_extensions_ids
-from lnbits.core.crud.wallets import create_wallet, get_wallets
+from lnbits.core.crud.wallets import (
+    clear_wallet_cache,
+    create_wallet,
+    get_standalone_wallet,
+    get_wallets,
+)
 from lnbits.core.db import db
 from lnbits.core.models import UserAcls
 from lnbits.db import Connection, Filters, Page
+from lnbits.helpers import sha256s
+from lnbits.utils.cache import cache
 
 from ..models import (
     Account,
@@ -30,6 +37,13 @@ async def create_account(
     return account
 
 
+async def get_accounts_count(conn: Connection | None = None) -> int:
+    row: dict | None = await (conn or db).fetchone(
+        "SELECT COUNT(*) as count FROM accounts"
+    )
+    return int(row["count"]) if row else 0
+
+
 async def update_account(account: Account, conn: Connection | None = None) -> Account:
     account.updated_at = datetime.now(timezone.utc)
     await (conn or db).update("accounts", account)
@@ -41,6 +55,7 @@ async def delete_account(user_id: str, conn: Connection | None = None) -> None:
         "DELETE from accounts WHERE id = :user",
         {"user": user_id},
     )
+    await clear_user_id_cache(user_id)
 
 
 async def get_accounts(
@@ -49,17 +64,22 @@ async def get_accounts(
 ) -> Page[AccountOverview]:
     where_clauses = []
     values: dict[str, Any] = {}
+    filters = filters or Filters()
 
-    # Make wallet filter explicit
-    wallet_filter = (
-        next((f for f in filters.filters if f.field == "wallet_id"), None)
-        if filters
-        else None
-    )
-    if filters and wallet_filter and wallet_filter.values:
-        where_clauses.append("wallets.id = :wallet_id")
-        values = {**values, "wallet_id": next(iter(wallet_filter.values.values()))}
-        filters.filters = [f for f in filters.filters if f.field != "wallet_id"]
+    wallet_filter = filters.get_filter_by_field("wallet_id")
+
+    if wallet_filter and wallet_filter.values:
+        wallet_id_value = next(iter(wallet_filter.values.values()), None)
+        wallet = (
+            await get_standalone_wallet(wallet_id_value, deleted=None, conn=conn)
+            if wallet_id_value
+            else None
+        )
+        if not wallet:
+            return Page(data=[], total=0)
+        where_clauses.append("accounts.id = :account_id")
+        values = {**values, "account_id": wallet.user}
+        filters.remove_filter_by_field("wallet_id")
 
     return await (conn or db).fetch_page(
         """
@@ -69,6 +89,7 @@ async def get_accounts(
             accounts.email,
             accounts.pubkey,
             accounts.external_id,
+            accounts.activated,
             SUM(COALESCE((
                 SELECT balance FROM balances WHERE wallet_id = wallets.id
             ), 0)) as balance_msat,
@@ -93,12 +114,18 @@ async def get_accounts(
     )
 
 
-async def get_account(user_id: str, conn: Connection | None = None) -> Account | None:
+async def get_account(
+    user_id: str, active_only: bool = True, conn: Connection | None = None
+) -> Account | None:
     if len(user_id) == 0:
         return None
+
     return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE id = :id",
-        {"id": user_id},
+        """
+            SELECT * FROM accounts
+            WHERE id = :id AND (activated = true OR activated = :activated)
+        """,
+        {"id": user_id, "activated": active_only},
         Account,
     )
 
@@ -124,55 +151,79 @@ async def delete_accounts_no_wallets(
 
 
 async def get_account_by_username(
-    username: str, conn: Connection | None = None
+    username: str, active_only: bool = True, conn: Connection | None = None
 ) -> Account | None:
     if len(username) == 0:
         return None
+
     return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE LOWER(username) = :username",
-        {"username": username.lower()},
+        """
+            SELECT * FROM accounts
+            WHERE
+                LOWER(username) = :username
+                AND (activated = true OR activated = :activated)
+        """,
+        {"username": username.lower(), "activated": active_only},
         Account,
     )
 
 
 async def get_account_by_pubkey(
-    pubkey: str, conn: Connection | None = None
+    pubkey: str, active_only: bool = True, conn: Connection | None = None
 ) -> Account | None:
     return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE LOWER(pubkey) = :pubkey",
-        {"pubkey": pubkey.lower()},
+        """
+            SELECT * FROM accounts
+            WHERE
+                LOWER(pubkey) = :pubkey
+                AND (activated = true OR activated = :activated)
+        """,
+        {"pubkey": pubkey.lower(), "activated": active_only},
         Account,
     )
 
 
 async def get_account_by_email(
-    email: str, conn: Connection | None = None
+    email: str, active_only: bool = True, conn: Connection | None = None
 ) -> Account | None:
     if len(email) == 0:
         return None
+
     return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE LOWER(email) = :email",
-        {"email": email.lower()},
+        """
+            SELECT * FROM accounts
+            WHERE
+                LOWER(email) = :email
+                AND (activated = true OR activated = :activated)
+        """,
+        {"email": email.lower(), "activated": active_only},
         Account,
     )
 
 
 async def get_account_by_username_or_email(
-    username_or_email: str, conn: Connection | None = None
+    username_or_email: str,
+    active_only: bool = True,
+    conn: Connection | None = None,
 ) -> Account | None:
+
     return await (conn or db).fetchone(
         """
             SELECT * FROM accounts
-            WHERE LOWER(email) = :value or LOWER(username) = :value
+            WHERE
+                (LOWER(email) = :value or LOWER(username) = :value)
+                AND (activated = true OR activated = :activated)
         """,
-        {"value": username_or_email.lower()},
+        {"value": username_or_email.lower(), "activated": active_only},
         Account,
     )
 
 
-async def get_user(user_id: str, conn: Connection | None = None) -> User | None:
+async def get_user(
+    user_id: str, active_only: bool = True, conn: Connection | None = None
+) -> User | None:
     async with db.reuse_conn(conn) if conn else db.connect() as conn:
-        account = await get_account(user_id, conn=conn)
+        account = await get_account(user_id, active_only, conn=conn)
         if not account:
             return None
         return await get_user_from_account(account, conn=conn)
@@ -191,6 +242,7 @@ async def get_user_from_account(
 
     return User(
         id=account.id,
+        activated=account.activated,
         email=account.email,
         username=account.username,
         pubkey=account.pubkey,
@@ -216,12 +268,31 @@ async def update_user_access_control_list(
 
 
 async def get_user_access_control_lists(
-    user_id: str, conn: Connection | None = None
+    user_id: str, active_only: bool = True, conn: Connection | None = None
 ) -> UserAcls:
     user_acls = await (conn or db).fetchone(
-        "SELECT id, access_control_list FROM accounts WHERE id = :id",
-        {"id": user_id},
+        """
+            SELECT id, access_control_list FROM accounts
+            WHERE id = :user_id AND (activated = true OR activated = :activated)
+        """,
+        {"user_id": user_id, "activated": active_only},
         UserAcls,
     )
 
     return user_acls or UserAcls(id=user_id)
+
+
+async def clear_user_id_cache(user_id: str):
+    user = await get_user(user_id, active_only=True)
+    if user:
+        clear_user_cache(user)
+
+
+def clear_user_cache(user: User):
+    user_cache_key: str | None = cache.pop(
+        f"auth:user:cache_key:{sha256s(user.id)}", None
+    )
+    if user_cache_key:
+        cache.pop(user_cache_key)
+    for wallet in user.wallets:
+        clear_wallet_cache(wallet)

lnbits/core/crud/wallets.py

@@ -50,7 +50,7 @@ async def delete_wallet(
     deleted: bool = True,
     conn: Connection | None = None,
 ) -> None:
-    _clear_wallet_cache(wallet_id)
+    clear_wallet_id_cache(wallet_id)
     now = int(time())
 
     await (conn or db).execute(
@@ -65,7 +65,7 @@ async def delete_wallet(
 
 
 async def force_delete_wallet(wallet_id: str, conn: Connection | None = None) -> None:
-    _clear_wallet_cache(wallet_id)
+    clear_wallet_id_cache(wallet_id)
     await (conn or db).execute(
         "DELETE FROM wallets WHERE id = :wallet",
         {"wallet": wallet_id},
@@ -75,7 +75,7 @@ async def force_delete_wallet(wallet_id: str, conn: Connection | None = None) ->
 async def delete_wallet_by_id(
     wallet_id: str, conn: Connection | None = None
 ) -> int | None:
-    _clear_wallet_cache(wallet_id)
+    clear_wallet_id_cache(wallet_id)
     now = int(time())
     result = await (conn or db).execute(
         # Timestamp placeholder is safe from SQL injection (not user input)
@@ -226,11 +226,14 @@ async def get_wallet_for_key(
 ) -> Wallet | None:
     wallet = await (conn or db).fetchone(
         """
-        SELECT *, COALESCE((
+        SELECT wallets.*, COALESCE((
             SELECT balance FROM balances WHERE wallet_id = wallets.id
         ), 0)
         AS balance_msat FROM wallets
-        WHERE (adminkey = :key OR inkey = :key) AND deleted = false
+        INNER JOIN accounts ON wallets.user = accounts.id
+        WHERE (adminkey = :key OR inkey = :key)
+            AND deleted = false
+            AND accounts.activated = true
         """,
         {"key": key},
         Wallet,
@@ -250,8 +253,11 @@ async def get_base_wallet_for_key(
 ) -> BaseWallet | None:
     wallet = await (conn or db).fetchone(
         """
-        SELECT id, "user", wallet_type, adminkey, inkey FROM wallets
-        WHERE (adminkey = :key OR inkey = :key) AND deleted = false
+        SELECT wallets.id, "user", wallet_type, adminkey, inkey FROM wallets
+        INNER JOIN accounts ON wallets.user = accounts.id
+        WHERE (adminkey = :key OR inkey = :key)
+            AND deleted = false
+            AND accounts.activated = true
         """,
         {"key": key},
         BaseWallet,
@@ -294,8 +300,14 @@ async def get_total_balance(conn: Connection | None = None):
     return row.get("balance", 0) or 0
 
 
-def _clear_wallet_cache(wallet_id):
+def clear_wallet_id_cache(wallet_id: str):
     cached_wallet: BaseWallet | None = cache.pop(f"auth:wallet:{wallet_id}")
     if cached_wallet:
         cache.pop(f"auth:x-api-key:{cached_wallet.adminkey}")
         cache.pop(f"auth:x-api-key:{cached_wallet.inkey}")
+
+
+def clear_wallet_cache(wallet: Wallet):
+    cache.pop(f"auth:wallet:{wallet.id}")
+    cache.pop(f"auth:x-api-key:{wallet.adminkey}")
+    cache.pop(f"auth:x-api-key:{wallet.inkey}")

lnbits/core/migrations.py

@@ -10,31 +10,26 @@ from lnbits.db import Connection
 
 
 async def m000_create_migrations_table(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
     CREATE TABLE IF NOT EXISTS dbversions (
         db TEXT PRIMARY KEY,
         version INT NOT NULL
     )
-    """
-    )
+    """)
 
 
 async def m001_initial(db: Connection):
     """
     Initial LNbits tables.
     """
-    await db.execute(
-        """
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS accounts (
             id TEXT PRIMARY KEY,
             email TEXT,
             pass TEXT
         );
-    """
-    )
-    await db.execute(
-        """
+    """)
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS extensions (
             "user" TEXT NOT NULL,
             extension TEXT NOT NULL,
@@ -42,10 +37,8 @@ async def m001_initial(db: Connection):
 
             UNIQUE ("user", extension)
         );
-    """
-    )
-    await db.execute(
-        """
+    """)
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS wallets (
             id TEXT PRIMARY KEY,
             name TEXT NOT NULL,
@@ -53,10 +46,8 @@ async def m001_initial(db: Connection):
             adminkey TEXT NOT NULL,
             inkey TEXT
         );
-    """
-    )
-    await db.execute(
-        f"""
+    """)
+    await db.execute(f"""
         CREATE TABLE IF NOT EXISTS apipayments (
             payhash TEXT NOT NULL,
             amount {db.big_int} NOT NULL,
@@ -67,11 +58,9 @@ async def m001_initial(db: Connection):
             time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
             UNIQUE (wallet, payhash)
         );
-    """
-    )
+    """)
 
-    await db.execute(
-        """
+    await db.execute("""
         CREATE VIEW balances AS
         SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
             SELECT wallet, SUM(amount) AS s  -- incoming
@@ -85,8 +74,7 @@ async def m001_initial(db: Connection):
             GROUP BY wallet
         )x
         GROUP BY wallet;
-    """
-    )
+    """)
 
 
 async def m002_add_fields_to_apipayments(db: Connection):
@@ -149,8 +137,7 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
     """
 
     await db.execute("DROP VIEW balances")
-    await db.execute(
-        """
+    await db.execute("""
         CREATE VIEW balances AS
         SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
             SELECT wallet, SUM(amount) AS s  -- incoming
@@ -164,8 +151,7 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
             GROUP BY wallet
         )x
         GROUP BY wallet;
-    """
-    )
+    """)
 
 
 async def m005_balance_check_balance_notify(db: Connection):
@@ -174,8 +160,7 @@ async def m005_balance_check_balance_notify(db: Connection):
     LNbits wallet and of balanceNotify URLs supplied by users to empty their wallets.
     """
 
-    await db.execute(
-        """
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS balance_check (
           wallet TEXT NOT NULL REFERENCES wallets (id),
           service TEXT NOT NULL,
@@ -183,19 +168,16 @@ async def m005_balance_check_balance_notify(db: Connection):
 
           UNIQUE(wallet, service)
         );
-    """
-    )
+    """)
 
-    await db.execute(
-        """
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS balance_notify (
           wallet TEXT NOT NULL REFERENCES wallets (id),
           url TEXT NOT NULL,
 
           UNIQUE(wallet, url)
         );
-    """
-    )
+    """)
 
 
 async def m006_add_invoice_expiry_to_apipayments(db: Connection):
@@ -262,19 +244,16 @@ async def m007_set_invoice_expiries(db: Connection):
 
 
 async def m008_create_admin_settings_table(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS settings (
             super_user TEXT,
             editable_settings TEXT NOT NULL DEFAULT '{}'
         );
-    """
-    )
+    """)
 
 
 async def m009_create_tinyurl_table(db: Connection):
-    await db.execute(
-        f"""
+    await db.execute(f"""
         CREATE TABLE IF NOT EXISTS tiny_url (
           id TEXT PRIMARY KEY,
           url TEXT,
@@ -282,13 +261,11 @@ async def m009_create_tinyurl_table(db: Connection):
           wallet TEXT,
           time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
         );
-    """
-    )
+    """)
 
 
 async def m010_create_installed_extensions_table(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS installed_extensions (
             id TEXT PRIMARY KEY,
             version TEXT NOT NULL,
@@ -299,8 +276,7 @@ async def m010_create_installed_extensions_table(db: Connection):
             active BOOLEAN DEFAULT false,
             meta TEXT NOT NULL DEFAULT '{}'
         );
-    """
-    )
+    """)
 
 
 async def m011_optimize_balances_view(db: Connection):
@@ -309,23 +285,19 @@ async def m011_optimize_balances_view(db: Connection):
     over the payments table instead of 2.
     """
     await db.execute("DROP VIEW balances")
-    await db.execute(
-        """
+    await db.execute("""
         CREATE VIEW balances AS
         SELECT wallet, SUM(amount - abs(fee)) AS balance
         FROM apipayments
         WHERE (pending = false AND amount > 0) OR amount < 0
         GROUP BY wallet
-    """
-    )
+    """)
 
 
 async def m012_add_currency_to_wallet(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         ALTER TABLE wallets ADD COLUMN currency TEXT
-        """
-    )
+        """)
 
 
 async def m013_add_deleted_to_wallets(db: Connection):
@@ -345,15 +317,13 @@ async def m014_set_deleted_wallets(db: Connection):
     Sets deleted column to wallets.
     """
     try:
-        result = await db.execute(
-            """
+        result = await db.execute("""
             SELECT *
             FROM wallets
             WHERE user LIKE 'del:%'
             AND adminkey LIKE 'del:%'
             AND inkey LIKE 'del:%'
-            """
-        )
+            """)
         rows = result.mappings().all()
 
         for row in rows:
@@ -386,8 +356,7 @@ async def m014_set_deleted_wallets(db: Connection):
 
 
 async def m015_create_push_notification_subscriptions_table(db: Connection):
-    await db.execute(
-        f"""
+    await db.execute(f"""
         CREATE TABLE IF NOT EXISTS webpush_subscriptions (
             endpoint TEXT NOT NULL,
             "user" TEXT NOT NULL,
@@ -396,8 +365,7 @@ async def m015_create_push_notification_subscriptions_table(db: Connection):
             timestamp TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
             PRIMARY KEY (endpoint, "user")
         );
-    """
-    )
+    """)
 
 
 async def m016_add_username_column_to_accounts(db: Connection):
@@ -484,8 +452,7 @@ async def m018_balances_view_exclude_deleted(db: Connection):
     Make deleted wallets not show up in the balances view.
     """
     await db.execute("DROP VIEW balances")
-    await db.execute(
-        """
+    await db.execute("""
         CREATE VIEW balances AS
         SELECT apipayments.wallet,
                SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -495,8 +462,7 @@ async def m018_balances_view_exclude_deleted(db: Connection):
               AND ((apipayments.pending = false AND apipayments.amount > 0)
               OR apipayments.amount < 0)
         GROUP BY wallet
-    """
-    )
+    """)
 
 
 async def m019_balances_view_based_on_wallets(db: Connection):
@@ -505,8 +471,7 @@ async def m019_balances_view_based_on_wallets(db: Connection):
     Important for querying whole lnbits balances.
     """
     await db.execute("DROP VIEW balances")
-    await db.execute(
-        """
+    await db.execute("""
         CREATE VIEW balances AS
         SELECT apipayments.wallet,
                SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -516,8 +481,7 @@ async def m019_balances_view_based_on_wallets(db: Connection):
               AND ((apipayments.pending = false AND apipayments.amount > 0)
               OR apipayments.amount < 0)
         GROUP BY apipayments.wallet
-    """
-    )
+    """)
 
 
 async def m020_add_column_column_to_user_extensions(db: Connection):
@@ -536,8 +500,7 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
     await db.execute("UPDATE apipayments SET status = 'success' WHERE NOT pending")
 
     await db.execute("DROP VIEW balances")
-    await db.execute(
-        """
+    await db.execute("""
         CREATE VIEW balances AS
         SELECT apipayments.wallet,
                SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -549,8 +512,7 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
             OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
         )
         GROUP BY apipayments.wallet
-    """
-    )
+    """)
 
 
 async def m022_add_pubkey_to_accounts(db: Connection):
@@ -581,8 +543,7 @@ async def m024_drop_pending(db: Connection):
 
 async def m025_refresh_view(db: Connection):
     await db.execute("DROP VIEW balances")
-    await db.execute(
-        """
+    await db.execute("""
         CREATE VIEW balances AS
         SELECT apipayments.wallet_id,
                SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -594,8 +555,7 @@ async def m025_refresh_view(db: Connection):
             OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
         )
         GROUP BY apipayments.wallet_id
-    """
-    )
+    """)
 
 
 async def m026_update_payment_table(db: Connection):
@@ -658,8 +618,7 @@ async def m027_update_apipayments_data(db: Connection):
 
 async def m028_update_settings(db: Connection):
 
-    await db.execute(
-        """
+    await db.execute("""
         CREATE TABLE IF NOT EXISTS system_settings (
             id TEXT PRIMARY KEY,
             value TEXT,
@@ -667,8 +626,7 @@ async def m028_update_settings(db: Connection):
 
             UNIQUE (id, tag)
         );
-    """
-    )
+    """)
 
     async def _insert_key_value(id_: str, value: Any):
         await db.execute(
@@ -691,8 +649,7 @@ async def m028_update_settings(db: Connection):
 
 
 async def m029_create_audit_table(db: Connection):
-    await db.execute(
-        f"""
+    await db.execute(f"""
         CREATE TABLE IF NOT EXISTS audit (
             component TEXT,
             ip_address TEXT,
@@ -706,16 +663,13 @@ async def m029_create_audit_table(db: Connection):
             delete_at TIMESTAMP,
             created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
         );
-        """
-    )
+        """)
 
 
 async def m030_add_user_api_tokens_column(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         ALTER TABLE accounts ADD COLUMN access_control_list TEXT
-        """
-    )
+        """)
 
 
 async def m031_add_color_and_icon_to_wallets(db: Connection):
@@ -738,32 +692,25 @@ async def m033_update_payment_table(db: Connection):
 
 
 async def m034_add_stored_paylinks_to_wallet(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         ALTER TABLE wallets ADD COLUMN stored_paylinks TEXT
-        """
-    )
+        """)
 
 
 async def m035_add_wallet_type_column(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         ALTER TABLE wallets ADD COLUMN wallet_type TEXT DEFAULT 'lightning'
-        """
-    )
+        """)
 
 
 async def m036_add_shared_wallet_column(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         ALTER TABLE wallets ADD COLUMN shared_wallet_id TEXT
-        """
-    )
+        """)
 
 
 async def m037_create_assets_table(db: Connection):
-    await db.execute(
-        f"""
+    await db.execute(f"""
         CREATE TABLE IF NOT EXISTS assets (
             id TEXT PRIMARY KEY,
             user_id TEXT NOT NULL,
@@ -776,16 +723,13 @@ async def m037_create_assets_table(db: Connection):
             data {db.blob} NOT NULL,
             created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
         );
-        """
-    )
+        """)
 
 
 async def m038_add_labels_for_payments(db: Connection):
-    await db.execute(
-        """
+    await db.execute("""
         ALTER TABLE apipayments ADD COLUMN labels TEXT
-        """
-    )
+        """)
 
 
 async def m039_index_payments(db: Connection):
@@ -804,11 +748,9 @@ async def m039_index_payments(db: Connection):
     ]
     for index in indexes:
         logger.debug(f"Creating index idx_payments_{index}...")
-        await db.execute(
-            f"""
+        await db.execute(f"""
             CREATE INDEX IF NOT EXISTS idx_payments_{index} ON apipayments ({index});
-            """
-        )
+            """)
 
 
 async def m040_index_wallets(db: Connection):
@@ -825,11 +767,9 @@ async def m040_index_wallets(db: Connection):
 
     for index in indexes:
         logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(
-            f"""
+        await db.execute(f"""
             CREATE INDEX IF NOT EXISTS idx_wallets_{index} ON wallets ("{index}");
-            """
-        )
+            """)
 
 
 async def m042_index_accounts(db: Connection):
@@ -843,11 +783,9 @@ async def m042_index_accounts(db: Connection):
 
     for index in indexes:
         logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(
-            f"""
+        await db.execute(f"""
             CREATE INDEX IF NOT EXISTS idx_accounts_{index} ON accounts ("{index}");
-            """
-        )
+            """)
 
 
 async def m043_add_ui_customization_to_accounts(db: Connection):
@@ -856,3 +794,11 @@ async def m043_add_ui_customization_to_accounts(db: Connection):
     Used for server side persistence of UI customization settings.
     """
     await db.execute("ALTER TABLE accounts ADD COLUMN ui_customization TEXT")
+
+
+async def m044_add_activated_to_accounts(db: Connection):
+    """
+    Adds activated column to accounts.
+    Used for account activation status.
+    """
+    await db.execute("ALTER TABLE accounts ADD COLUMN activated BOOLEAN DEFAULT true")

lnbits/core/models/extensions.py

@@ -43,6 +43,8 @@ class ExplicitRelease(BaseModel):
     details_link: str | None
     paid_features: str | None
     pay_link: str | None
+    admin_only: bool = False
+    super_user_only: bool = False
 
     def is_version_compatible(self):
         return is_lnbits_version_ok(self.min_lnbits_version, self.max_lnbits_version)
@@ -52,6 +54,8 @@ class GitHubRelease(BaseModel):
     id: str
     organisation: str
     repository: str
+    admin_only: bool = False
+    super_user_only: bool = False
 
 
 class Manifest(BaseModel):
@@ -83,6 +87,8 @@ class ExtensionConfig(BaseModel):
     warning: str | None = ""
     min_lnbits_version: str | None
     max_lnbits_version: str | None
+    admin_only: bool = False
+    super_user_only: bool = False
 
     def is_version_compatible(self) -> bool:
         return is_lnbits_version_ok(self.min_lnbits_version, self.max_lnbits_version)
@@ -195,6 +201,8 @@ class ExtensionRelease(BaseModel):
     cost_sats: int | None = None
     paid_sats: int | None = 0
     payment_hash: str | None = None
+    admin_only: bool = False
+    super_user_only: bool = False
 
     @property
     def archive_url(self) -> str:
@@ -263,6 +271,8 @@ class ExtensionRelease(BaseModel):
             paid_features=e.paid_features,
             repo=e.repo,
             icon=e.icon,
+            admin_only=e.admin_only,
+            super_user_only=e.super_user_only,
         )
 
     @classmethod
@@ -289,6 +299,8 @@ class ExtensionRelease(BaseModel):
                 release.min_lnbits_version = config.min_lnbits_version
                 release.max_lnbits_version = config.max_lnbits_version
                 release.is_version_compatible = config.is_version_compatible()
+                release.admin_only = config.admin_only
+                release.super_user_only = config.super_user_only
 
                 release.icon = icon_to_github_url(f"{org}/{repo}", config.tile)
 
@@ -336,6 +348,8 @@ class ExtensionMeta(BaseModel):
     paid_features: str | None = None
     has_paid_release: bool = False
     has_free_release: bool = False
+    admin_only: bool = False
+    super_user_only: bool = False
 
 
 class InstallableExtension(BaseModel):
@@ -399,6 +413,16 @@ class InstallableExtension(BaseModel):
             return False
         return self.meta.pay_to_enable.required is True
 
+    @property
+    def is_admin_only(self) -> bool:
+        return settings.is_admin_extension(self.id) or bool(
+            self.meta and self.meta.admin_only
+        )
+
+    @property
+    def is_super_user_only(self) -> bool:
+        return bool(self.meta and self.meta.super_user_only)
+
     async def download_archive(self):
         logger.info(f"Downloading extension {self.name} ({self.installed_version}).")
         ext_zip_file = self.zip_path
@@ -454,6 +478,16 @@ class InstallableExtension(BaseModel):
 
             self.name = config_json.get("name")
             self.short_description = config_json.get("short_description")
+            if self.meta:
+                self.meta.admin_only = config_json.get("admin_only", False)
+                self.meta.super_user_only = config_json.get("super_user_only", False)
+                if self.meta.installed_release:
+                    self.meta.installed_release.admin_only = config_json.get(
+                        "admin_only", False
+                    )
+                    self.meta.installed_release.super_user_only = config_json.get(
+                        "super_user_only", False
+                    )
 
             if (
                 self.meta
@@ -496,6 +530,10 @@ class InstallableExtension(BaseModel):
             return
         if not release.is_version_compatible:
             return
+        if not self.meta:
+            self.meta = ExtensionMeta()
+        self.meta.admin_only = release.admin_only
+        self.meta.super_user_only = release.super_user_only
         if not self.meta or not self.meta.latest_release:
             meta = self.meta or ExtensionMeta()
             meta.latest_release = release
@@ -558,6 +596,13 @@ class InstallableExtension(BaseModel):
                 github_release.organisation, github_release.repository
             )
             source_repo = f"{github_release.organisation}/{github_release.repository}"
+            admin_only = github_release.admin_only or config.admin_only
+            super_user_only = github_release.super_user_only or config.super_user_only
+            latest_extension_release = ExtensionRelease.from_github_release(
+                source_repo, latest_release
+            )
+            latest_extension_release.admin_only = admin_only
+            latest_extension_release.super_user_only = super_user_only
             return InstallableExtension(
                 id=github_release.id,
                 name=config.name,
@@ -569,9 +614,9 @@ class InstallableExtension(BaseModel):
                     config.tile,
                 ),
                 meta=ExtensionMeta(
-                    latest_release=ExtensionRelease.from_github_release(
-                        source_repo, latest_release
-                    ),
+                    admin_only=admin_only,
+                    super_user_only=super_user_only,
+                    latest_release=latest_extension_release,
                 ),
             )
         except Exception as e:
@@ -580,7 +625,12 @@ class InstallableExtension(BaseModel):
 
     @classmethod
     def from_explicit_release(cls, e: ExplicitRelease) -> InstallableExtension:
-        meta = ExtensionMeta(archive=e.archive, dependencies=e.dependencies)
+        meta = ExtensionMeta(
+            archive=e.archive,
+            dependencies=e.dependencies,
+            admin_only=e.admin_only,
+            super_user_only=e.super_user_only,
+        )
         return InstallableExtension(
             id=e.id,
             name=e.name,
@@ -610,6 +660,8 @@ class InstallableExtension(BaseModel):
                     short_description=config_json.get("short_description"),
                     icon=config_json.get("tile"),
                     meta=ExtensionMeta(
+                        admin_only=config_json.get("admin_only", False),
+                        super_user_only=config_json.get("super_user_only", False),
                         installed_release=ExtensionRelease(
                             name=ext_id,
                             version=version,
@@ -617,7 +669,9 @@ class InstallableExtension(BaseModel):
                             source_repo=f"{conf_path}",
                             min_lnbits_version=config_json.get("min_lnbits_version"),
                             max_lnbits_version=config_json.get("max_lnbits_version"),
-                        )
+                            admin_only=config_json.get("admin_only", False),
+                            super_user_only=config_json.get("super_user_only", False),
+                        ),
                     ),
                 )
 
@@ -719,6 +773,13 @@ class InstallableExtension(BaseModel):
                     repo_releases = await ExtensionRelease.get_github_releases(
                         r.organisation, r.repository
                     )
+                    for repo_release in repo_releases:
+                        repo_release.admin_only = (
+                            repo_release.admin_only or r.admin_only
+                        )
+                        repo_release.super_user_only = (
+                            repo_release.super_user_only or r.super_user_only
+                        )
                     extension_releases += repo_releases
 
                 for e in manifest.extensions:

lnbits/core/models/payments.py

@@ -6,23 +6,16 @@ from typing import Literal
 
 from fastapi import Query
 from lnurl import LnurlWithdrawResponse
+from loguru import logger
 from pydantic import BaseModel, Field, validator
 
 from lnbits.db import FilterModel
-from lnbits.fiat import get_fiat_provider
 from lnbits.fiat.base import (
-    FiatPaymentFailedStatus,
-    FiatPaymentPendingStatus,
     FiatPaymentStatus,
-    FiatPaymentSuccessStatus,
 )
 from lnbits.utils.exchange_rates import allowed_currencies
-from lnbits.wallets import get_funding_source
 from lnbits.wallets.base import (
-    PaymentFailedStatus,
-    PaymentPendingStatus,
     PaymentStatus,
-    PaymentSuccessStatus,
 )
 
 
@@ -130,59 +123,23 @@ class Payment(BaseModel):
             "fiat_"
         )
 
+    # DEPRECATED: in v1.5.0, use service check_payment_status instead
     async def check_status(
         self, skip_internal_payment_notifications: bool | None = False
     ) -> PaymentStatus:
-        if self.is_internal:
-            if self.success:
-                return PaymentSuccessStatus()
-            if self.failed:
-                return PaymentFailedStatus()
-            if self.is_in and self.fiat_provider:
-                fiat_status = await self.check_fiat_status(
-                    skip_internal_payment_notifications
-                )
-                return PaymentStatus(paid=fiat_status.paid)
-            return PaymentPendingStatus()
-        funding_source = get_funding_source()
-        if self.is_out:
-            status = await funding_source.get_payment_status(self.checking_id)
-        else:
-            status = await funding_source.get_invoice_status(self.checking_id)
-        return status
+        logger.warning("payment.check_status() is deprecated.")
+        from lnbits.core.services.payments import check_payment_status
 
+        return await check_payment_status(self, skip_internal_payment_notifications)
+
+    # DEPRECATED: in v1.5.0, use service check_payment_status instead
     async def check_fiat_status(
         self, skip_internal_payment_notifications: bool | None = False
     ) -> FiatPaymentStatus:
-        if not self.is_internal:
-            return FiatPaymentPendingStatus()
-        if self.success:
-            return FiatPaymentSuccessStatus()
-        if self.failed:
-            return FiatPaymentFailedStatus()
+        logger.warning("payment.check_fiat_status() is deprecated.")
+        from lnbits.core.services.fiat_providers import check_fiat_status
 
-        if not self.fiat_provider:
-            return FiatPaymentPendingStatus()
-
-        checking_id = self.extra.get("fiat_checking_id")
-        if not checking_id:
-            return FiatPaymentPendingStatus()
-
-        fiat_provider = await get_fiat_provider(self.fiat_provider)
-        if not fiat_provider:
-            return FiatPaymentPendingStatus()
-        fiat_status = await fiat_provider.get_invoice_status(checking_id)
-
-        if skip_internal_payment_notifications:
-            return fiat_status
-
-        if fiat_status.success:
-            # notify receivers asynchronously
-            from lnbits.tasks import internal_invoice_queue
-
-            await internal_invoice_queue.put(self.checking_id)
-
-        return fiat_status
+        return await check_fiat_status(self, skip_internal_payment_notifications)
 
 
 class PaymentFilters(FilterModel):

lnbits/core/models/sso/__init__.py

@@ -0,0 +1 @@
+"""SSO authentication providers for LNbits"""

lnbits/core/models/sso/oidc.py

@@ -0,0 +1,36 @@
+"""Generic OIDC SSO Login Helper"""
+
+from typing import Optional
+
+import httpx
+from fastapi_sso.sso.base import DiscoveryDocument, OpenID, SSOBase
+
+
+class OidcSSO(SSOBase):
+    """Class providing login via Generic OIDC OAuth (e.g., Zitadel, Authentik, etc.)"""
+
+    provider = "oidc"
+    scope = ["openid", "email", "profile"]
+    discovery_url = ""
+
+    async def openid_from_response(
+        self, response: dict, session: Optional["httpx.AsyncClient"] = None
+    ) -> OpenID:
+        """Return OpenID from user information provided by OIDC provider"""
+        return OpenID(
+            email=response.get("email", ""),
+            provider=self.provider,
+            id=response.get("sub"),
+            first_name=response.get("given_name"),
+            last_name=response.get("family_name"),
+            display_name=response.get("name") or response.get("preferred_username"),
+            picture=response.get("picture"),
+        )
+
+    async def get_discovery_document(self) -> DiscoveryDocument:
+        """Get document containing handy urls"""
+        async with httpx.AsyncClient() as session:
+            response = await session.get(self.discovery_url)
+            content = response.json()
+
+            return content

lnbits/core/models/tinyurl.py

@@ -1,4 +1,6 @@
-from pydantic import BaseModel
+from datetime import datetime, timezone
+
+from pydantic import BaseModel, Field
 
 
 class TinyURL(BaseModel):
@@ -6,4 +8,4 @@ class TinyURL(BaseModel):
     url: str
     endless: bool
     wallet: str
-    time: float
+    time: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

lnbits/core/models/users.py

@@ -181,6 +181,7 @@ class AccountId(BaseModel):
 
 
 class Account(AccountId):
+    activated: bool = True
     external_id: str | None = None  # for external account linking
     username: str | None = None
     password_hash: str | None = None
@@ -241,6 +242,7 @@ class Account(AccountId):
 
 
 class AccountOverview(Account):
+    activated: bool = True
     transaction_count: int | None = 0
     wallet_count: int | None = 0
     balance_msat: int | None = 0
@@ -276,6 +278,7 @@ class AccountFilters(FilterModel):
 
 class User(BaseModel):
     id: str
+    activated: bool = True
     created_at: datetime
     updated_at: datetime
     email: str | None = None
@@ -315,6 +318,7 @@ class RegisterUser(BaseModel):
     username: str = Query(default=..., min_length=2, max_length=20)
     password: str = Query(default=..., min_length=8, max_length=50)
     password_repeat: str = Query(default=..., min_length=8, max_length=50)
+    invitation_code: str | None = Query(default=None, max_length=256)
 
 
 class CreateUser(BaseModel):
@@ -358,6 +362,7 @@ class UpdateSuperuserPassword(BaseModel):
     username: str = Query(default=..., min_length=2, max_length=20)
     password: str = Query(default=..., min_length=8, max_length=50)
     password_repeat: str = Query(default=..., min_length=8, max_length=50)
+    first_install_token: str | None = Query(None)
 
 
 class LoginUsr(BaseModel):

lnbits/core/services/__init__.py

@@ -1,3 +1,4 @@
+from .fiat_providers import check_fiat_status
 from .funding_source import (
     get_balance_delta,
     switch_to_voidwallet,
@@ -7,6 +8,7 @@ from .notifications import enqueue_admin_notification, send_payment_notification
 from .payments import (
     calculate_fiat_amounts,
     cancel_hold_invoice,
+    check_payment_status,
     check_transaction_status,
     check_wallet_limits,
     create_fiat_invoice,
@@ -40,6 +42,8 @@ __all__ = [
     "calculate_fiat_amounts",
     "cancel_hold_invoice",
     "check_admin_settings",
+    "check_fiat_status",
+    "check_payment_status",
     "check_transaction_status",
     "check_wallet_limits",
     "check_webpush_settings",

lnbits/core/services/extensions.py

@@ -9,6 +9,7 @@ from lnbits.core.crud import (
     delete_installed_extension,
     get_db_version,
     get_installed_extension,
+    get_installed_extensions_count,
     update_installed_extension_state,
 )
 from lnbits.core.crud.extensions import (
@@ -38,6 +39,8 @@ async def install_extension(
     if installed_ext and installed_ext.meta:
         ext_info.meta.payments = installed_ext.meta.payments
 
+    await check_extensions_limit(installed_ext)
+
     if not skip_download:
         await ext_info.download_archive()
 
@@ -63,6 +66,15 @@ async def install_extension(
     return extension
 
 
+async def check_extensions_limit(installed_ext: InstallableExtension | None = None):
+    if settings.lnbits_max_extensions == 0 or installed_ext:
+        return
+
+    extensions_count = await get_installed_extensions_count()
+    if extensions_count >= settings.lnbits_max_extensions:
+        raise ValueError("Max amount of extensions have been installed")
+
+
 async def uninstall_extension(ext_id: str):
     await stop_extension_background_work(ext_id)
 

lnbits/core/services/fiat_providers.py

@@ -12,6 +12,12 @@ from lnbits.core.models import CreatePayment, Payment, PaymentState
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.db import Connection
 from lnbits.fiat import get_fiat_provider
+from lnbits.fiat.base import (
+    FiatPaymentFailedStatus,
+    FiatPaymentPendingStatus,
+    FiatPaymentStatus,
+    FiatPaymentSuccessStatus,
+)
 from lnbits.settings import settings
 
 
@@ -29,6 +35,40 @@ async def handle_fiat_payment_confirmation(
         logger.warning(e)
 
 
+async def check_fiat_status(
+    payment: Payment, skip_internal_payment_notifications: bool | None = False
+) -> FiatPaymentStatus:
+    if not payment.is_internal:
+        return FiatPaymentPendingStatus()
+    if payment.success:
+        return FiatPaymentSuccessStatus()
+    if payment.failed:
+        return FiatPaymentFailedStatus()
+
+    if not payment.fiat_provider:
+        return FiatPaymentPendingStatus()
+
+    checking_id = payment.extra.get("fiat_checking_id")
+    if not checking_id:
+        return FiatPaymentPendingStatus()
+
+    fiat_provider = await get_fiat_provider(payment.fiat_provider)
+    if not fiat_provider:
+        return FiatPaymentPendingStatus()
+    fiat_status = await fiat_provider.get_invoice_status(checking_id)
+
+    if skip_internal_payment_notifications:
+        return fiat_status
+
+    if fiat_status.success:
+        # notify receivers asynchronously
+        from lnbits.tasks import internal_invoice_queue
+
+        await internal_invoice_queue.put(payment.checking_id)
+
+    return fiat_status
+
+
 def check_stripe_signature(
     payload: bytes,
     sig_header: str | None,
@@ -78,8 +118,8 @@ async def verify_paypal_webhook(headers, payload: bytes):
     """
     webhook_id = settings.paypal_webhook_id
     if not webhook_id:
-        logger.warning("PayPal webhook ID not set; skipping verification.")
-        return
+        logger.warning("PayPal webhook ID not set.")
+        raise ValueError("PayPal webhook cannot be verified. Missing webhook ID.")
 
     required_headers = {
         "PAYPAL-TRANSMISSION-ID": headers.get("PAYPAL-TRANSMISSION-ID"),
@@ -89,8 +129,8 @@ async def verify_paypal_webhook(headers, payload: bytes):
         "PAYPAL-AUTH-ALGO": headers.get("PAYPAL-AUTH-ALGO"),
     }
     if not all(required_headers.values()):
-        logger.warning("Missing PayPal webhook headers; skipping verification.")
-        return
+        logger.warning("Missing PayPal webhook headers.")
+        raise ValueError("PayPal webhook cannot be verified. Missing headers.")
 
     try:
         async with httpx.AsyncClient(base_url=settings.paypal_api_endpoint) as client:

lnbits/core/services/payments.py

@@ -13,18 +13,19 @@ from lnbits.core.crud.payments import get_daily_stats
 from lnbits.core.db import db
 from lnbits.core.models import PaymentDailyStats, PaymentFilters
 from lnbits.core.models.payments import CreateInvoice
+from lnbits.core.services.fiat_providers import handle_fiat_payment_confirmation
 from lnbits.db import Connection, Filters
 from lnbits.decorators import check_user_extension_access
 from lnbits.exceptions import InvoiceError, PaymentError, UnsupportedError
 from lnbits.fiat import get_fiat_provider
 from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
-from lnbits.tasks import create_task, internal_invoice_queue_put
 from lnbits.utils.crypto import fake_privkey, random_secret_and_hash, verify_preimage
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
 from lnbits.wallets import fake_wallet, get_funding_source
 from lnbits.wallets.base import (
     InvoiceResponse,
+    PaymentFailedStatus,
     PaymentPendingStatus,
     PaymentResponse,
     PaymentStatus,
@@ -47,6 +48,7 @@ from ..models import (
     PaymentState,
     Wallet,
 )
+from .fiat_providers import check_fiat_status
 from .notifications import send_payment_notification_in_background
 
 payment_lock = asyncio.Lock()
@@ -364,7 +366,7 @@ async def update_pending_payments(wallet_id: str):
 async def update_pending_payment(
     payment: Payment, conn: Connection | None = None
 ) -> Payment:
-    status = await payment.check_status()
+    status = await check_payment_status(payment)
     if status.failed:
         payment.status = PaymentState.FAILED
         await update_payment(payment, conn=conn)
@@ -507,6 +509,8 @@ async def update_wallet_balance(
         )
         payment.status = PaymentState.SUCCESS
         await update_payment(payment, conn=conn)
+        from lnbits.tasks import internal_invoice_queue_put
+
         await internal_invoice_queue_put(payment.checking_id)
 
 
@@ -618,7 +622,29 @@ async def check_transaction_status(
     if payment.status == PaymentState.SUCCESS.value:
         return PaymentSuccessStatus(fee_msat=payment.fee)
 
-    return await payment.check_status()
+    return await check_payment_status(payment)
+
+
+async def check_payment_status(
+    payment: Payment, skip_internal_payment_notifications: bool | None = False
+) -> PaymentStatus:
+    if payment.is_internal:
+        if payment.success:
+            return PaymentSuccessStatus()
+        if payment.failed:
+            return PaymentFailedStatus()
+        if payment.is_in and payment.fiat_provider:
+            fiat_status = await check_fiat_status(
+                payment, skip_internal_payment_notifications
+            )
+            return PaymentStatus(paid=fiat_status.paid)
+        return PaymentPendingStatus()
+    funding_source = get_funding_source()
+    if payment.is_out:
+        status = await funding_source.get_payment_status(payment.checking_id)
+    else:
+        status = await funding_source.get_invoice_status(payment.checking_id)
+    return status
 
 
 async def get_payments_daily_stats(
@@ -752,7 +778,7 @@ async def _pay_internal_invoice(
     await update_payment(internal_payment, conn=conn)
     logger.success(f"internal payment successful {internal_payment.checking_id}")
 
-    send_payment_notification_in_background(wallet, payment)
+    await _send_payment_notification_in_background(wallet.id, payment, conn=conn)
 
     # notify receiver asynchronously
     from lnbits.tasks import internal_invoice_queue
@@ -795,6 +821,8 @@ async def _pay_external_invoice(
 
     fee_reserve_msat = fee_reserve(amount_msat, internal=False)
 
+    from lnbits.tasks import create_task
+
     task = create_task(
         _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat)
     )
@@ -825,7 +853,8 @@ async def _pay_external_invoice(
         payment = await update_payment_success_status(
             payment, payment_response, conn=conn
         )
-        send_payment_notification_in_background(wallet, payment)
+
+        await _send_payment_notification_in_background(wallet.id, payment, conn=conn)
         logger.success(f"payment successful {payment_response.checking_id}")
 
     payment.checking_id = payment_response.checking_id
@@ -868,7 +897,7 @@ async def _verify_external_payment(
         raise PaymentError("Payment already paid.", status="success")
 
     # payment failed
-    status = await payment.check_status()
+    status = await check_payment_status(payment)
     if status.failed:
         raise PaymentError(
             "Payment is failed node, retrying is not possible.", status="failed"
@@ -1033,3 +1062,40 @@ async def cancel_hold_invoice(payment: Payment) -> InvoiceResponse:
     await update_payment(payment)
 
     return response
+
+
+async def _send_payment_notification_in_background(
+    wallet_id: str, payment: Payment, conn: Connection | None = None
+):
+    # fetch balance again
+    wallet = await get_wallet(wallet_id, conn=conn)
+    if not wallet:
+        raise PaymentError(f"Could not fetch wallet '{wallet_id}'.", status="failed")
+    send_payment_notification_in_background(wallet, payment)
+
+
+async def update_invoice_callback(checking_id: str) -> Payment | None:
+    """
+    Takes a checking_id of an incoming payment, from either paid_invoices_stream()
+    or internal_invoice_queue. Checks its status, updates and returns it.
+    returns None if no payment was found or it not and incoming payment.
+    """
+    payment = await get_standalone_payment(checking_id, incoming=True)
+    if not payment:
+        logger.warning(f"No payment found for '{checking_id}'.")
+        return None
+    if not payment.is_in:
+        logger.warning(f"Payment '{checking_id}' is not incoming, skipping.")
+        return None
+
+    status = await check_payment_status(
+        payment, skip_internal_payment_notifications=True
+    )
+    payment.fee = status.fee_msat or payment.fee
+    # only overwrite preimage if status.preimage provides it
+    payment.preimage = status.preimage or payment.preimage
+    payment.status = PaymentState.SUCCESS
+    await update_payment(payment)
+    if payment.fiat_provider:
+        await handle_fiat_payment_confirmation(payment)
+    return payment

lnbits/core/services/users.py

@@ -3,8 +3,10 @@ from uuid import uuid4
 
 from loguru import logger
 
+from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.db import db
 from lnbits.core.models.extensions import UserExtension
+from lnbits.core.models.users import RegisterUser
 from lnbits.db import Connection
 from lnbits.settings import (
     EditableSettings,
@@ -21,6 +23,7 @@ from ..crud import (
     get_account_by_email,
     get_account_by_pubkey,
     get_account_by_username,
+    get_accounts_count,
     get_super_settings,
     get_user_extensions,
     get_user_from_account,
@@ -53,6 +56,8 @@ async def create_user_account_no_ckeck(
     conn: Connection | None = None,
 ) -> User:
     async with db.reuse_conn(conn) if conn else db.connect() as conn:
+        await check_users_limit(conn)
+
         if account:
             account.validate_fields()
             if account.username and await get_account_by_username(
@@ -93,6 +98,15 @@ async def create_user_account_no_ckeck(
     return user
 
 
+async def check_users_limit(conn: Connection | None = None):
+    if settings.lnbits_max_users == 0:
+        return
+
+    users_count = await get_accounts_count(conn=conn)
+    if users_count >= settings.lnbits_max_users:
+        raise ValueError("Max amount of users have been created")
+
+
 async def update_user_account(account: Account) -> Account:
     account.validate_fields()
 
@@ -171,6 +185,12 @@ async def check_admin_settings():
         if account and account.extra and account.extra.provider == "env":
             settings.first_install = True
 
+        if settings.has_first_install_token_changed():
+            logger.warning("First install token is changed. Resetting admin settings.")
+            new_settings = await init_admin_settings()
+            settings.super_user = new_settings.super_user
+            settings.first_install = True
+
         logger.success(
             "✔️ Admin UI is enabled. run `uv run lnbits-cli superuser` "
             "to get the superuser."
@@ -192,3 +212,25 @@ async def init_admin_settings(super_user: str | None = None) -> SuperSettings:
 
     editable_settings = EditableSettings.from_dict(settings.dict())
     return await create_admin_settings(account.id, editable_settings.dict())
+
+
+async def check_register_activation_settings(data: RegisterUser):
+    if not settings.lnbits_require_user_activation:
+        return None
+    if settings.lnbits_user_activation_by_invitation_code:
+        code = data.invitation_code.strip() if data.invitation_code else ""
+        if len(code) == 0:
+            raise ValueError("Invitation code cannot be empty.")
+
+        if code == settings.lnbits_register_reusable_activation_code:
+            return None
+        if code in settings.lnbits_register_one_time_activation_codes:
+            settings.lnbits_register_one_time_activation_codes.remove(code)
+            await set_settings_field(
+                "lnbits_register_one_time_activation_codes",
+                settings.lnbits_register_one_time_activation_codes,
+            )
+            return None
+        raise ValueError("Invalid invitation code.")
+
+    raise ValueError("No activation method provided.")

lnbits/core/templates/index.html

@@ -1,3 +0,0 @@
-{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
-%} {% block scripts %} {{ window_vars(user) }} {% endblock %} {% block page %}{%
-endblock %}

lnbits/core/templates/index_public.html

@@ -1,3 +0,0 @@
-{% extends "public.html" %} {% from "macros.jinja" import window_vars with
-context %} {% block scripts %} {{ window_vars() }} {% endblock %} {% block page
-%} {% endblock %}

lnbits/core/views/auth_api.py

@@ -12,6 +12,7 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi_sso.sso.base import OpenID, SSOBase
 from loguru import logger
 
+from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.crud.users import (
     get_user_access_control_lists,
     update_user_access_control_list,
@@ -26,7 +27,10 @@ from lnbits.core.models.users import (
     UpdateAccessControlList,
 )
 from lnbits.core.services import create_user_account
-from lnbits.core.services.users import update_user_account
+from lnbits.core.services.users import (
+    check_register_activation_settings,
+    update_user_account,
+)
 from lnbits.decorators import (
     access_token_payload,
     check_account_exists,
@@ -86,6 +90,7 @@ async def login(data: LoginUsernamePassword) -> JSONResponse:
     account = await get_account_by_username_or_email(data.username)
     if not account or not account.verify_password(data.password):
         raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid credentials.")
+
     return _auth_success_response(account.username, account.id, account.email)
 
 
@@ -94,7 +99,7 @@ async def nostr_login(request: Request) -> JSONResponse:
     if not settings.is_auth_method_allowed(AuthMethods.nostr_auth_nip98):
         raise HTTPException(HTTPStatus.FORBIDDEN, "Login with Nostr Auth not allowed.")
     event = _nostr_nip98_event(request)
-    account = await get_account_by_pubkey(event["pubkey"])
+    account = await get_account_by_pubkey(event["pubkey"], active_only=False)
     if not account:
         account = Account(
             id=uuid4().hex,
@@ -102,6 +107,8 @@ async def nostr_login(request: Request) -> JSONResponse:
             extra=UserExtra(provider="nostr"),
         )
         await create_user_account(account)
+    if not account.activated:
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User is not activated.")
     return _auth_success_response(account.username or "", account.id, account.email)
 
 
@@ -148,9 +155,20 @@ async def impersonate_user(
 
     max_age = settings.auth_token_expire_minutes * 60
     response.set_cookie(
-        "admin_access_token", cookie_access_token, httponly=True, max_age=max_age
+        "admin_access_token",
+        cookie_access_token,
+        httponly=True,
+        secure=settings.auth_https_only,
+        samesite="lax",
+        max_age=max_age,
+    )
+    response.set_cookie(
+        "is_lnbits_user_impersonated",
+        "true",
+        secure=settings.auth_https_only,
+        samesite="lax",
+        max_age=max_age,
     )
-    response.set_cookie("is_lnbits_user_impersonated", "true", max_age=max_age)
     return response
 
 
@@ -171,7 +189,12 @@ async def stop_impersonate_user(
     )
     max_age = settings.auth_token_expire_minutes * 60
     response.set_cookie(
-        "cookie_access_token", admin_access_token, httponly=True, max_age=max_age
+        "cookie_access_token",
+        admin_access_token,
+        httponly=True,
+        secure=settings.auth_https_only,
+        samesite="lax",
+        max_age=max_age,
     )
     response.delete_cookie("admin_access_token")
     response.delete_cookie("is_access_token_expired")
@@ -357,12 +380,14 @@ async def register(data: RegisterUser) -> JSONResponse:
     if not is_valid_username(data.username):
         raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid username.")
 
-    if await get_account_by_username(data.username):
+    if await get_account_by_username(data.username, active_only=False):
         raise HTTPException(HTTPStatus.BAD_REQUEST, "Username already exists.")
 
     if data.email and not is_valid_email_address(data.email):
         raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid email.")
 
+    await check_register_activation_settings(data)
+
     account = Account(
         id=uuid4().hex,
         email=data.email,
@@ -503,15 +528,34 @@ async def update_ui_customization(
 async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
     if not settings.first_install:
         raise HTTPException(HTTPStatus.FORBIDDEN, "This is not your first install")
+
+    if settings.first_install_token:
+        if not data.first_install_token:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Missing first_install_token.")
+        if settings.first_install_token != data.first_install_token:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid first_install_token.")
+
+    account = await get_account_by_username(data.username, False)
+    if account:
+        raise HTTPException(HTTPStatus.BAD_REQUEST, "Username already exists.")
+
     account = await get_account(settings.super_user)
     if not account:
         raise HTTPException(HTTPStatus.INTERNAL_SERVER_ERROR, "Superuser not found.")
+
     account.username = data.username
     account.extra = account.extra or UserExtra()
     account.extra.provider = "lnbits"
     account.hash_password(data.password)
     await update_account(account)
     settings.first_install = False
+
+    # only confrm it after the super user has been successfully updated
+    if settings.first_install_token:
+        settings.first_install_token_confirmed = data.first_install_token
+        await set_settings_field(
+            "first_install_token_confirmed", data.first_install_token
+        )
     return _auth_success_response(account.username, account.id, account.email)
 
 
@@ -521,7 +565,7 @@ async def _handle_sso_login(userinfo: OpenID, verified_user_id: str | None = Non
         raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid email.")
 
     redirect_path = "/wallet"
-    account = await get_account_by_email(email)
+    account = await get_account_by_email(email, active_only=False)
 
     if verified_user_id:
         if account:
@@ -540,7 +584,7 @@ async def _handle_sso_login(userinfo: OpenID, verified_user_id: str | None = Non
             id=uuid4().hex, email=email, extra=UserExtra(email_verified=True)
         )
         await create_user_account(account)
-    return _auth_redirect_response(redirect_path, email)
+    return _auth_redirect_response(redirect_path, account.id, email)
 
 
 def _auth_success_response(
@@ -555,9 +599,20 @@ def _auth_success_response(
     max_age = settings.auth_token_expire_minutes * 60
     response = JSONResponse({"access_token": access_token, "token_type": "bearer"})
     response.set_cookie(
-        "cookie_access_token", access_token, httponly=True, max_age=max_age
+        "cookie_access_token",
+        access_token,
+        httponly=True,
+        secure=settings.auth_https_only,
+        samesite="lax",
+        max_age=max_age,
+    )
+    response.set_cookie(
+        "is_lnbits_user_authorized",
+        "true",
+        secure=settings.auth_https_only,
+        samesite="lax",
+        max_age=max_age,
     )
-    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
     response.delete_cookie("is_access_token_expired")
 
     return response
@@ -574,15 +629,28 @@ def _auth_api_token_response(
     )
 
 
-def _auth_redirect_response(path: str, email: str) -> RedirectResponse:
-    payload = AccessTokenPayload(sub="" or "", email=email, auth_time=int(time()))
+def _auth_redirect_response(path: str, user_id: str, email: str) -> RedirectResponse:
+    payload = AccessTokenPayload(
+        usr=user_id, sub="", email=email, auth_time=int(time())
+    )
     access_token = create_access_token(data=payload.dict())
     max_age = settings.auth_token_expire_minutes * 60
     response = RedirectResponse(path)
     response.set_cookie(
-        "cookie_access_token", access_token, httponly=True, max_age=max_age
+        "cookie_access_token",
+        access_token,
+        httponly=True,
+        secure=settings.auth_https_only,
+        samesite="lax",
+        max_age=max_age,
+    )
+    response.set_cookie(
+        "is_lnbits_user_authorized",
+        "true",
+        secure=settings.auth_https_only,
+        samesite="lax",
+        max_age=max_age,
     )
-    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
     response.delete_cookie("is_access_token_expired")
     return response
 
@@ -602,7 +670,10 @@ def _new_sso(provider: str) -> SSOBase | None:
 
         sso_provider_class = _find_auth_provider_class(provider)
         sso_provider = sso_provider_class(
-            client_id, client_secret, None, allow_insecure_http=True
+            client_id,
+            client_secret,
+            None,
+            allow_insecure_http=not settings.auth_https_only,
         )
         if (
             discovery_url

lnbits/core/views/callback_api.py

@@ -9,6 +9,7 @@ from lnbits.core.crud.payments import (
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.payments import CreateInvoice
 from lnbits.core.services.fiat_providers import (
+    check_fiat_status,
     check_stripe_signature,
     verify_paypal_webhook,
 )
@@ -23,7 +24,7 @@ callback_router = APIRouter(prefix="/api/v1/callback", tags=["callback"])
 async def api_generic_webhook_handler(
     provider_name: str, request: Request
 ) -> SimpleStatus:
-
+    logger.info(f"Received callback from provider: '{provider_name}'.")
     if provider_name.lower() == "stripe":
         payload = await request.body()
         sig_header = request.headers.get("Stripe-Signature")
@@ -87,7 +88,7 @@ async def _handle_stripe_intent_session_completed(event: dict):
     if not payment:
         logger.warning(f"No payment found for hash: '{payment_hash}'.")
         return
-    await payment.check_fiat_status()
+    await check_fiat_status(payment)
 
 
 async def _handle_stripe_checkout_session_completed(event: dict):
@@ -110,7 +111,7 @@ async def _handle_stripe_checkout_session_completed(event: dict):
     payment = await get_standalone_payment(payment_hash)
     if not payment:
         raise ValueError(f"No payment found for hash: '{payment_hash}'.")
-    await payment.check_fiat_status()
+    await check_fiat_status(payment)
 
 
 async def _handle_stripe_subscription_invoice_paid(event: dict):
@@ -155,7 +156,7 @@ async def _handle_stripe_subscription_invoice_paid(event: dict):
         ),
     )
 
-    await payment.check_fiat_status()
+    await check_fiat_status(payment)
 
 
 async def _get_stripe_subscription_payment_options(
@@ -180,8 +181,10 @@ async def _get_stripe_subscription_payment_options(
 
 
 async def handle_paypal_event(event: dict):
+    event_id = event.get("id", "")
     event_type = event.get("event_type", "")
     resource = event.get("resource", {})
+    logger.info(f"Handling PayPal event: '{event_id}'. Type: '{event_type}'.")
 
     if event_type in ("CHECKOUT.ORDER.APPROVED", "PAYMENT.CAPTURE.COMPLETED"):
         payment_hash = _paypal_extract_payment_hash(resource)
@@ -192,23 +195,20 @@ async def handle_paypal_event(event: dict):
         if not payment:
             logger.warning(f"No payment found for hash: '{payment_hash}'.")
             return
-        await payment.check_fiat_status()
+        await check_fiat_status(payment)
         return
 
-    if event_type in (
-        "PAYMENT.SALE.COMPLETED",
-        "BILLING.SUBSCRIPTION.PAYMENT.SUCCEEDED",
-    ):
+    if event_type in ("PAYMENT.SALE.COMPLETED"):
         await _handle_paypal_subscription_payment(resource)
         return
 
-    logger.info(f"Unhandled PayPal event type: '{event_type}'.")
+    logger.warning(f"Unhandled PayPal event type: '{event_type}'.")
 
 
 async def _handle_paypal_subscription_payment(resource: dict):
     amount_info = resource.get("amount") or {}
-    currency = (amount_info.get("currency_code") or "").upper()
-    total = amount_info.get("value")
+    currency = (amount_info.get("currency") or "").upper()
+    total = amount_info.get("total")
     if not currency or total is None:
         raise ValueError("PayPal subscription event missing amount.")
 
@@ -216,18 +216,14 @@ async def _handle_paypal_subscription_payment(resource: dict):
     if not custom_id:
         raise ValueError("PayPal subscription event missing custom metadata.")
 
-    try:
-        metadata = json.loads(custom_id)
-    except json.JSONDecodeError:
-        metadata = {}
-
-    payment_options = FiatSubscriptionPaymentOptions(**metadata)
+    payment_options = _deserialize_paypal_metadata(custom_id)
     if not payment_options.wallet_id:
         raise ValueError("PayPal subscription event missing wallet_id.")
 
     memo = payment_options.memo or ""
     extra = {
         **(payment_options.extra or {}),
+        "subscription_request_id": resource.get("billing_agreement_id"),
         "fiat_method": "subscription",
         "tag": payment_options.tag,
         "subscription": {
@@ -247,7 +243,7 @@ async def _handle_paypal_subscription_payment(resource: dict):
         ),
     )
 
-    await payment.check_fiat_status()
+    await check_fiat_status(payment)
 
 
 def _paypal_extract_payment_hash(resource: dict) -> str | None:
@@ -258,3 +254,29 @@ def _paypal_extract_payment_hash(resource: dict) -> str | None:
         if pu.get("custom_id"):
             return pu.get("custom_id")
     return None
+
+
+def _deserialize_paypal_metadata(custom_id: str) -> FiatSubscriptionPaymentOptions:
+    try:
+        meta = json.loads(custom_id)
+        wallet_id = meta[0] if len(meta) > 0 else None
+        tag = meta[1] if len(meta) > 1 else None
+        subscription_request_id = meta[2] if len(meta) > 2 else None
+        extra_link = meta[3] if len(meta) > 3 else None
+        memo = meta[4] if len(meta) > 4 else None
+
+        extra = {
+            "link": extra_link,
+            "subscription_request_id": subscription_request_id,
+        }
+
+        return FiatSubscriptionPaymentOptions(
+            wallet_id=wallet_id,
+            tag=tag,
+            subscription_request_id=subscription_request_id,
+            extra=extra,
+            memo=memo,
+        )
+    except (json.JSONDecodeError, IndexError) as e:
+        logger.warning(f"Failed to deserialize PayPal metadata: {e}")
+        return FiatSubscriptionPaymentOptions()

lnbits/core/views/extension_api.py

@@ -79,7 +79,11 @@ async def api_install_extension(data: CreateExtension):
         raise HTTPException(HTTPStatus.BAD_REQUEST, "Incompatible extension version.")
 
     release.payment_hash = data.payment_hash
-    ext_meta = ExtensionMeta(installed_release=release)
+    ext_meta = ExtensionMeta(
+        installed_release=release,
+        admin_only=release.admin_only,
+        super_user_only=release.super_user_only,
+    )
     ext_info = InstallableExtension(
         id=data.ext_id,
         name=data.ext_id,
@@ -98,12 +102,16 @@ async def api_install_extension(data: CreateExtension):
         ext_info.clean_extension_files()
         detail = (
             str(exc)
-            if isinstance(exc, AssertionError)
+            if isinstance(exc, (AssertionError, ValueError))
             else f"Failed to install extension '{ext_info.id}'."
             f"({ext_info.installed_version})."
         )
         raise HTTPException(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            status_code=(
+                HTTPStatus.BAD_REQUEST
+                if isinstance(exc, (AssertionError, ValueError))
+                else HTTPStatus.INTERNAL_SERVER_ERROR
+            ),
             detail=detail,
         ) from exc
 
@@ -172,6 +180,19 @@ async def api_update_pay_to_enable(
     )
 
 
+def _check_enable_extension_access(
+    ext_id: str, ext: InstallableExtension, account_id: AccountId
+) -> None:
+    if ext.is_super_user_only and not settings.is_super_user(account_id.id):
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'."
+        )
+    if ext.is_admin_only and not settings.is_admin_user(account_id.id):
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'."
+        )
+
+
 @extension_router.put("/{ext_id}/enable")
 async def api_enable_extension(
     ext_id: str, account_id: AccountId = Depends(check_account_id_exists)
@@ -187,6 +208,7 @@ async def api_enable_extension(
         raise ValueError(f"Extension '{ext_id}' is not installed.")
     if not ext.active:
         raise ValueError(f"Extension '{ext_id}' is not activated.")
+    _check_enable_extension_access(ext_id, ext, account_id)
 
     user_ext = await get_user_extension(account_id.id, ext_id)
     if not user_ext:
@@ -460,6 +482,8 @@ async def get_extension_release(org: str, repo: str, tag_name: str):
             "min_lnbits_version": config.min_lnbits_version,
             "is_version_compatible": config.is_version_compatible(),
             "warning": config.warning,
+            "admin_only": config.admin_only,
+            "super_user_only": config.super_user_only,
         }
     except Exception as exc:
         raise HTTPException(
@@ -569,7 +593,8 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
                 (True for version in db_versions if version.db == ext.id), False
             ),
             "isAvailable": ext.id in all_ext_ids,
-            "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
+            "isAdminOnly": ext.is_admin_only,
+            "isSuperUserOnly": ext.is_super_user_only,
             "isActive": ext.id not in inactive_extensions,
             "latestRelease": (
                 dict(ext.meta.latest_release)

lnbits/core/views/fiat_api.py

@@ -1,6 +1,7 @@
 from http import HTTPStatus
 
 from fastapi import APIRouter, Depends, HTTPException
+from loguru import logger
 
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.wallets import WalletTypeInfo
@@ -30,6 +31,11 @@ async def create_subscription(
     data: CreateFiatSubscription,
     key_type: WalletTypeInfo = Depends(require_admin_key),
 ) -> FiatSubscriptionResponse:
+    logger.debug(
+        f"Creating subscription with provider '{provider}. '"
+        f"Subscription ID '{data.subscription_id}'."
+    )
+
     fiat_provider = await get_fiat_provider(provider)
     if not fiat_provider:
         raise HTTPException(404, "Fiat provider not found")
@@ -47,6 +53,12 @@ async def create_subscription(
     subscription_response = await fiat_provider.create_subscription(
         data.subscription_id, data.quantity, data.payment_options
     )
+    if subscription_response.error_message:
+        logger.warning(
+            f"Failed to create subscription with provider '{provider}': "
+            f"{subscription_response.error_message}"
+        )
+
     return subscription_response
 
 

lnbits/core/views/generic.py

@@ -200,7 +200,7 @@ async def index(
 ) -> HTMLResponse:
     return template_renderer().TemplateResponse(
         request,
-        "index.html",
+        "base.html",
         {
             "user": user.json(),
         },
@@ -211,7 +211,7 @@ async def index(
 @generic_router.get("/node/public")
 @generic_router.get("/first_install", dependencies=[Depends(check_first_install)])
 async def index_public(request: Request) -> HTMLResponse:
-    return template_renderer().TemplateResponse(request, "index.html", {"public": True})
+    return template_renderer().TemplateResponse(request, "base.html", {"public": True})
 
 
 @generic_router.get("/uuidv4/{hex_value}")

lnbits/core/views/lnurl_api.py

@@ -36,6 +36,8 @@ lnurl_router = APIRouter(tags=["LNURL"])
 
 async def _handle(lnurl: str) -> LnurlResponseModel:
     try:
+        if "@" in lnurl:  # lower case lightning addresses
+            lnurl = lnurl.lower()
         res = await lnurl_handle(lnurl, user_agent=settings.user_agent, timeout=5)
         if isinstance(res, LnurlErrorResponse):
             raise HTTPException(status_code=HTTPStatus.BAD_REQUEST, detail=res.reason)

lnbits/core/views/user_api.py

@@ -20,6 +20,7 @@ from lnbits.core.crud import (
     update_admin_settings,
     update_wallet,
 )
+from lnbits.core.crud.users import clear_user_id_cache, get_account, update_account
 from lnbits.core.crud.wallets import delete_wallet_by_id
 from lnbits.core.models import (
     AccountFilters,
@@ -73,7 +74,7 @@ async def api_get_users(
     summary="Get user by Id",
 )
 async def api_get_user(user_id: str) -> User:
-    user = await get_user(user_id)
+    user = await get_user(user_id, active_only=False)
     if not user:
         raise HTTPException(HTTPStatus.NOT_FOUND, "User not found.")
     return user
@@ -197,7 +198,7 @@ async def api_users_reset_password(user_id: str) -> str:
     return f"reset_key_{reset_key_b64}"
 
 
-@users_router.get(
+@users_router.put(
     "/user/{user_id}/admin",
     dependencies=[Depends(check_super_user)],
     name="Give or revoke admin permsisions to a user",
@@ -220,6 +221,43 @@ async def api_users_toggle_admin(user_id: str) -> SimpleStatus:
     )
 
 
+@users_router.put(
+    "/user/{user_id}/activate",
+    name="Activate or deactivate a user",
+)
+async def api_users_toggle_activated(
+    user_id: str, admin_account: Account = Depends(check_admin)
+) -> SimpleStatus:
+    if user_id == settings.super_user:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Cannot deactivate super user.",
+        )
+    if user_id == admin_account.id:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="You cannot deactivate yourself.",
+        )
+
+    if settings.is_admin_user(user_id):
+        settings.lnbits_admin_users.remove(user_id)
+
+    user_account = await get_account(user_id, active_only=False)
+    if not user_account:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND,
+            detail="User not found.",
+        )
+    user_account.activated = not user_account.activated
+    await update_account(user_account)
+    await clear_user_id_cache(user_id)
+
+    return SimpleStatus(
+        success=True,
+        message=f"User {'activated' if user_account.activated else 'deactivated'}.",
+    )
+
+
 @users_router.get("/user/{user_id}/wallet", name="Get wallets for user")
 async def api_users_get_user_wallet(user_id: str) -> list[Wallet]:
     return await get_wallets(user_id, deleted=None)

lnbits/core/views/wallet_api.py

@@ -9,6 +9,7 @@ from fastapi import (
 )
 
 from lnbits.core.crud.wallets import (
+    clear_wallet_cache,
     create_wallet,
     get_wallets_paginated,
 )
@@ -37,7 +38,6 @@ from lnbits.decorators import (
     require_invoice_key,
 )
 from lnbits.helpers import generate_filter_params_openapi
-from lnbits.utils.cache import cache
 
 from ..crud import (
     delete_wallet,
@@ -134,9 +134,7 @@ async def api_reset_wallet_keys(
     if not wallet or wallet.user != account_id.id:
         raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="Wallet not found")
 
-    cache.pop(f"auth:wallet:{wallet.id}")
-    cache.pop(f"auth:x-api-key:{wallet.adminkey}")
-    cache.pop(f"auth:x-api-key:{wallet.inkey}")
+    clear_wallet_cache(wallet)
 
     wallet.adminkey = uuid4().hex
     wallet.inkey = uuid4().hex

lnbits/db.py

@@ -12,7 +12,6 @@ from typing import Any, Generic, Literal, TypeVar, get_origin
 
 from loguru import logger
 from pydantic import BaseModel, ValidationError, root_validator
-from sqlalchemy import event
 from sqlalchemy.ext.asyncio import AsyncConnection, AsyncEngine, create_async_engine
 from sqlalchemy.sql import text
 
@@ -56,14 +55,6 @@ def compat_timestamp_placeholder(key: str):
         return f":{key}"
 
 
-def get_placeholder(model: Any, field: str) -> str:
-    type_ = model.__fields__[field].type_
-    if type_ == datetime:
-        return compat_timestamp_placeholder(field)
-    else:
-        return f":{field}"
-
-
 class Compat:
     type: str | None = "<inherited>"
     schema: str | None = "<inherited>"
@@ -326,31 +317,7 @@ class Database(Compat):
         self.engine: AsyncEngine = create_async_engine(
             database_uri, echo=settings.debug_database
         )
-
-        if self.type in {POSTGRES, COCKROACH}:
-
-            @event.listens_for(self.engine.sync_engine, "connect")
-            def register_custom_types(dbapi_connection, *_):
-                def _parse_date(value) -> datetime:
-                    if value is None:
-                        value = "1970-01-01 00:00:00"
-                    f = "%Y-%m-%d %H:%M:%S.%f"
-                    if "." not in value:
-                        f = "%Y-%m-%d %H:%M:%S"
-                    # Parse and add UTC timezone info
-                    return datetime.strptime(value, f).replace(tzinfo=timezone.utc)
-
-                dbapi_connection.run_async(
-                    lambda connection: connection.set_type_codec(
-                        "TIMESTAMP",
-                        encoder=datetime,
-                        decoder=_parse_date,
-                        schema="pg_catalog",
-                    )
-                )
-
         self.lock = asyncio.Lock()
-
         logger.trace(f"database {self.type} added for {self.name}")
 
     @asynccontextmanager
@@ -646,6 +613,12 @@ class Filters(BaseModel, Generic[TFilterModel]):
         for page_filter in self.filters:
             page_filter.table_name = table_name
 
+    def get_filter_by_field(self, field: str) -> Filter[TFilterModel] | None:
+        return next((f for f in self.filters if f.field == field), None)
+
+    def remove_filter_by_field(self, field: str) -> None:
+        self.filters = [f for f in self.filters if f.field != field]
+
 
 class DbJsonEncoder(json.JSONEncoder):
     def default(self, o):
@@ -663,7 +636,7 @@ def insert_query(table_name: str, model: BaseModel) -> str:
     placeholders = []
     keys = model_to_dict(model).keys()
     for field in keys:
-        placeholders.append(get_placeholder(model, field))
+        placeholders.append(f":{field}")
     # add quotes to keys to avoid SQL conflicts (e.g. `user` is a reserved keyword)
     fields = ", ".join([f'"{key}"' for key in keys])
     values = ", ".join(placeholders)
@@ -681,9 +654,8 @@ def update_query(
     """
     fields = []
     for field in model_to_dict(model).keys():
-        placeholder = get_placeholder(model, field)
         # add quotes to keys to avoid SQL conflicts (e.g. `user` is a reserved keyword)
-        fields.append(f'"{field}" = {placeholder}')
+        fields.append(f'"{field}" = :{field}')
     query = ", ".join(fields)
     return f"UPDATE {table_name} SET {query} {where}"  # noqa: S608
 
@@ -701,7 +673,12 @@ def model_to_dict(model: BaseModel) -> dict:
         if model.__fields__[key].field_info.extra.get("no_database", False):
             continue
         if isinstance(value, datetime):
-            _dict[key] = value.timestamp()
+            if DB_TYPE == SQLITE:
+                _dict[key] = value.timestamp()
+            else:
+                # remove tz. postgres and cockroach TIMESTAMP is not tz aware
+                # so it will throw if we dont remove the UTC.
+                _dict[key] = value.replace(tzinfo=None)
             continue
         if (
             type(type_) is type(BaseModel)
@@ -757,11 +734,7 @@ def dict_to_model(_row: dict, model: type[TModel]) -> TModel:  # noqa: C901
             if DB_TYPE == SQLITE:
                 _dict[key] = datetime.fromtimestamp(value, timezone.utc)
             else:
-                # Ensure PostgreSQL datetime values have timezone info
-                if isinstance(value, datetime) and value.tzinfo is None:
-                    _dict[key] = value.replace(tzinfo=timezone.utc)
-                else:
-                    _dict[key] = value
+                _dict[key] = value.replace(tzinfo=timezone.utc)
             continue
         if issubclass(type_, BaseModel):
             _dict[key] = dict_to_submodel(type_, value)

lnbits/decorators.py

@@ -14,6 +14,7 @@ from lnbits.core.crud import (
     get_account,
     get_account_by_email,
     get_account_by_username,
+    get_installed_extension,
     get_user_active_extensions_ids,
     get_user_from_account,
     get_wallet_for_key,
@@ -261,6 +262,7 @@ async def check_account_id_exists(
             account_id,
             expiry=settings.auth_authentication_cache_minutes * 60,
         )
+        cache.set(f"auth:user:cache_key:{sha256s(account.id)}", cache_key)
 
     return account_id
 
@@ -423,7 +425,19 @@ async def check_user_extension_access(
     Check if the user has access to a particular extension.
     Raises HTTP Forbidden if the user is not allowed.
     """
-    if settings.is_admin_extension(ext_id) and not settings.is_admin_user(user_id):
+    ext = await get_installed_extension(ext_id, conn=conn)
+    is_admin_only = settings.is_admin_extension(ext_id) or bool(
+        ext and ext.meta and ext.meta.admin_only
+    )
+    is_super_user_only = bool(ext and ext.meta and ext.meta.super_user_only)
+
+    if is_super_user_only and not settings.is_super_user(user_id):
+        return SimpleStatus(
+            success=False,
+            message=f"User not authorized for extension '{ext_id}'.",
+        )
+
+    if is_admin_only and not settings.is_admin_user(user_id):
         return SimpleStatus(
             success=False, message=f"User not authorized for extension '{ext_id}'."
         )

lnbits/fiat/paypal.py

@@ -2,7 +2,7 @@ import asyncio
 import json
 import time
 from collections.abc import AsyncGenerator
-from typing import Any
+from typing import Any, Literal
 
 import httpx
 from loguru import logger
@@ -24,6 +24,8 @@ from .base import (
     FiatSubscriptionResponse,
 )
 
+FiatMethod = Literal["checkout", "subscription"]
+
 
 class PayPalCheckoutOptions(BaseModel):
     class Config:
@@ -34,11 +36,21 @@ class PayPalCheckoutOptions(BaseModel):
     metadata: dict[str, Any] = Field(default_factory=dict)
 
 
+class PayPalSubscriptionOptions(BaseModel):
+    class Config:
+        extra = "ignore"
+
+    checking_id: str | None = None
+    payment_request: str | None = None
+
+
 class PayPalCreateInvoiceOptions(BaseModel):
     class Config:
         extra = "ignore"
 
+    fiat_method: FiatMethod = "checkout"
     checkout: PayPalCheckoutOptions | None = None
+    subscription: PayPalSubscriptionOptions | None = None
 
 
 class PayPalWallet(FiatProvider):
@@ -96,6 +108,14 @@ class PayPalWallet(FiatProvider):
         opts = self._parse_create_opts(extra or {})
         if opts is None:
             return FiatInvoiceResponse(ok=False, error_message="Invalid PayPal options")
+        if opts.fiat_method == "subscription":
+            term = opts.subscription or PayPalSubscriptionOptions()
+            checking_id = term.checking_id or urlsafe_short_hash()
+            return FiatInvoiceResponse(
+                ok=True,
+                checking_id=f"subscription_{checking_id}",
+                payment_request=term.payment_request or "",
+            )
 
         try:
             await self._ensure_access_token()
@@ -171,6 +191,7 @@ class PayPalWallet(FiatProvider):
             or "https://lnbits.com"
         )
 
+        logger.debug(f"Creating PayPal subscription with ID '{subscription_id}'")
         if not payment_options.subscription_request_id:
             payment_options.subscription_request_id = urlsafe_short_hash()
         payment_options.extra = payment_options.extra or {}
@@ -182,7 +203,6 @@ class PayPalWallet(FiatProvider):
             await self._ensure_access_token()
             payload = {
                 "plan_id": subscription_id,
-                "quantity": str(quantity),
                 "custom_id": self._serialize_metadata(payment_options),
                 "application_context": {
                     "return_url": success_url,
@@ -205,7 +225,7 @@ class PayPalWallet(FiatProvider):
             return FiatSubscriptionResponse(
                 ok=True,
                 checkout_session_url=approval_url,
-                subscription_request_id=payment_options.subscription_request_id,
+                subscription_request_id=data.get("id"),
             )
         except Exception as exc:
             logger.warning(exc)
@@ -219,6 +239,10 @@ class PayPalWallet(FiatProvider):
         correlation_id: str,
         **kwargs,
     ) -> FiatSubscriptionResponse:
+        logger.debug(
+            f"Cancelling PayPal subscription '{subscription_id}'. "
+            f"Correlation ID '{correlation_id}'."
+        )
         try:
             await self._ensure_access_token()
             r = await self.client.post(
@@ -240,12 +264,20 @@ class PayPalWallet(FiatProvider):
     async def get_invoice_status(self, checking_id: str) -> FiatPaymentStatus:
         try:
             await self._ensure_access_token()
-            order_id = self._normalize_paypal_id(checking_id)
-            r = await self.client.get(
-                f"/v2/checkout/orders/{order_id}", headers=self._auth_headers()
-            )
-            r.raise_for_status()
-            return self._status_from_order(r.json())
+            paypal_id = self._normalize_paypal_id(checking_id)
+            if paypal_id.startswith("subscription_"):
+                capture_id = paypal_id.replace("subscription_", "", 1)
+                r = await self.client.get(
+                    f"v2/payments/captures/{capture_id}", headers=self._auth_headers()
+                )
+                r.raise_for_status()
+                return self._status_from_capture(r.json())
+            else:
+                r = await self.client.get(
+                    f"/v2/checkout/orders/{paypal_id}", headers=self._auth_headers()
+                )
+                r.raise_for_status()
+                return self._status_from_order(r.json())
         except Exception as exc:
             logger.debug(f"Error getting PayPal order status: {exc}")
             return FiatPaymentPendingStatus()
@@ -270,6 +302,14 @@ class PayPalWallet(FiatProvider):
             return FiatPaymentFailedStatus()
         return FiatPaymentPendingStatus()
 
+    def _status_from_capture(self, order: dict[str, Any]) -> FiatPaymentStatus:
+        status = (order.get("status") or "").upper()
+        if status in ["COMPLETED"]:
+            return FiatPaymentSuccessStatus()
+        if status in ["DECLINED", "FAILED", "CANCELLED", "CANCELED"]:
+            return FiatPaymentFailedStatus()
+        return FiatPaymentPendingStatus()
+
     def _normalize_paypal_id(self, checking_id: str) -> str:
         return (
             checking_id.replace("fiat_paypal_", "", 1)
@@ -280,15 +320,20 @@ class PayPalWallet(FiatProvider):
     def _serialize_metadata(
         self, payment_options: FiatSubscriptionPaymentOptions
     ) -> str:
-        md = {
-            "wallet_id": payment_options.wallet_id,
-            "memo": payment_options.memo,
-            "extra": payment_options.extra,
-            "tag": payment_options.tag,
-            "subscription_request_id": payment_options.subscription_request_id,
-        }
-        raw = json.dumps(md)
-        return raw[:127]  # PayPal custom_id limit
+        meta = [
+            payment_options.wallet_id,
+            payment_options.tag,
+            payment_options.subscription_request_id,
+        ]
+        if payment_options.extra:
+            meta.append(payment_options.extra.get("link", None))
+
+        # Keep custom_id within PayPal's 127-char limit
+        memo_limit = 120 - len(json.dumps(meta))
+        if memo_limit > 0 and payment_options.memo:
+            meta.append(payment_options.memo[:memo_limit])
+
+        return json.dumps(meta)
 
     def _parse_create_opts(
         self, raw_opts: dict[str, Any]

lnbits/helpers.py

@@ -7,15 +7,14 @@ from typing import Any
 from urllib import request
 from urllib.parse import urlparse
 
-import jinja2
 import jwt
 import shortuuid
 from fastapi.routing import APIRoute
 from loguru import logger
 from packaging import version
 from pydantic.schema import field_schema
+from starlette.templating import Jinja2Templates
 
-from lnbits.jinja2_templating import Jinja2Templates
 from lnbits.settings import settings
 from lnbits.utils.crypto import AESCipher
 from lnbits.utils.exchange_rates import currencies
@@ -56,7 +55,6 @@ def static_url_for(static: str, path: str) -> str:
 def template_renderer(additional_folders: list | None = None) -> Jinja2Templates:
     folders = [
         "lnbits/templates",
-        "lnbits/core/templates",
         settings.extension_builder_working_dir_path.as_posix(),
     ]
 
@@ -66,64 +64,15 @@ def template_renderer(additional_folders: list | None = None) -> Jinja2Templates
             for f in additional_folders
         ]
         folders.extend(additional_folders)
-    t = Jinja2Templates(loader=jinja2.FileSystemLoader(folders))
+    t = Jinja2Templates(directory=folders)
     t.env.globals["static_url_for"] = static_url_for
     t.env.globals["normalize_path"] = normalize_path
 
-    window_settings = {
-        "AD_SPACE": settings.lnbits_ad_space,
-        "AD_SPACE_ENABLED": settings.lnbits_ad_space_enabled,
-        "AD_SPACE_TITLE": settings.lnbits_ad_space_title,
-        "EXTENSIONS": list(settings.lnbits_installed_extensions_ids),
-        "HIDE_API": settings.lnbits_hide_api,
-        "SITE_TITLE": settings.lnbits_site_title,
-        "SITE_TAGLINE": settings.lnbits_site_tagline,
-        "SITE_DESCRIPTION": settings.lnbits_site_description,
-        "LNBITS_ADMIN_UI": settings.lnbits_admin_ui,
-        "LNBITS_AUDIT_ENABLED": settings.lnbits_audit_enabled,
-        "LNBITS_AUTH_METHODS": settings.auth_allowed_methods,
-        "LNBITS_AUTH_KEYCLOAK_ORG": settings.keycloak_client_custom_org,
-        "LNBITS_AUTH_KEYCLOAK_ICON": settings.keycloak_client_custom_icon,
-        "LNBITS_CUSTOM_IMAGE": settings.lnbits_custom_image,
-        "LNBITS_CUSTOM_BADGE": settings.lnbits_custom_badge,
-        "LNBITS_CUSTOM_BADGE_COLOR": settings.lnbits_custom_badge_color,
-        "LNBITS_EXTENSIONS_DEACTIVATE_ALL": settings.lnbits_extensions_deactivate_all,
-        "LNBITS_NEW_ACCOUNTS_ALLOWED": settings.new_accounts_allowed,
-        "LNBITS_NODE_UI": settings.lnbits_node_ui and settings.has_nodemanager,
-        "LNBITS_NODE_UI_AVAILABLE": settings.has_nodemanager,
-        "LNBITS_QR_LOGO": settings.lnbits_qr_logo,
-        "LNBITS_APPLE_TOUCH_ICON": settings.lnbits_apple_touch_icon,
-        "LNBITS_SERVICE_FEE": settings.lnbits_service_fee,
-        "LNBITS_SERVICE_FEE_MAX": settings.lnbits_service_fee_max,
-        "LNBITS_SERVICE_FEE_WALLET": settings.lnbits_service_fee_wallet,
-        "LNBITS_SHOW_HOME_PAGE_ELEMENTS": settings.lnbits_show_home_page_elements,
-        "LNBITS_THEME_OPTIONS": settings.lnbits_theme_options,
-        "WALLET_FEATURED_BUTTON_LABEL": settings.lnbits_wallet_featured_button_label,
-        "WALLET_FEATURED_BUTTON_URL": settings.lnbits_wallet_featured_button_url,
-        "WALLET_FEATURED_BUTTON_ICON": settings.lnbits_wallet_featured_button_icon,
-        "LNBITS_VERSION": settings.version,
-        "USE_CUSTOM_LOGO": settings.lnbits_custom_logo,
-        "LNBITS_DEFAULT_REACTION": settings.lnbits_default_reaction,
-        "LNBITS_DEFAULT_THEME": settings.lnbits_default_theme,
-        "LNBITS_DEFAULT_BORDER": settings.lnbits_default_border,
-        "LNBITS_DEFAULT_GRADIENT": settings.lnbits_default_gradient,
-        "LNBITS_DEFAULT_BGIMAGE": settings.lnbits_default_bgimage,
-        "VOIDWALLET": settings.lnbits_backend_wallet_class == "VoidWallet",
-        "WEBPUSH_PUBKEY": settings.lnbits_webpush_pubkey,
-        "LNBITS_EXTENSIONS_REVIEWS_URL": settings.lnbits_extensions_reviews_url,
-        "LNBITS_DENOMINATION": settings.lnbits_denomination,
-        "has_holdinvoice": settings.has_holdinvoice,
-        "LNBITS_NOSTR_CONFIGURED": settings.is_nostr_notifications_configured(),
-        "LNBITS_TELEGRAM_CONFIGURED": settings.is_telegram_notifications_configured(),
-        "LNBITS_EXT_BUILDER": settings.lnbits_extensions_builder_activate_non_admins,
-        "LNBITS_CURRENCIES": list(currencies.keys()),
-        "LNBITS_ALLOWED_CURRENCIES": settings.lnbits_allowed_currencies,
-        "CACHE_KEY": settings.server_startup_time,
-    }
-
-    t.env.globals["WINDOW_SETTINGS"] = window_settings
-    for key, value in window_settings.items():
-        t.env.globals[key] = value
+    # used in base.html
+    t.env.globals["SITE_TITLE"] = settings.lnbits_site_title
+    t.env.globals["LNBITS_APPLE_TOUCH_ICON"] = settings.lnbits_apple_touch_icon
+    t.env.globals["SETTINGS"] = settings.to_public().dict(by_alias=True)
+    t.env.globals["CURRENCIES"] = list(currencies.keys())
 
     if settings.bundle_assets:
         t.env.globals["INCLUDED_JS"] = ["bundle.min.js"]
@@ -137,6 +86,9 @@ def template_renderer(additional_folders: list | None = None) -> Jinja2Templates
             t.env.globals["INCLUDED_CSS"] = vendor_files["css"]
             t.env.globals["INCLUDED_COMPONENTS"] = vendor_files["components"]
 
+    # backwards compatibility for extensions (tpos)
+    t.env.globals["LNBITS_DENOMINATION"] = settings.lnbits_denomination
+
     return t
 
 

lnbits/jinja2_templating.py

@@ -1,28 +0,0 @@
-import typing
-
-from jinja2 import BaseLoader, Environment, pass_context
-from starlette.datastructures import QueryParams
-from starlette.requests import Request
-from starlette.templating import Jinja2Templates as SuperJinja2Templates
-
-
-class Jinja2Templates(SuperJinja2Templates):
-    def __init__(self, loader: BaseLoader) -> None:
-        self.env = self.get_environment(loader)
-        super().__init__(env=self.env)
-
-    def get_environment(self, loader: BaseLoader) -> Environment:
-        @pass_context
-        def url_for(context: dict, name: str, **path_params: typing.Any) -> str:
-            request: Request = context["request"]
-            return request.app.url_path_for(name, **path_params)
-
-        def url_params_update(init: QueryParams, **new: typing.Any) -> QueryParams:
-            values = dict(init)
-            values.update(new)
-            return QueryParams(**values)
-
-        env = Environment(loader=loader, autoescape=True)
-        env.globals["url_for"] = url_for
-        env.globals["url_params_update"] = url_params_update
-        return env

lnbits/middleware.py

@@ -1,6 +1,5 @@
 import asyncio
 import json
-import re
 from datetime import datetime, timezone
 from http import HTTPStatus
 from typing import Any
@@ -19,53 +18,6 @@ from lnbits.core.models import AuditEntry
 from lnbits.helpers import normalize_path, template_renderer
 from lnbits.settings import settings
 
-_LOCALHOST_IPS = {"127.0.0.1", "::1"}
-_PUBLIC_ASSET_PATHS = {
-    "/favicon.ico",
-    "/service-worker.js",
-}
-
-
-def _normalize_match_path(path: str) -> str:
-    if not path:
-        return "/"
-    if path != "/" and path.endswith("/"):
-        return path.rstrip("/")
-    return path
-
-
-def _route_pattern_matches(pattern: str, path: str) -> bool:
-    if not pattern:
-        return False
-    if not pattern.startswith("/"):
-        pattern = f"/{pattern}"
-    pattern = _normalize_match_path(pattern)
-    path = _normalize_match_path(path)
-    if pattern.endswith("*"):
-        prefix = pattern.rstrip("*")
-        return path.startswith(prefix)
-    if pattern == path:
-        return True
-    escaped = re.escape(pattern)
-    escaped = re.sub(r"\\\{[^/]+\\\}", r"[^/]+", escaped)
-    return re.fullmatch(escaped, path) is not None
-
-
-def _response_by_accepted_type(request: Request, msg: str, status_code: HTTPStatus):
-    accept_header = request.headers.get("accept", "")
-    if "text/html" in accept_header.split(","):
-        return HTMLResponse(
-            status_code=status_code,
-            content=template_renderer()
-            .TemplateResponse(
-                request,
-                "error.html",
-                {"err": msg, "status_code": status_code, "message": msg},
-            )
-            .body,
-        )
-    return JSONResponse(status_code=status_code, content={"detail": msg})
-
 
 class InstalledExtensionMiddleware:
     # This middleware class intercepts calls made to the extensions API and:
@@ -283,42 +235,6 @@ def add_ip_block_middleware(app: FastAPI):
         return await call_next(request)
 
 
-def add_route_access_middleware(app: FastAPI):
-    @app.middleware("http")
-    async def route_access_middleware(request: Request, call_next):
-        if not settings.lnbits_route_access_control_enabled:
-            return await call_next(request)
-        if not request.client:
-            return JSONResponse(
-                status_code=HTTPStatus.FORBIDDEN,
-                content={"detail": "No request client"},
-            )
-        if request.client.host in _LOCALHOST_IPS:
-            return await call_next(request)
-
-        path = request.url.path or "/"
-        if "/static/" in path or path in _PUBLIC_ASSET_PATHS:
-            return await call_next(request)
-        whitelist = settings.lnbits_route_access_whitelist
-        blacklist = settings.lnbits_route_access_blacklist
-
-        if whitelist:
-            if any(_route_pattern_matches(route, path) for route in whitelist):
-                return await call_next(request)
-            return _response_by_accepted_type(
-                request, f"Route not whitelisted: {path}", HTTPStatus.FORBIDDEN
-            )
-
-        if blacklist and any(
-            _route_pattern_matches(route, path) for route in blacklist
-        ):
-            return _response_by_accepted_type(
-                request, f"Route is blacklisted: {path}", HTTPStatus.FORBIDDEN
-            )
-
-        return await call_next(request)
-
-
 def add_first_install_middleware(app: FastAPI):
     @app.middleware("http")
     async def first_install_middleware(request: Request, call_next):

lnbits/nodes/lndrest.py

@@ -76,7 +76,7 @@ class LndRestNode(Node):
         return response.json()
 
     def get(self, path: str, **kwargs):
-        return self.request("GET", path, **kwargs)
+        return self.request("GET", path, timeout=30, **kwargs)
 
     async def _get_id(self) -> str:
         info = await self.get("/v1/getinfo")
@@ -99,11 +99,12 @@ class LndRestNode(Node):
                 "perm": True,
                 "timeout": 30,
             },
+            timeout=30,
         )
 
     async def disconnect_peer(self, peer_id: str):
         try:
-            await self.request("DELETE", "/v1/peers/" + peer_id)
+            await self.request("DELETE", "/v1/peers/" + peer_id, timeout=30)
         except HTTPException as exc:
             if "unable to disconnect" in exc.detail:
                 raise HTTPException(
@@ -141,6 +142,7 @@ class LndRestNode(Node):
                 "local_funding_amount": local_amount,
                 "push_sat": push_amount,
             },
+            timeout=30,
         )
         return ChannelPoint(
             # WHY IS THIS REVERSED?!
@@ -214,6 +216,7 @@ class LndRestNode(Node):
                 # 'min_htlc_msat': <uint64>,
                 # 'inbound_fee': <InboundFee>,
             },
+            timeout=30,
         )
 
     async def get_channel(self, channel_id: str) -> NodeChannel | None:

lnbits/settings.py

@@ -41,6 +41,14 @@ class UsersSettings(LNbitsSettings):
     lnbits_admin_users: list[str] = Field(default=[])
     lnbits_allowed_users: list[str] = Field(default=[])
     lnbits_allow_new_accounts: bool = Field(default=True)
+    lnbits_require_user_activation: bool = Field(default=False)
+
+    lnbits_user_activation_by_email: bool = Field(default=False)
+    lnbits_user_activation_by_payment: bool = Field(default=False)
+    lnbits_user_activation_by_invitation_code: bool = Field(default=False)
+
+    lnbits_register_reusable_activation_code: str = Field(default="")
+    lnbits_register_one_time_activation_codes: list[str] = Field(default=[])
 
     @property
     def new_accounts_allowed(self) -> bool:
@@ -284,10 +292,14 @@ class ThemesSettings(LNbitsSettings):
     lnbits_qr_logo: str = Field(default="/static/images/favicon_qr_logo.png")
     lnbits_apple_touch_icon: str | None = Field(default=None)
     lnbits_default_reaction: str = Field(default="confettiBothSides")
-    lnbits_default_theme: str = Field(default="salvador")
+    lnbits_default_theme: str = Field(default="bitcoin")
     lnbits_default_border: str = Field(default="hard-border")
     lnbits_default_gradient: bool = Field(default=True)
     lnbits_default_bgimage: str | None = Field(default=None)
+    lnbits_default_dark: bool = Field(default=True)
+    lnbits_default_card_rounded: bool = Field(default=True)
+    lnbits_default_card_gradient: bool = Field(default=True)
+    lnbits_default_card_shadow: bool = Field(default=False)
 
 
 class OpsSettings(LNbitsSettings):
@@ -312,7 +324,8 @@ class AssetSettings(LNbitsSettings):
             "heif",
             "heics",
             "text/plain",
-            "text/json" "text/xml",
+            "text/json",
+            "text/xml",
             "application/json",
             "application/pdf",
         ]
@@ -421,9 +434,6 @@ class SecuritySettings(LNbitsSettings):
     lnbits_rate_limit_unit: str = Field(default="minute")
     lnbits_allowed_ips: list[str] = Field(default=[])
     lnbits_blocked_ips: list[str] = Field(default=[])
-    lnbits_route_access_control_enabled: bool = Field(default=False)
-    lnbits_route_access_whitelist: list[str] = Field(default=[])
-    lnbits_route_access_blacklist: list[str] = Field(default=[])
     lnbits_callback_url_rules: list[str] = Field(
         default=["https?://([a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})(:\\d+)?"]
     )
@@ -438,6 +448,7 @@ class SecuritySettings(LNbitsSettings):
 
     lnbits_max_outgoing_payment_amount_sats: int = Field(default=10_000_000, ge=0)
     lnbits_max_incoming_payment_amount_sats: int = Field(default=10_000_000, ge=0)
+    first_install_token_confirmed: str | None = Field(default=None)
 
     def is_wallet_max_balance_exceeded(self, amount):
         return (
@@ -578,6 +589,8 @@ class ZBDFundingSource(LNbitsSettings):
 class PhoenixdFundingSource(LNbitsSettings):
     phoenixd_api_endpoint: str | None = Field(default="http://localhost:9740/")
     phoenixd_api_password: str | None = Field(default=None)
+    phoenixd_data_dir: str | None = Field(default=None)
+    phoenixd_mnemonic: str | None = Field(default=None)
 
 
 class AlbyFundingSource(LNbitsSettings):
@@ -597,6 +610,16 @@ class SparkFundingSource(LNbitsSettings):
     spark_token: str | None = Field(default=None)
 
 
+class SparkL2FundingSource(LNbitsSettings):
+    spark_l2_network: str = Field(default="MAINNET")
+    spark_l2_external_endpoint: str | None = Field(default="http://localhost:8765")
+    spark_l2_external_api_key: str | None = Field(default=None)
+    spark_l2_mnemonic: str | None = Field(default=None)
+    spark_l2_pay_wait_ms: int = Field(default=4000, ge=0)
+    spark_l2_pay_poll_ms: int = Field(default=500, ge=0)
+    spark_l2_stream_keepalive_ms: int = Field(default=15000, ge=0)
+
+
 class LnTipsFundingSource(LNbitsSettings):
     lntips_api_endpoint: str | None = Field(default=None)
     lntips_api_key: str | None = Field(default=None)
@@ -702,6 +725,7 @@ class FundingSourcesSettings(
     PhoenixdFundingSource,
     OpenNodeFundingSource,
     SparkFundingSource,
+    SparkL2FundingSource,
     LnTipsFundingSource,
     NWCFundingSource,
     BreezSdkFundingSource,
@@ -712,6 +736,7 @@ class FundingSourcesSettings(
     # How long to wait for the payment to be confirmed before returning a pending status
     # It will not fail the payment, it will make it return pending after the timeout
     lnbits_funding_source_pay_invoice_wait_seconds: int = Field(default=5, ge=0)
+    lnbits_funding_source_pending_interval_seconds: int = Field(default=1800, ge=0)
     funding_source_max_retries: int = Field(default=4, ge=0)
 
 
@@ -776,6 +801,7 @@ class AuthMethods(Enum):
     google_auth = "google-auth"
     github_auth = "github-auth"
     keycloak_auth = "keycloak-auth"
+    oidc_auth = "oidc-auth"
 
     @classmethod
     def all(cls):
@@ -786,6 +812,7 @@ class AuthMethods(Enum):
             AuthMethods.google_auth.value,
             AuthMethods.github_auth.value,
             AuthMethods.keycloak_auth.value,
+            AuthMethods.oidc_auth.value,
         ]
 
 
@@ -831,6 +858,14 @@ class KeycloakAuthSettings(LNbitsSettings):
     keycloak_client_custom_icon: str | None = Field(default=None)
 
 
+class OidcAuthSettings(LNbitsSettings):
+    oidc_discovery_url: str = Field(default="")
+    oidc_client_id: str = Field(default="")
+    oidc_client_secret: str = Field(default="")
+    oidc_client_custom_org: str | None = Field(default=None)
+    oidc_client_custom_icon: str | None = Field(default=None)
+
+
 class AuditSettings(LNbitsSettings):
     lnbits_audit_enabled: bool = Field(default=True)
 
@@ -938,6 +973,7 @@ class EditableSettings(
     GoogleAuthSettings,
     GitHubAuthSettings,
     KeycloakAuthSettings,
+    OidcAuthSettings,
 ):
     @validator(
         "lnbits_admin_users",
@@ -973,6 +1009,8 @@ class EnvSettings(LNbitsSettings):
     debug: bool = Field(default=False)
     debug_database: bool = Field(default=False)
     bundle_assets: bool = Field(default=True)
+    # When enabled, auth cookies require HTTPS and SSO will reject insecure HTTP.
+    auth_https_only: bool = Field(default=True)
     host: str = Field(default="127.0.0.1")
     port: int = Field(default=5000, gt=0)
     forwarded_allow_ips: str = Field(default="*")
@@ -986,14 +1024,24 @@ class EnvSettings(LNbitsSettings):
     enable_log_to_file: bool = Field(default=True)
     log_rotation: str = Field(default="100 MB")
     log_retention: str = Field(default="3 months")
+    first_install_token: str | None = Field(default=None)
 
     cleanup_wallets_days: int = Field(default=90, ge=0)
     funding_source_max_retries: int = Field(default=4, ge=0)
+    lnbits_max_users: int = Field(default=0, ge=0)
+    lnbits_max_extensions: int = Field(default=0, ge=0)
 
     @property
     def has_default_extension_path(self) -> bool:
         return self.lnbits_extensions_path == "lnbits"
 
+    def has_first_install_token_changed(self) -> bool:
+        if not self.first_install_token:
+            return False
+        if not settings.first_install_token_confirmed:
+            return False
+        return self.first_install_token != settings.first_install_token_confirmed
+
     def check_auth_secret_key(self):
         if self.auth_secret_key:
             return
@@ -1029,6 +1077,7 @@ class SuperUserSettings(LNbitsSettings):
             "FakeWallet",
             "LNPayWallet",
             "LNbitsWallet",
+            "SparkL2Wallet",
             "LnTipsWallet",
             "LndRestWallet",
             "LndWallet",
@@ -1134,6 +1183,137 @@ class Settings(EditableSettings, ReadOnlySettings, TransientSettings, BaseSettin
             and ext_id in self.lnbits_all_extensions_ids
         )
 
+    def to_public(self) -> PublicSettings:
+        return PublicSettings.from_settings(self)
+
+
+class PublicSettings(BaseModel):
+    """
+    PublicSettings is used for templating and public information.
+    WARNING: do not expose private information, PublicSettings is exposed publicly.
+    """
+
+    allow_register: bool = Field(alias="allowRegister")
+    qr_logo: str = Field(alias="qrLogo")
+    site_title: str = Field(alias="siteTitle")
+    site_tagline: str = Field(alias="siteTagline")
+    site_description: str | None = Field(alias="siteDescription")
+    auth_methods: list[str] = Field(alias="authMethods")
+    keycloak_org: str | None = Field(alias="keycloakOrg")
+    keycloak_icon: str | None = Field(alias="keycloakIcon")
+    oidc_org: str | None = Field(alias="oidcOrg")
+    oidc_icon: str | None = Field(alias="oidcIcon")
+    has_holdinvoice: bool = Field(alias="hasHoldinvoice")
+    has_nodemanager: bool = Field(alias="hasNodemanager")
+    show_nodemanager: bool = Field(alias="showNodemanager")
+    custom_logo: str | None = Field(alias="customLogo")
+    show_voidwallet: bool = Field(alias="showVoidwallet")
+    version: str = Field(alias="version")
+    show_home_page_elements: bool = Field(alias="showHomePageElements")
+    hide_api: bool = Field(alias="hideApi")
+    cache_key: str = Field(alias="cacheKey")
+    webpush_pubkey: str | None = Field(alias="webpushPubkey")
+    show_extensions: bool = Field(alias="showExtensions")
+    show_audit: bool = Field(alias="showAudit")
+    show_admin: bool = Field(alias="showAdmin")
+    ad_space: list[list[str]] = Field(alias="adSpace")
+    ad_space_title: str = Field(alias="adSpaceTitle")
+    show_ad_space: bool = Field(alias="showAdSpace")
+    custom_image: str | None = Field(alias="customImage")
+    custom_badge: str | None = Field(alias="customBadge")
+    custom_badge_color: str | None = Field(alias="customBadgeColor")
+    service_fee: float = Field(alias="serviceFee")
+    service_fee_max: int = Field(alias="serviceFeeMax")
+    service_fee_wallet: str | None = Field(alias="serviceFeeWallet")
+    theme_options: list[str] = Field(alias="themeOptions")
+    default_reaction: str = Field(alias="defaultReaction")
+    default_theme: str = Field(alias="defaultTheme")
+    default_border: str = Field(alias="defaultBorder")
+    default_bgimage: str | None = Field(alias="defaultBgimage")
+    default_gradient: bool = Field(alias="defaultGradient")
+    default_dark: bool = Field(alias="defaultDark")
+    default_card_rounded: bool = Field(alias="defaultCardRounded")
+    default_card_gradient: bool = Field(alias="defaultCardGradient")
+    default_card_shadow: bool = Field(alias="defaultCardShadow")
+    denomination: str | None = Field()
+    extensions: list[str] = Field()
+    allowed_currencies: list[str] = Field(alias="allowedCurrencies")
+    extensions_reviews_url: str = Field(alias="extensionsReviewsUrl")
+    ext_builder: bool = Field(alias="extBuilder")
+    nostr_configured: bool = Field(alias="nostrConfigured")
+    telegram_configured: bool = Field(alias="telegramConfigured")
+    wallet_featured_button_label: str | None = Field(alias="walletFeaturedButtonLabel")
+    wallet_featured_button_url: str | None = Field(alias="walletFeaturedButtonUrl")
+    wallet_featured_button_icon: str | None = Field(alias="walletFeaturedButtonIcon")
+    lnbits_user_activation_by_email: bool = Field(alias="userActivationByEmail")
+    lnbits_user_activation_by_payment: bool = Field(alias="userActivationByPayment")
+    lnbits_user_activation_by_invitation_code: bool = Field(
+        alias="userActivationByInvitationCode"
+    )
+    has_first_install_token: bool = Field(alias="hasFirstInstallToken")
+
+    @classmethod
+    def from_settings(cls, settings: Settings):
+        ads = [x.split(";") for x in settings.lnbits_ad_space.split(",")]
+        return cls(
+            adSpace=ads,
+            adSpaceTitle=settings.lnbits_ad_space_title,
+            showAdSpace=settings.lnbits_ad_space_enabled and len(ads) > 0,
+            allowRegister=settings.new_accounts_allowed,
+            qrLogo=settings.lnbits_qr_logo,
+            siteDescription=settings.lnbits_site_description,
+            siteTitle=settings.lnbits_site_title,
+            siteTagline=settings.lnbits_site_tagline,
+            authMethods=settings.auth_allowed_methods,
+            keycloakOrg=settings.keycloak_client_custom_org,
+            keycloakIcon=settings.keycloak_client_custom_icon,
+            oidcOrg=settings.oidc_client_custom_org,
+            oidcIcon=settings.oidc_client_custom_icon,
+            hasHoldinvoice=settings.has_holdinvoice,
+            hasNodemanager=settings.has_nodemanager,
+            showNodemanager=settings.lnbits_node_ui and settings.has_nodemanager,
+            customLogo=settings.lnbits_custom_logo,
+            showVoidwallet=settings.lnbits_backend_wallet_class == "VoidWallet",
+            version=settings.version,
+            showHomePageElements=settings.lnbits_show_home_page_elements,
+            hideApi=settings.lnbits_hide_api,
+            cacheKey=str(settings.server_startup_time),
+            webpushPubkey=settings.lnbits_webpush_pubkey,
+            showExtensions=not settings.lnbits_extensions_deactivate_all,
+            showAudit=settings.lnbits_audit_enabled,
+            showAdmin=settings.lnbits_admin_ui,
+            customImage=settings.lnbits_custom_image,
+            customBadge=settings.lnbits_custom_badge,
+            customBadgeColor=settings.lnbits_custom_badge_color,
+            serviceFee=settings.lnbits_service_fee,
+            serviceFeeMax=settings.lnbits_service_fee_max,
+            serviceFeeWallet=settings.lnbits_service_fee_wallet,
+            themeOptions=settings.lnbits_theme_options,
+            defaultReaction=settings.lnbits_default_reaction,
+            defaultTheme=settings.lnbits_default_theme,
+            defaultBorder=settings.lnbits_default_border,
+            defaultGradient=settings.lnbits_default_gradient,
+            defaultBgimage=settings.lnbits_default_bgimage,
+            defaultDark=settings.lnbits_default_dark,
+            defaultCardRounded=settings.lnbits_default_card_rounded,
+            defaultCardGradient=settings.lnbits_default_card_gradient,
+            defaultCardShadow=settings.lnbits_default_card_shadow,
+            denomination=settings.lnbits_denomination,
+            extensions=list(settings.lnbits_installed_extensions_ids),
+            allowedCurrencies=settings.lnbits_allowed_currencies,
+            extensionsReviewsUrl=settings.lnbits_extensions_reviews_url,
+            extBuilder=settings.lnbits_extensions_builder_activate_non_admins,
+            nostrConfigured=settings.is_nostr_notifications_configured(),
+            telegramConfigured=settings.is_telegram_notifications_configured(),
+            walletFeaturedButtonLabel=settings.lnbits_wallet_featured_button_label,
+            walletFeaturedButtonUrl=settings.lnbits_wallet_featured_button_url,
+            walletFeaturedButtonIcon=settings.lnbits_wallet_featured_button_icon,
+            userActivationByEmail=settings.lnbits_user_activation_by_email,
+            userActivationByPayment=settings.lnbits_user_activation_by_payment,
+            userActivationByInvitationCode=settings.lnbits_user_activation_by_invitation_code,
+            hasFirstInstallToken=settings.first_install_token is not None,
+        )
+
 
 class SuperSettings(EditableSettings):
     super_user: str

lnbits/static/css/base.css

@@ -220,6 +220,181 @@ body.body--dark .q-drawer {
   backdrop-filter: blur(6px) brightness(0.8);
 }
 
+body.rounded-ui .q-card,
+body.rounded-ui .q-btn {
+  border-radius: 10px;
+}
+
+body[data-theme=classic].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(103, 58, 183, 0.08), rgba(156, 39, 176, 0.06));
+}
+body[data-theme=classic].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(103, 58, 183, 0.06), rgba(156, 39, 176, 0.04));
+}
+
+body[data-theme=classic].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(38.6192771084, 42.356626506, 64.7807228916), rgba(103, 58, 183, 0.07));
+}
+body[data-theme=classic].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(36.7144578313, 40.2674698795, 61.5855421687), rgba(103, 58, 183, 0.05));
+}
+
+body[data-theme=bitcoin].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(234, 97, 29, 0.08), rgba(229, 111, 53, 0.06));
+}
+body[data-theme=bitcoin].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(234, 97, 29, 0.06), rgba(229, 111, 53, 0.04));
+}
+
+body[data-theme=bitcoin].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(54.18, 49.364, 71.036), rgba(234, 97, 29, 0.07));
+}
+body[data-theme=bitcoin].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(51.885, 47.273, 68.027), rgba(234, 97, 29, 0.05));
+}
+
+body[data-theme=freedom].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(226, 33, 86, 0.08), rgba(185, 26, 69, 0.06));
+}
+body[data-theme=freedom].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(226, 33, 86, 0.06), rgba(185, 26, 69, 0.04));
+}
+
+body[data-theme=freedom].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(82.2051282051, 55.1948717949, 63.4153846154), rgba(226, 33, 86, 0.07));
+}
+body[data-theme=freedom].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(79.1538461538, 53.1461538462, 61.0615384615), rgba(226, 33, 86, 0.05));
+}
+
+body[data-theme=cyber].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(124, 179, 66, 0.08), rgba(85, 139, 47, 0.06));
+}
+body[data-theme=cyber].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(124, 179, 66, 0.06), rgba(85, 139, 47, 0.04));
+}
+
+body[data-theme=cyber].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(10.2, 10.2, 10.2), rgba(124, 179, 66, 0.07));
+}
+body[data-theme=cyber].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(7.65, 7.65, 7.65), rgba(124, 179, 66, 0.05));
+}
+
+body[data-theme=mint].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(58, 183, 125, 0.08), rgba(39, 176, 101, 0.06));
+}
+body[data-theme=mint].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(58, 183, 125, 0.06), rgba(39, 176, 101, 0.04));
+}
+
+body[data-theme=mint].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(38.6192771084, 64.7807228916, 53.5686746988), rgba(58, 183, 125, 0.07));
+}
+body[data-theme=mint].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(36.7144578313, 61.5855421687, 50.9265060241), rgba(58, 183, 125, 0.05));
+}
+
+body[data-theme=autumn].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(183, 118, 58, 0.08), rgba(176, 121, 39, 0.06));
+}
+body[data-theme=autumn].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(183, 118, 58, 0.06), rgba(176, 121, 39, 0.04));
+}
+
+body[data-theme=autumn].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(64.7807228916, 51.0771084337, 38.6192771084), rgba(183, 118, 58, 0.07));
+}
+body[data-theme=autumn].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(61.5855421687, 48.5578313253, 36.7144578313), rgba(183, 118, 58, 0.05));
+}
+
+body[data-theme=flamingo].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(255, 0, 255, 0.08), rgba(253, 163, 253, 0.06));
+}
+body[data-theme=flamingo].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(255, 0, 255, 0.06), rgba(253, 163, 253, 0.04));
+}
+
+body[data-theme=flamingo].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(66.176, 4.224, 66.176), rgba(255, 0, 255, 0.07));
+}
+body[data-theme=flamingo].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(61.382, 3.918, 61.382), rgba(255, 0, 255, 0.05));
+}
+
+body[data-theme=monochrome].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(73, 73, 73, 0.08), rgba(107, 107, 107, 0.06));
+}
+body[data-theme=monochrome].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(73, 73, 73, 0.06), rgba(107, 107, 107, 0.04));
+}
+
+body[data-theme=monochrome].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(10.2, 10.2, 10.2), rgba(73, 73, 73, 0.07));
+}
+body[data-theme=monochrome].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(7.65, 7.65, 7.65), rgba(73, 73, 73, 0.05));
+}
+
+body[data-theme=salvador].card-gradient .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgba(25, 118, 210, 0.08), rgba(38, 166, 154, 0.06));
+}
+body[data-theme=salvador].card-gradient .q-drawer {
+  background-image: linear-gradient(165deg, rgba(25, 118, 210, 0.06), rgba(38, 166, 154, 0.04));
+}
+
+body[data-theme=salvador].card-gradient.body--dark .q-card:not(.q-dialog .q-card,
+.lnbits__dialog-card,
+.q-dialog-plugin--dark) {
+  background-image: linear-gradient(135deg, rgb(43.9888888889, 64.2, 84.4111111111), rgba(25, 118, 210, 0.07));
+}
+body[data-theme=salvador].card-gradient.body--dark .q-drawer {
+  background-image: linear-gradient(165deg, rgb(42.2416666667, 61.65, 81.0583333333), rgba(25, 118, 210, 0.05));
+}
+
+body.card-shadow .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
+  filter: drop-shadow(0 10px 24px rgba(0, 0, 0, 0.18));
+}
+
+body.card-shadow.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
+  filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
+}
+
 :root {
   --size: 100px;
   --gap: 25px;

lnbits/static/i18n/br.js

@@ -6,6 +6,7 @@ window.localisation.br = {
   funding: 'Financiamento',
   users: 'Usuários',
   audit: 'Auditoria',
+  api_watch: 'Relógio da API',
   apps: 'Aplicativos',
   channels: 'Canais',
   transactions: 'Transações',
@@ -21,13 +22,17 @@ window.localisation.br = {
   active_channels: 'Canais Ativos',
   connect_peer: 'Conectar Par',
   connect: 'Conectar',
+  reconnect: 'Reconectar',
   open_channel: 'Canal Aberto',
   open: 'Abrir',
+  clear: 'Limpar',
   close_channel: 'Fechar Canal',
   close: 'Fechar',
   restart: 'Reiniciar servidor',
+  image_library: 'Biblioteca de Imagens',
   save: 'Salvar',
   save_tooltip: 'Salvar suas alterações',
+  must_save: 'Você tem alterações não salvas',
   credit_debit: 'Crédito / Débito',
   credit_hint: 'Pressione Enter para creditar a conta',
   credit_label: '{denomination} para creditar',
@@ -46,24 +51,47 @@ window.localisation.br = {
   export_to_phone: 'Exportar para o telefone com código QR',
   export_to_phone_desc:
     'Este código QR contém a URL da sua carteira com acesso total. Você pode escaneá-lo do seu telefone para abrir sua carteira a partir dele.',
+  access_wallet_on_mobile: 'Acesso Móvel',
+  stored_paylinks: 'Links LNURL de pagamento armazenados',
   wallet: 'Carteira:',
+  wallet_name: 'Nome da carteira',
+  wallet_type: 'Tipo de carteira',
+  shared_wallet: 'Carteira Compartilhada',
+  share_wallet: 'Compartilhar Carteira',
+  update_permissions: 'Atualizar Permissões',
+  shared_wallet_id: 'ID da Carteira Compartilhada',
+  shared_wallet_desc:
+    'Você foi convidado(a) para ter acesso à carteira de outra pessoa.',
   wallets: 'Carteiras',
+  exclude_wallets: 'Excluir Carteiras',
   add_wallet: 'Adicionar nova carteira',
+  reject_wallet: 'Rejeitar carteira',
+  add_new_wallet: 'Adicionar uma nova carteira',
+  pin_wallet: 'Fixar carteira',
   delete_wallet: 'Excluir carteira',
   delete_wallet_desc:
     'Toda a carteira será excluída, os fundos serão IRRECUPERÁVEIS.',
   rename_wallet: 'Renomear carteira',
   update_name: 'Atualizar nome',
   fiat_tracking: 'Rastreamento Fiat',
+  fiat_providers: 'Provedores fiat',
+  fiat_warning_bitcoin:
+    'Provedores Fiat podem ficar nervosos com qualquer coisa relacionada ao bitcoin, portanto, evite usar a palavra "bitcoin" nos seus memorandos!',
   currency: 'Moeda',
   update_currency: 'Atualizar moeda',
   press_to_claim: 'Pressione para solicitar bitcoin',
+  claim_desc:
+    'Parece que você tem um valor resgatável de bitcoin, mas ainda não tem uma carteira. Pressione o botão abaixo para reivindicá-lo. Isso criará uma nova carteira para você.',
   donate: 'Doar',
   view_github: 'Ver no GitHub',
   voidwallet_active: 'VoidWallet está ativo! Pagamentos desabilitados',
-  use_with_caution: 'USE COM CAUTELA - a carteira {name} ainda está em BETA',
-  service_fee: 'Taxa de serviço: {amount} % por transação',
-  service_fee_max: 'Taxa de serviço: {amount} % por transação (máx {max} sats)',
+  voidwallet_active_user:
+    'Fonte de financiamento indisponível. Por favor, entre em contato com seu administrador para configurar.',
+  voidwallet_active_admin:
+    'Fonte de financiamento indisponível. Clique aqui para configurar.',
+  service_fee_badge: 'Taxa de serviço: {amount} % por transação',
+  service_fee_max_badge:
+    'Taxa de serviço: {amount} % por transação (máximo {max} {denom})',
   service_fee_tooltip:
     'Taxa de serviço cobrada pelo administrador do servidor LNbits por transação de saída',
   toggle_darkmode: 'Alternar modo escuro',
@@ -79,6 +107,7 @@ window.localisation.br = {
   create_invoice: 'Criar Fatura',
   camera_tooltip: 'Usar a câmara para escanear uma fatura / QR',
   export_csv: 'Exportar para CSV',
+  export_csv_details: 'Exportar para CSV com detalhes',
   chart_tooltip: 'Mostrar gráfico',
   pending: 'Pendente',
   copy_invoice: 'Copiar fatura',
@@ -86,15 +115,27 @@ window.localisation.br = {
   cancel: 'Cancelar',
   scan: 'Escanear',
   read: 'Ler',
+  write: 'Escrever',
   pay: 'Pagar',
   memo: 'Memo',
   date: 'Data',
+  path: 'Caminho',
+  internal_memo: 'Memorando interno (opcional)',
+  internal_memo_hint_receive:
+    'Este memorando não é mostrado ao pagador, mas é armazenado na fatura para sua referência.',
+  internal_memo_hint_pay:
+    'Este memorando não é exibido ao beneficiário, mas é armazenado no pagamento para sua referência.',
   payment_processing: 'Processando pagamento...',
+  payment_successful: 'Pagamento bem-sucedido!',
+  payment_pending: 'Pagamento pendente...',
+  payment_check: 'Cheque pagamento',
   not_enough_funds: 'Fundos insuficientes!',
   search_by_tag_memo_amount: 'Pesquisar por tag, memo, quantidade',
+  search: 'Buscar',
   invoice_waiting: 'Fatura aguardando pagamento',
   payment_received: 'Pagamento Recebido',
   payment_sent: 'Pagamento Enviado',
+  payment_failed: 'Pagamento Falhou',
   receive: 'receber',
   send: 'enviar',
   outgoing_payment_pending: 'Pagamento pendente de saída',
@@ -112,7 +153,10 @@ window.localisation.br = {
   extensions: 'Extensões',
   no_extensions: 'Você não possui nenhuma extensão instalada :(',
   created: 'Criado',
+  created_at: 'Criado em',
+  updated_at: 'Atualizado em',
   search_extensions: 'Extensões de pesquisa',
+  search_wallets: 'Pesquisar carteiras',
   extension_sources: 'Fontes de Extensão',
   ext_sources_hint: 'Repositórios de onde as extensões podem ser baixadas',
   ext_sources_label:
@@ -121,10 +165,13 @@ window.localisation.br = {
   repository: 'Repositório',
   confirm_continue: 'Você tem certeza de que deseja continuar?',
   manage_extension_details: 'Instalar/desinstalar extensão',
+  upload: 'Enviar',
   install: 'Instalar',
   uninstall: 'Desinstalar',
   drop_db: 'Remover Dados',
   enable: 'Ativar',
+  enabled: 'Habilitado',
+  disabled: 'Desativado',
   pay_to_enable: 'Pague para Habilitar',
   enable_extension_details: 'Ativar extensão para o usuário atual',
   disable: 'Desativar',
@@ -132,6 +179,8 @@ window.localisation.br = {
   installed: 'Instalado',
   activated: 'Ativado',
   deactivated: 'Desativado',
+  activate: 'Ativar',
+  deactivate: 'Desativar',
   release_notes: 'Notas de Lançamento',
   activate_extension_details:
     'Tornar a extensão disponível/indisponível para usuários',
@@ -139,8 +188,34 @@ window.localisation.br = {
   all: 'Tudo',
   only_admins_can_install:
     'Apenas contas de administrador podem instalar extensões.',
+  only_admins_can_create_extensions:
+    'Apenas contas de administrador podem criar extensões',
   admin_only: 'Apenas para Administração',
+  super_user_only: 'Apenas para superusuário',
+  make_user_admin: 'Tornar usuário administrador',
+  revoke_admin: 'Revogar Admin',
   new_version: 'Nova Versão',
+  reviews_url: 'URL de Avaliações',
+  reviews_url_label: 'URL do servidor de avaliações',
+  reviews_url_hint:
+    'URL completa do PaidReviews incluindo o id das configurações (por exemplo, https://example.com/paidreviews/SETTINGS_ID)',
+  reviews_open: 'Ver avaliações',
+  reviews_leave: 'Deixe uma avaliação',
+  reviews_name: 'Seu nome',
+  reviews_comment: 'Sua avaliação',
+  reviews_rating: 'Avaliação',
+  reviews_submit: 'Enviar avaliação',
+  reviews_loading: 'Carregando avaliações...',
+  reviews_refresh: 'Atualizar avaliações',
+  reviews_error_load: 'Não foi possível carregar as avaliações',
+  reviews_url_not_configured: 'URL de avaliações não configurada',
+  reviews_pay_invoice: 'Pagar fatura',
+  reviews_invoice_paid: 'Fatura paga',
+  reviews_invoice_title: 'Pague esta fatura para enviar sua avaliação',
+  reviews_count: 'Avaliações',
+  no_reviews: 'Ainda não há avaliações',
+  extension_has_free_release: 'Tem lançamentos gratuitos',
+  extension_has_paid_release: 'Tem lançamentos pagos',
   extension_depends_on: 'Depende de:',
   extension_rating_soon: 'Avaliações estarão disponíveis em breve',
   extension_installed_version: 'Versão instalada',
@@ -155,26 +230,122 @@ window.localisation.br = {
     'Esta versão requer no mínimo a versão do LNbits',
   min_version: 'Mínimo (incluído)',
   max_version: 'Máximo (excluído)',
+  preimage: 'Pré-imagem',
+  preimage_hint: 'Pré-imagem para liquidar a fatura de retenção',
+  hold_invoice: 'Reter Fatura',
+  hold_invoice_description:
+    'Esta fatura está em espera e requer uma pré-imagem para ser liquidada.',
   payment_hash: 'Hash de pagamento',
+  invoice_cancelled: 'Fatura Cancelada',
+  invoice_settled: 'Fatura Liquidada',
+  hold_invoice_payment_hash:
+    'Hash de pagamento para fatura em espera (opcional)',
+  settle_invoice: 'Liquidar Fatura',
+  cancel_invoice: 'Cancelar Fatura',
   fee: 'Taxa',
   amount: 'Quantidade',
+  amount_limits: 'Limites de Quantia',
   amount_sats: 'Quantidade (sats)',
+  faucest_wallet: 'Carteira de Torneira',
+  faucest_wallet_desc_1:
+    'Toda vez que um pagamento for confirmado pelo provedor {provider}, os fundos serão subtraídos desta carteira.',
+  faucest_wallet_desc_2:
+    'Isso ajuda a monitorar todos os pagamentos do {provider} e seu status.',
+  faucest_wallet_desc_3:
+    'Esta carteira deve ser recarregada com a quantia de sats que o administrador está disposto a oferecer em troca da moeda fiduciária.',
+  faucest_wallet_desc_4:
+    'Se esta carteira estiver configurada, mas estiver vazia, os pagamentos de {provider} não serão processados.',
+  faucest_wallet_desc_5:
+    'Esta carteira pode eventualmente ficar com saldo negativo se pagamentos fiduciários paralelos forem feitos.',
+  faucest_wallet_id: 'ID da Carteira de Torneira (opcional)',
+  faucest_wallet_id_hint:
+    'ID da carteira a ser usado para a torneira. Será usado para enviar os fundos ao usuário.',
   tag: 'Etiqueta',
   unit: 'Unidade',
   description: 'Descrição',
   expiry: 'Validade',
   webhook: 'Webhook',
+  webhook_url: 'URL do Webhook',
+  webhook_url_hint:
+    'URL de Webhook para enviar os detalhes do pagamento. Será chamada quando o pagamento for concluído.',
+  copy_webhook_url: 'Copiar URL do webhook',
+  webhook_events_list:
+    'Os seguintes eventos devem ser suportados pelo webhook:',
+  webhook_stripe_description:
+    'No lado do Stripe, você deve configurar um webhook com um URL que aponta para o seu servidor LNbits.',
   payment_proof: 'Comprovante de pagamento',
   update: 'Atualizar',
   update_available: 'Atualização {version} disponível!',
+  funding_sources: 'Fontes de Financiamento',
   latest_update: 'Você está na versão mais recente {version}.',
   notifications: 'Notificações',
-  no_notifications: 'Sem notificações',
-  notifications_disabled:
-    'As notificações de status do LNbits estão desativadas.',
-  enable_notifications: 'Ativar notificações',
-  enable_notifications_desc:
-    'Se ativado, ele buscará as últimas atualizações de status do LNbits, como incidentes de segurança e atualizações.',
+  notifications_configure: 'Configurar Notificações',
+  notifications_nostr_config: 'Configuração do Nostr',
+  notifications_enable_nostr: 'Ativar Nostr',
+  notifications_enable_nostr_desc: 'Enviar notificações pelo Nostr',
+  notifications_nostr_private_key: 'Chave Privada Nostr',
+  notifications_nostr_private_key_desc:
+    'Chave privada (hex ou nsec) para assinar as mensagens enviadas para Nostr',
+  notifications_nostr_identifier: 'Identificador Nostr',
+  notifications_nostr_identifier_desc:
+    'Identificador Nip5 para enviar notificações para',
+  notifications_nostr_identifiers: 'Identificadores Nostr',
+  notifications_nostr_identifiers_desc:
+    'Lista de identificadores para enviar notificações.',
+  notifications_telegram_config: 'Configuração do Telegram',
+  notifications_enable_telegram: 'Ativar Telegram',
+  notifications_enable_telegram_desc: 'Enviar notificações pelo Telegram',
+  notifications_telegram_access_token: 'Token de Acesso',
+  notifications_telegram_access_token_desc: 'Token de acesso para o bot',
+  notifications_chat_id: 'ID de bate-papo do Telegram',
+  notifications_chat_id_desc:
+    'ID do chat do Telegram para enviar as notificações para',
+  notifications_excluded_wallets_desc:
+    'Não envie notificações para essas carteiras',
+  notifications_email_config: 'Configuração de Email',
+  notifications_enable_email: 'Habilitar Email',
+  notifications_enable_email_desc: 'Enviar notificações por e-mail',
+  notifications_send_test_email: 'Enviar e-mail de teste',
+  notifications_send_email: 'Enviar e-mail',
+  notifications_send_email_desc: 'Email que você enviará de',
+  notifications_send_email_username: 'Nome de usuário',
+  notifications_send_email_username_desc:
+    'Nome de usuário, usará o e-mail se não estiver definido',
+  notifications_send_email_password: 'Enviar senha de e-mail',
+  notifications_send_email_password_desc:
+    'Senha para o e-mail que você enviará de',
+  notifications_send_email_server_port: 'Enviar e-mail porta SMTP',
+  notifications_send_email_server_port_desc: 'Porta para o servidor SMTP',
+  notifications_send_email_server: 'Enviar e-mail servidor SMTP',
+  notifications_send_email_server_desc:
+    'Servidor SMTP para o e-mail de que você enviará',
+  notifications_send_to_emails: 'Emails para enviar para',
+  notifications_send_to_emails_desc:
+    'Notificações de e-mails serão enviadas para',
+  notification_settings_update: 'Configurações atualizadas',
+  notification_settings_update_desc:
+    'Notificar quando as configurações do servidor forem atualizadas',
+  notification_server_start_stop: 'Iniciar/Parar Servidor',
+  notification_server_start_stop_desc:
+    'Notificar quando o servidor tiver sido iniciado/parado',
+  notification_watchdog_limit: 'Notificação de Limite do Watchdog',
+  notification_watchdog_limit_desc:
+    'Notifique quando o limite do watchdog for alcançado (não afeta a fonte de financiamento)',
+  notification_server_status: 'Status do Servidor',
+  notification_server_status_desc:
+    'Enviar notificações regulares sobre o status do servidor (valor do intervalo em horas)',
+  notification_incoming_payment: 'Pagamentos Recebidos',
+  notification_incoming_payment_desc:
+    'Notificar quando uma carteira tiver recebido um pagamento acima do valor especificado (sats)',
+  notification_outgoing_payment: 'Pagamentos Saída',
+  notification_outgoing_payment_desc:
+    'Notificar quando uma carteira tiver enviado um pagamento acima do valor especificado (sats)',
+  notification_credit_debit: 'Crédito / Débito',
+  notification_credit_debit_desc:
+    'Notificar quando uma carteira tiver sido creditada/debitada pelo superusuário',
+  notification_balance_delta_changed: 'Mudança no Delta de Saldo',
+  notification_balance_delta_changed_desc:
+    'Notifique quando a diferença entre o saldo do nó e o saldo do LNbits tiver mudado mais do que a quantidade especificada (em sats). Defina como 0 para desativar. Isso é executado a cada minuto.',
   enable_watchdog: 'Ativar Watchdog',
   enable_watchdog_desc:
     'Se ativado, ele mudará automaticamente sua fonte de financiamento para VoidWallet se o seu saldo for inferior ao saldo do LNbits. Você precisará ativar manualmente após uma atualização.',
@@ -189,6 +360,7 @@ window.localisation.br = {
   notification_source_label:
     'URL de origem (use apenas a fonte de status oficial do LNbits e fontes de confiança)',
   more: 'mais',
+  more_count: 'Mais {count}',
   less: 'menos',
   releases: 'Lançamentos',
   watchdog: 'Cão de guarda',
@@ -200,15 +372,24 @@ window.localisation.br = {
   allow_access_hint: 'Permitir acesso por IP (substituirá os IPs bloqueados)',
   enter_ip: 'Digite o IP e pressione enter',
   rate_limiter: 'Limitador de Taxa',
+  callback_url_rules: 'Regras de URL de Retorno',
+  enter_callback_url_rule: 'Digite a regra de URL como regex e pressione enter',
+  callback_url_rule_hint:
+    'URLs de retorno de chamada (como a de LNURL) serão validados conforme estas regras. Pelo menos uma regra deve corresponder. Nenhuma regra significa que todas as URLs são permitidas.',
   wallet_limiter: 'Limitador de Carteira',
+  wallet_config: 'Configuração da Carteira',
+  wallet_charts: 'Gráficos da Carteira',
   wallet_limit_max_withdraw_per_day:
     'Retirada máxima diária da carteira em sats (0 para desativar)',
   wallet_max_ballance: 'Saldo máximo da carteira em sats (0 para desativar)',
   wallet_limit_secs_between_trans:
     'Minutos e segundos entre transações por carteira (0 para desativar)',
+  only_incoming_payments_allowed: 'Apenas pagamentos recebidos são permitidos',
+  disable_outgoing_payments: 'Desativar pagamentos de saída',
   number_of_requests: 'Número de solicitações',
   time_unit: 'Unidade de tempo',
   minute: 'minuto',
+  settings: 'Configurações',
   second: 'segundo',
   hour: 'hora',
   disable_server_log: 'Desativar Log do Servidor',
@@ -219,49 +400,108 @@ window.localisation.br = {
   login_with_user_id: 'Faça login com ID do usuário',
   or: 'ou',
   create_new_wallet: 'Criar Nova Carteira',
+  delete_all_wallets: 'Excluir Todas as Carteiras',
+  confirm_delete_all_wallets:
+    'Tem certeza de que deseja excluir TODAS as carteiras deste usuário?',
   login_to_account: 'Faça login na sua conta',
   create_account: 'Criar conta',
   account_settings: 'Configurações da Conta',
+  signin_with_oauth: 'Entrar com',
+  signin_with_oauth_or: 'ou entre com',
   signin_with_nostr: 'Continuar com Nostr',
   signin_with_google: 'Entrar com o Google',
   signin_with_github: 'Entrar com GitHub',
-  signin_with_keycloak: 'Entrar com Keycloak',
+  signin_with_custom_org: 'Entrar com {custom_org}',
   username_or_email: 'Nome de usuário ou E-mail',
   password: 'Senha',
   password_config: 'Configuração de Senha',
   password_repeat: 'Repetição de senha',
+  update_password: 'Atualizar Senha',
   change_password: 'Alterar Senha',
   update_credentials: 'Atualizar credenciais',
   update_pubkey: 'Atualizar Chave Pública',
+  nostr_pubkey_tooltip:
+    'Insira a chave pública Nostr deste usuário (valor hexadecimal)',
   set_password: 'Definir Senha',
+  set_password_tooltip: 'Defina uma senha para este usuário',
   invalid_password: 'A senha deve ter pelo menos 8 caracteres',
+  invalid_password_repeat: 'As senhas não coincidem',
+  reset_key_generated: 'Uma chave de reinicialização foi gerada.',
+  reset_key_copy:
+    'Clique em OK para copiar o URL de redefinição para sua área de transferência.',
   login: 'Entrar',
   register: 'Registrar',
   username: 'Nome de usuário',
   pubkey: 'Chave Pública',
   user_id: 'ID do Usuário',
+  id: 'ID',
   email: 'E-mail',
   first_name: 'Primeiro Nome',
   last_name: 'Sobrenome',
   picture: 'Foto',
+  user_picture_desc:
+    'URL para uma imagem a ser usada como foto de perfil. Você pode carregá-la como um ativo.',
   verify_email: 'Verifique o e-mail com',
   account: 'Conta',
   update_account: 'Atualizar Conta',
   invalid_username: 'Nome de usuário inválido',
   auth_provider: 'Provedor de Autenticação',
+  external_id: 'ID Externo',
   my_account: 'Minha Conta',
+  existing_account_question: 'Já tem uma conta?',
+  background_image: 'Imagem de Fundo',
   back: 'Voltar',
   logout: 'Sair',
   look_and_feel: 'Aparência',
+  endpoint: 'Ponto de extremidade',
+  api: 'API',
+  api_stripe: 'API',
+  api_token: 'Token de API',
+  api_tokens: 'Tokens da API',
+  access_control_list: 'Lista de Controle de Acesso',
+  access_control_list_admin_warning:
+    'Esta é uma conta de administrador. Os tokens gerados terão privilégios de administrador.',
+  new_api_acl: 'Nova Lista de Controle de Acesso',
+  api_token_id: 'Id do Token',
   toggle_gradient: 'Alternar Gradiente',
   gradient_background: 'Fundo em Degradê',
+  rounded_ui: 'Cartões e Botões Arredondados',
+  toggle_rounded_ui: 'Alternar cantos arredondados para cartões e botões',
+  card_gradient: 'Gradiente do Cartão',
+  toggle_card_gradient: 'Alternar gradiente nos cartões',
+  card_shadow: 'Sombra do Cartão',
+  toggle_card_shadow: 'Alternar sombra nas cartas',
   language: 'Idioma',
+  assets: 'Ativos',
+  max_asset_size_mb: 'Tamanho Máximo do Ativo (MB)',
+  max_asset_size_mb_desc:
+    'O tamanho máximo permitido para uploads de ativos em megabytes (pode usar valores decimais).',
+  assets_allowed_mime_types: 'Tipos MIME permitidos',
+  assets_allowed_mime_types_desc:
+    'Os tipos MIME permitidos para uploads de ativos. Nenhum valor significa que todos os uploads são permitidos.',
+  thumbnail_width: 'Largura da Miniatura',
+  thumbnail_width_desc: 'Largura da miniatura gerada em pixels.',
+  thumbnail_height: 'Altura da miniatura',
+  thumbnail_height_desc: 'Altura da miniatura gerada em pixels.',
+  thumbnail_format: 'Formato da Miniatura',
+  thumbnail_format_desc:
+    'Formato de imagem da miniatura gerada (PNG, JPEG, etc.).',
+  max_assets_per_user: 'Máximo de ativos por usuário',
+  max_assets_per_user_desc:
+    'O número máximo de ativos que um usuário pode fazer upload. Zero significa que o upload está proibido.',
+  assets_no_limit_users: 'Usuários sem Limites de Ativos',
+  assets_no_limit_users_desc:
+    'Esses usuários podem enviar um número ilimitado de ativos (com base no ID do usuário).',
   color_scheme: 'Esquema de Cores',
+  visible_wallet_count: 'Contagem de Carteiras Visíveis',
   admin_settings: 'Configurações do Administrador',
   extension_cost: 'Este lançamento requer um pagamento mínimo de {cost} sats.',
   extension_paid_sats: 'Você já pagou {paid_sats} sats.',
+  create_extension: 'Criar Extensão',
   release_details_error: 'Não é possível obter os detalhes da versão.',
   pay_from_wallet: 'Pagar com a Carteira',
+  pay_with: 'Pague com {provider}',
+  select_payment_provider: 'Selecione o provedor de pagamento',
   wallet_required: 'Carteira *',
   show_qr: 'Exibir QR',
   retry_install: 'Repetir Instalação',
@@ -274,6 +514,9 @@ window.localisation.br = {
     'A extensão {name} requer um pagamento mínimo de {amount} sats para habilitar.',
   hide_empty_wallets: 'Ocultar carteiras vazias',
   recheck: 'Verificar novamente',
+  check: 'Verificar',
+  check_connection: 'Verificar Conexão',
+  check_webhook: 'Verificar Webhook',
   contributors: 'Contribuidores',
   license: 'Licença',
   reset_key: 'Redefinir Chave',
@@ -286,6 +529,7 @@ window.localisation.br = {
   hash: 'Hash:',
   welcome_lnbits: 'Bem-vindo ao LNbits',
   setup_su_account: 'Configure a conta Superuser abaixo.',
+  first_install_token: 'Primeiro Token de Instalação',
   create_ticker_converter: 'Criar Conversor de Ticker de Moeda',
   enable_audit: 'Habilitar Auditoria',
   recommended: 'Recomendado',
@@ -326,9 +570,16 @@ window.localisation.br = {
   user_default_extensions_label: 'Extensões do usuário',
   user_default_extensions_hint:
     'Extensões que serão ativadas por padrão para os usuários.',
+  extension_builder: 'Construtor de Extensão',
+  extension_builder_manifest_url: 'URL do Manifesto do Criador de Extensões',
+  extension_builder_manifest_url_hint:
+    'URL para um arquivo JSON manifest com detalhes do extension builder',
   miscellanous: 'Diversos',
   misc_disable_extensions: 'Desativar extensões',
   misc_disable_extensions_label: 'Desativar todas as extensões',
+  misc_disable_extensions_builder: 'Habilitar Extensions Builder',
+  misc_disable_extensions_builder_label:
+    'Habilitar Extensions Builder para usuários não administradores.',
   misc_hide_api: 'Ocultar API',
   misc_hide_api_label:
     'Oculta a API de carteira, extensões podem optar por honrar',
@@ -346,16 +597,33 @@ window.localisation.br = {
   toggle_transactions_node_ui:
     'Guia de Transações (Desativar em nós grandes CLN)',
   invoice_expiry: 'Expiração da Fatura',
-  invoice_expiry_label: 'Validade da fatura (segundos)',
-  fee_reserve: 'Reserva de Taxa',
-  fee_reserve_msats: 'Taxa de reserva em msats',
-  fee_reserve_percent: 'Taxa de reserva em porcentagem',
+  invoice_expiry_label: 'Validade da fatura',
+  routing_fee_reserve_calculations: 'Cálculos de Reserva de Taxa de Roteamento',
+  routing_fee_reserve_calculations_desc:
+    'LNbits reserva um "valor de reserva" para cada pagamento para cobrir as taxas de roteamento. A taxa de roteamento máxima passada para a fonte de financiamento é a que for maior: a <strong>reserva mínima de taxa de roteamento</strong> ou a <strong>percentagem de reserva de taxa de roteamento</strong>.',
+  millisats: 'milissats',
+  fee_reserve: 'Reserva Mínima de Taxa de Encaminhamento',
+  fee_reserve_percent: 'Porcentagem da Reserva de Taxa de Roteamento',
+  fee_reserve_min_hint:
+    'A taxa mínima reservada por pagamento.<br>Isso atua como um piso - a taxa de roteamento máxima nunca será inferior a este valor, independentemente do tamanho do pagamento.',
+  fee_reserve_percent_hint:
+    'A porcentagem do valor do pagamento a reservar para taxas de roteamento.',
+  payment_timeouts: 'Tempos de Espera de Pagamento',
+  payment_wait_time: 'Tempo de Espera do Pagamento',
+  seconds: 'segundos',
+  payment_wait_time_desc:
+    'Tempo de espera antes de marcar um pagamento de saída como pendente. Padrão: 5s; aumentar para faturas de liquidação lenta.',
+  payment_wait_time_tooltip:
+    'Controla quanto tempo o LNbits espera para uma tentativa de pagamento de saída ser confirmada antes de marcá-la como pendente. Valores mais altos ajudam ao pagar faturas de liquidação lenta (por exemplo, faturas HODL, Boltz). O pagamento será verificado novamente mais tarde e atualizado automaticamente ou manualmente.',
   server_management: 'Gerenciamento de Servidor',
   base_url: 'URL base',
   base_url_label: 'URL estática/base para o servidor',
   authentication: 'Autenticação',
   auth_token_expiry_label: 'Minutos para expiração do token',
   auth_token_expiry_hint: 'Tempo em minutos até o token expirar',
+  auth_authentication_cache_label: 'Tempo de cache (minutos)',
+  auth_authentication_cache_hint:
+    'Tempo em minutos para armazenar em cache a autenticação bem-sucedida (0 para desativar)',
   auth_allowed_methods_label: 'Métodos de autorização permitidos',
   auth_allowed_methods_hint: 'Selecione métodos de autorização',
   auth_nostr_label: 'URL de Solicitação Nostr',
@@ -373,13 +641,36 @@ window.localisation.br = {
   auth_keycloak_ci_hint:
     'Certifique-se de que a URL de retorno de chamada de autorização esteja definida para https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Segredo do Cliente Keycloak',
+  auth_keycloak_custom_org_label: 'Organização Personalizada do Keycloak',
+  auth_keycloak_custom_icon_label: 'Ícone Personalizado do Keycloak (URL)',
+  auth_oidc_label: 'URL de Descoberta do OIDC',
+  auth_oidc_ci_label: 'ID do Cliente OIDC',
+  auth_oidc_ci_hint:
+    'Certifique-se de que a URL de retorno de chamada de autorização esteja definida para https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'Segredo do Cliente OIDC',
+  auth_oidc_custom_org_label:
+    'Nome da Organização Personalizada OIDC (ex. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Ícone Personalizado do OIDC (URL)',
+  auth_keycloak_custom_org_label: 'Keycloak Custom Organization',
+  auth_keycloak_custom_icon_label: 'Ícone Personalizado do Keycloak (URL)',
   currency_settings: 'Configurações de Moeda',
   allowed_currencies: 'Moedas Permitidas',
   allowed_currencies_hint: 'Limite o número de moedas fiduciárias disponíveis',
   default_account_currency: 'Moeda Padrão da Conta',
   default_account_currency_hint: 'Moeda padrão para contabilidade',
+  min_incoming_payment_amount: 'Quantia Mínima de Pagamento de Entrada',
+  min_incoming_payment_amount_desc:
+    'Quantidade mínima permitida para gerar uma fatura',
+  max_incoming_payment_amount: 'Valor Máximo do Pagamento Recebido',
+  max_incoming_payment_amount_desc:
+    'Quantidade máxima permitida para gerar uma fatura',
+  max_outgoing_payment_amount: 'Valor Máximo de Pagamento de Saída',
+  max_outgoing_payment_amount_desc:
+    'Valor máximo permitido para efetuar um pagamento',
+  service_fee: 'Taxa de serviço: {amount} % por transação',
   service_fee_label: 'Taxa de serviço (%)',
   service_fee_hint: 'Taxa cobrada por tx (%)',
+  service_fee_max: 'Taxa de serviço: {amount} % por transação (máx {max} sats)',
   service_fee_max_label: 'Taxa de serviço máx (sats)',
   service_fee_max_hint: 'Taxa máxima de serviço a cobrar em (sats)',
   fee_wallet: 'Carteira de Taxas',
@@ -391,6 +682,8 @@ window.localisation.br = {
     'Desativar Taxa de Serviço para Pagamentos Internos Lightning',
   ui_management: 'Gerenciamento de UI',
   ui_site_title: 'Título do Site',
+  ui_changing_remove_lnbits_elements:
+    '(alterar removerá os elementos LNbits na página inicial e rodapé)',
   ui_site_tagline: 'Tagline do site',
   ui_elements_enable: 'Habilitar elementos na página inicial',
   ui_elements_disable: 'Desativar elementos na página inicial',
@@ -399,11 +692,27 @@ window.localisation.br = {
   ui_site_description: 'Descrição do Site',
   ui_site_description_hint: 'Use texto simples, Markdown ou HTML bruto',
   ui_default_wallet_name: 'Nome Padrão da Carteira',
+  ui_default_theme: 'Tema Padrão',
+  wallet_featured_button_label: 'Carteira Rótulo do Botão em Destaque',
+  wallet_featured_button_label_hint:
+    'Mostrar botão em destaque na página inicial da carteira',
+  wallet_featured_button_url: 'URL do Botão em Destaque',
+  wallet_featured_button_url_hint:
+    'Ao clicar, o botão abrirá este URL. Deixe em branco para ocultar o botão.',
+  wallet_featured_button_icon: 'Ícone do Botão em Destaque',
+  wallet_featured_button_icon_hint:
+    'Ícone mostrado no botão de destaque (verifique os ícones quasar)',
   lnbits_wallet: 'Carteira LNbits',
   denomination: 'Denominação',
   denomination_hint: 'O nome para o token FakeWallet',
+  denomination_error: 'A denominação deve ter 3 caracteres ou `sats`.',
   ui_qr_code_logo: 'Logo do QR Code',
   ui_qr_code_logo_hint: 'URL para imagem de logo no código QR',
+  ui_apple_touch_icon: 'Ícone de Toque da Apple',
+  ui_apple_touch_icon_hint: 'URL do ícone de toque da Apple',
+  ui_custom_image: 'Imagem Personalizada',
+  ui_custom_image_label: 'URL para imagem personalizada',
+  ui_custom_image_hint: 'Imagem exibida na página inicial/login',
   ui_custom_badge: 'Distintivo Personalizado',
   ui_custom_badge_label:
     "Distintivo Personalizado 'USE COM CUIDADO - a carteira LNbits ainda está em BETA'",
@@ -426,14 +735,95 @@ window.localisation.br = {
   admin_users_label: 'ID do Usuário',
   allowed_users: 'Usuários Permitidos',
   allowed_users_hint: 'Somente esses usuários podem usar o LNbits',
+  allowed_users_hint_feature: 'Somente estes usuários podem usar {feature}',
   allowed_users_label: 'ID do Usuário',
   allow_creation_user: 'Permitir a criação de novos usuários',
   allow_creation_user_desc:
     'Permitir a criação de novos usuários na página de índice',
+  require_user_activation: 'Requer ativação do usuário',
+  require_user_activation_desc:
+    'Novos usuários serão ativados somente após passarem por um dos métodos de confirmação. Administradores podem ativar usuários manualmente a partir do painel de administração.',
+  reusable_activation_code: 'Código de ativação reutilizável',
+  reusable_activation_code_label: 'Código de ativação reutilizável',
+  reusable_activation_code_hint:
+    'Este código de ativação pode ser usado várias vezes por diferentes usuários.',
+  one_time_activation_code: 'Códigos de ativação única',
+  one_time_activation_code_label: 'Adicionar código de ativação',
+  one_time_activation_code_hint:
+    'Lista de códigos de ativação únicos. Cada código pode ser usado apenas uma vez, depois será removido da lista.',
+  invitation_code: 'Código de Convite',
+  invitation_code_hint: 'O código de convite que você recebeu.',
+  email_confirmation_hint:
+    'Endereço de e-mail para enviar o código de confirmação.',
+  nostr_identifier: 'Identificador Nostr',
+  nostr_identifier_hint:
+    'Identificador nostr nip5 ou <npub> para enviar o código de confirmação.',
+  new_user_not_allowed: 'O registro está desativado.',
+  start_user_impersonation: 'Personificar este usuário',
+  stop_user_impersonation: 'Parar a Personificação do Usuário',
   components: 'Componentes',
   long_running_endpoints: 'Top 5 Endpoints de Longa Execução',
   http_request_methods: 'Métodos de Requisição HTTP',
   http_response_codes: 'Códigos de Resposta HTTP',
   request_details: 'Detalhes do Pedido',
-  http_request_details: 'Detalhes da Requisição HTTP'
+  http_request_details: 'Detalhes da Requisição HTTP',
+  payment_details: 'Detalhes do Pagamento',
+  payment_details_desc: 'Informações detalhadas sobre o pagamento',
+  payments: 'Pagamentos',
+  payment_show_internal: 'Mostrar Pagamentos Internos',
+  payment_chart_flow: 'Fluxo de Pagamento Mensal',
+  payment_chart_status: 'Status do Pagamento',
+  payment_chart_tx_per_wallet: 'Transações por Carteira (saldo/contagem)',
+  payment_details_back: 'Voltar para Pagamentos',
+  payment_chart_tags: 'Pagamentos por Tags',
+  payments_balance_in_out: 'Entradas/Saídas de Saldo',
+  payments_count_in_out: 'Contar Entrada/Saída',
+  payments_status_chart: 'Gráfico de Status',
+  payments_tag_chart: 'Gráfico de Marcadores',
+  payments_balance_chart: 'Gráfico de Saldo',
+  payments_wallets_chart: 'Gráfico de Carteiras',
+  payments_balance_in_out_chart: 'Gráfico de Entrada/Saída de Saldo',
+  payments_count_in_out_chart: 'Gráfico de Entrada/Saída',
+  reset_wallet_keys: 'Redefinir Chaves',
+  reset_wallet_keys_desc:
+    'Redefina as chaves de API para esta carteira. Isso invalidará as chaves atuais e gerará novas.',
+  view_list: 'Visualizar carteiras como lista',
+  view_column: 'Visualizar carteiras como linhas',
+  filter_payments: 'Filtrar pagamentos',
+  filter_labels: 'Rótulos de filtro',
+  filter_date: 'Filtrar por data',
+  websocket_example: 'Exemplo de Websocket',
+  client_id: 'ID do Cliente',
+  secret_key: 'Chave Secreta',
+  signing_secret: 'Segredo de Assinatura',
+  signing_secret_hint:
+    'Segredo de assinatura para o webhook. As mensagens serão assinadas com este segredo.',
+  webhook_id: 'ID do Webhook',
+  webhook_id_hint:
+    'ID do webhook do PayPal usado para verificar eventos recebidos.',
+  webhook_paypal_description:
+    'No lado do PayPal, configure um webhook apontando para o seu servidor LNbits.',
+  callback_success_url: 'URL de Sucesso de Callback',
+  callback_success_url_hint:
+    'O usuário será redirecionado para este URL após o pagamento ser bem-sucedido.',
+  connected: 'Conectado',
+  not_connected: 'Não Conectado',
+  free: 'Grátis',
+  paid: 'Pago',
+  funding_source_retries: 'Máximo de tentativas',
+  funding_source_retries_desc:
+    'Número máximo de tentativas para fontes de financiamento, antes de voltar para VoidWallet.',
+  add_label: 'Adicionar Rótulo',
+  label: 'Etiqueta',
+  labels: 'Rótulos',
+  label_filter: 'Filtro de Rótulo',
+  no_labels_defined: 'Ainda não há rótulos definidos',
+  manage_labels: 'Gerenciar Etiquetas',
+  update_label: 'Atualizar Rótulo',
+  delete_label: 'Excluir Rótulo',
+  add_remove_labels: 'Adicionar ou Remover Rótulos',
+  payment_labels_updated: 'Rótulos de pagamento atualizados',
+  color: 'Cor',
+  sort: 'Ordenar',
+  sort_by: 'Ordenar por'
 }

lnbits/static/i18n/cn.js

@@ -135,6 +135,7 @@ window.localisation.cn = {
   all: '全部',
   only_admins_can_install: '（只有管理员账户可以安装扩展）',
   admin_only: '仅限管理员',
+  super_user_only: '仅限超级用户',
   new_version: '新版本',
   extension_depends_on: '依赖于:',
   extension_rating_soon: '即将推出评分',
@@ -353,6 +354,15 @@ window.localisation.cn = {
   auth_keycloak_ci_hint:
     '确保授权回调URL设置为https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Keycloak客户端密钥',
+  auth_keycloak_custom_org_label: 'Keycloak 自定义组织',
+  auth_keycloak_custom_icon_label: 'Keycloak 自定义图标 (URL)',
+  auth_oidc_label: 'OIDC 发现 URL',
+  auth_oidc_ci_label: 'OIDC 客户端 ID',
+  auth_oidc_ci_hint:
+    '确保授权回调URL设置为https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'OIDC客户端密钥',
+  auth_oidc_custom_org_label: 'OIDC 自定义组织名称（例如 Zitadel、Authentik）',
+  auth_oidc_custom_icon_label: 'OIDC 自定义图标 (URL)',
   currency_settings: '货币设置',
   allowed_currencies: '允许的货币',
   allowed_currencies_hint: '限制可用法定货币的数量',

lnbits/static/i18n/cs.js

@@ -140,6 +140,7 @@ window.localisation.cs = {
   only_admins_can_install:
     '(Pouze administrátorské účty mohou instalovat rozšíření)',
   admin_only: 'Pouze pro adminy',
+  super_user_only: 'Pouze pro superuživatele',
   new_version: 'Nová verze',
   extension_depends_on: 'Závisí na:',
   extension_rating_soon: 'Hodnocení brzy dostupné',
@@ -367,6 +368,16 @@ window.localisation.cs = {
   auth_keycloak_ci_hint:
     'Ujistěte se, že je autorizace callback URL nastavena na https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Klíč k aplikaci Keycloak tajemství',
+  auth_keycloak_custom_org_label: 'Vlastní organizace Keycloak',
+  auth_keycloak_custom_icon_label: 'Vlastní ikona Keycloak (URL)',
+  auth_oidc_label: 'URL pro zjištění OIDC',
+  auth_oidc_ci_label: 'ID klienta OIDC',
+  auth_oidc_ci_hint:
+    'Ujistěte se, že je autorizace callback URL nastavena na https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'Klíč k aplikaci OIDC tajemství',
+  auth_oidc_custom_org_label:
+    'Název vlastní organizace OIDC (např. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Vlastní ikona OIDC (URL)',
   currency_settings: 'Nastavení měny',
   allowed_currencies: 'Povolené měny',
   allowed_currencies_hint: 'Omezte počet dostupných fiat měn',

lnbits/static/i18n/de.js

@@ -143,6 +143,7 @@ window.localisation.de = {
   only_admins_can_install:
     '(Nur Administratorkonten können Erweiterungen installieren)',
   admin_only: 'Nur für Admins',
+  super_user_only: 'Nur für Superuser',
   new_version: 'Neue Version',
   extension_depends_on: 'Hängt ab von:',
   extension_rating_soon: 'Bewertungen sind bald verfügbar',
@@ -377,6 +378,16 @@ window.localisation.de = {
   auth_keycloak_ci_hint:
     'Stellen Sie sicher, dass die Autorisierungs-Callback-URL auf https://{domain}/api/v1/auth/keycloak/token eingestellt ist.',
   auth_keycloak_cs_label: 'Keycloak-Client-Geheimnis',
+  auth_keycloak_custom_org_label: 'Keycloak Benutzerdefinierte Organisation',
+  auth_keycloak_custom_icon_label: 'Keycloak Benutzerdefiniertes Symbol (URL)',
+  auth_oidc_label: 'OIDC Discovery-URL',
+  auth_oidc_ci_label: 'OIDC-Client-ID',
+  auth_oidc_ci_hint:
+    'Stellen Sie sicher, dass die Autorisierungs-Callback-URL auf https://{domain}/api/v1/auth/oidc/token eingestellt ist.',
+  auth_oidc_cs_label: 'OIDC-Client-Geheimnis',
+  auth_oidc_custom_org_label:
+    'OIDC Benutzerdefinierter Organisationsname (z.B. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'OIDC Benutzerdefiniertes Symbol (URL)',
   currency_settings: 'Währungseinstellungen',
   allowed_currencies: 'Erlaubte Währungen',
   allowed_currencies_hint:

lnbits/static/i18n/en.js

@@ -6,7 +6,7 @@ window.localisation.en = {
   funding: 'Funding',
   users: 'Users',
   audit: 'Audit',
-  api_watch: 'Api Watch',
+  api_watch: 'API Watch',
   apps: 'Apps',
   channels: 'Channels',
   transactions: 'Transactions',
@@ -171,6 +171,7 @@ window.localisation.en = {
   drop_db: 'Remove Data',
   enable: 'Enable',
   enabled: 'Enabled',
+  disabled: 'Disabled',
   pay_to_enable: 'Pay To Enable',
   enable_extension_details: 'Enable extension for current user',
   disable: 'Disable',
@@ -178,6 +179,8 @@ window.localisation.en = {
   installed: 'Installed',
   activated: 'Activated',
   deactivated: 'Deactivated',
+  activate: 'Activate',
+  deactivate: 'Deactivate',
   release_notes: 'Release Notes',
   activate_extension_details: 'Make extension available/unavailable for users',
   featured: 'Featured',
@@ -186,6 +189,9 @@ window.localisation.en = {
   only_admins_can_create_extensions:
     'Only admin accounts can create extensions',
   admin_only: 'Admin Only',
+  super_user_only: 'Super User Only',
+  make_user_admin: 'Make User Admin',
+  revoke_admin: 'Revoke Admin',
   new_version: 'New Version',
   reviews_url: 'Reviews URL',
   reviews_url_label: 'Reviews server URL',
@@ -266,12 +272,18 @@ window.localisation.en = {
   update: 'Update',
   update_available: 'Update {version} available!',
   funding_sources: 'Funding Sources',
+  funding_source: 'Funding Source',
+  requires_server_restart:
+    'Changing these settings requires a server restart to take effect.',
+  funding_source_info: 'Select the active funding wallet',
+  phoenixd_warning:
+    "Phoenixd mnemonic is only available if phoenixd data-dir is specified and is readable by LNbits. It's not indicative of phoenixd not running. It just means LNbits cannot access the mnemonic to display it here.",
   latest_update: 'You are on the latest version {version}.',
   notifications: 'Notifications',
   notifications_configure: 'Configure Notifications',
   notifications_nostr_config: 'Nostr Configuration',
   notifications_enable_nostr: 'Enable Nostr',
-  notifications_enable_nostr_desc: 'Send notfications over Nostr',
+  notifications_enable_nostr_desc: 'Send notifications over Nostr',
   notifications_nostr_private_key: 'Nostr Private Key',
   notifications_nostr_private_key_desc:
     'Private key (hex or nsec) to sign the messages sent to Nostr',
@@ -280,11 +292,11 @@ window.localisation.en = {
     'Nip5 identifier to send notifications to',
   notifications_nostr_identifiers: 'Nostr Identifiers',
   notifications_nostr_identifiers_desc:
-    'List of identifiers to send notifications to',
+    'List of identifiers to send notifications to.',
 
   notifications_telegram_config: 'Telegram Configuration',
   notifications_enable_telegram: 'Enable Telegram',
-  notifications_enable_telegram_desc: 'Send notfications over Telegram',
+  notifications_enable_telegram_desc: 'Send notifications over Telegram',
   notifications_telegram_access_token: 'Access Token',
   notifications_telegram_access_token_desc: 'Access token for the bot',
   notifications_chat_id: 'Telegram Chat ID',
@@ -313,15 +325,15 @@ window.localisation.en = {
 
   notification_settings_update: 'Settings updated',
   notification_settings_update_desc:
-    'Notify when server settings have been updated',
+    'Send a notification when server settings have been updated',
 
   notification_server_start_stop: 'Server Start/Stop',
   notification_server_start_stop_desc:
-    'Notify when the server has been started/stopped',
+    'Send a notification when the server has been started/stopped',
 
   notification_watchdog_limit: 'Watchdog Limit Notification',
   notification_watchdog_limit_desc:
-    'Notify when the watchdog limit has been reached (does not affect the funding source)',
+    'Send a notification when the watchdog limit has been reached (does not affect the funding source)',
 
   notification_server_status: 'Server Status',
   notification_server_status_desc:
@@ -329,29 +341,31 @@ window.localisation.en = {
 
   notification_incoming_payment: 'Incoming Payments',
   notification_incoming_payment_desc:
-    'Notify when a wallet has received a payment above the specified amount (sats)',
+    'Send a notification when a wallet has received a payment above the specified amount (sats)',
 
   notification_outgoing_payment: 'Outgoing Payments',
   notification_outgoing_payment_desc:
-    'Notify when a wallet has sent a payment above the specified amount (sats)',
+    'Send a notification when a wallet has sent a payment above the specified amount (sats)',
 
   notification_credit_debit: 'Credit / Debit',
   notification_credit_debit_desc:
-    'Notify when a wallet has been credited/debited by the superuser',
+    'Send a notification when a wallet has been credited/debited by the superuser',
 
   notification_balance_delta_changed: 'Balance Delta Changed',
   notification_balance_delta_changed_desc:
-    'Notify when the difference between the node balance and the LNbits balance has changed by more than the specified amount (in sats). Set to 0 to disable. This runs every minute.',
+    'Send a notification when the difference between the node balance and the LNbits balance has changed by more than the specified amount (in sats). Set to 0 to disable. This runs every minute.',
 
-  enable_watchdog: 'Enable Watchdog Switch',
+  watchdog_introduction:
+    "Watchdog is a feature that allows you to automatically switch the LNbits funding source to VoidWallet if your node balance is lower than the LNbits balance by a certain threshold. This can help prevent overspending and keep your node's funds safe.",
+  enable_watchdog: 'Enable Watchdog',
   enable_watchdog_desc:
-    'If enabled it will change your funding source to VoidWallet automatically if your balance is lower than the LNbits balance. You will need to enable manually after an update.',
-  watchdog_interval: 'Watchdog Interval',
+    'You will need to re-enable this manually after an update.',
+  watchdog_interval: 'Watchdog Check Interval',
   watchdog_interval_desc:
-    'How often the background task should check for a killswitch signal in the watchdog delta [node_balance - lnbits_balance] (in minutes).',
-  watchdog_delta: 'Watchdog Delta',
+    'How often LNbits should check for a killswitch signal in the watchdog threshold delta value [node_balance - lnbits_balance] (in minutes).',
+  watchdog_delta: 'Watchdog Threshold Delta',
   watchdog_delta_desc:
-    'Limit before killswitch changes funding source to VoidWallet [lnbits_balance - node_balance > delta]',
+    "The LNbit's > Node balance delta threshold.  If this threshold is exceeded, the funding source is changed to VoidWallet.",
   status: 'Status',
   notification_source: 'Notification Source',
   notification_source_label:
@@ -362,24 +376,12 @@ window.localisation.en = {
   releases: 'Releases',
   watchdog: 'Watchdog',
   server_logs: 'Server Logs',
-  ip_blocker: 'IP Blocker',
-  route_access_control: 'Route Access Control',
-  route_access_control_enable: 'Enable route access control',
-  route_access_control_hint:
-    'When enabled, non-local requests are restricted. Requests from 127.0.0.1 (and ::1) are always allowed.',
-  route_access_whitelist_label: 'Route Whitelist',
-  route_access_whitelist_hint:
-    'Only allow non-local access to these routes (leave empty to disable whitelist mode).',
-  route_access_blacklist_label: 'Route Blacklist',
-  route_access_blacklist_hint:
-    'Block non-local access to these routes (ignored when a whitelist is set).',
-  route_access_save_confirm:
-    'Are you sure you want to save? This can impact access to LNbits if you are not accessing locally.',
+  ip_blocker: 'IP Blacklist/Whitelist',
   security: 'Security',
-  security_tools: 'Security tools',
+  security_tools: 'Security Tools',
   block_access_hint: 'Block access by IP',
   allow_access_hint: 'Allow access by IP (will override blocked IPs)',
-  enter_ip: 'Enter IP and hit enter',
+  enter_ip: 'Enter an IP address and press enter',
   rate_limiter: 'Rate Limiter',
   callback_url_rules: 'Callback URL Rules',
   enter_callback_url_rule: 'Enter URL rule as regex and hit enter',
@@ -393,14 +395,16 @@ window.localisation.en = {
   wallet_max_ballance: 'Wallet max balance in sats (0 to disable)',
   wallet_limit_secs_between_trans:
     'Min secs between transactions per wallet (0 to disable)',
-  only_incoming_payments_allowed: 'Only incoming payments allowed',
+  only_incoming_payments_allowed: 'Allow incoming payments only',
   disable_outgoing_payments: 'Disable outgoing payments',
-  number_of_requests: 'Number of requests',
+  number_of_requests: 'Number of requests to allow',
+  number_of_requests_hint:
+    'Number of requests to allow per "time unit" for the rate limiter. Set to 0 to disable.',
   time_unit: 'Time unit',
-  minute: 'minute',
+  minute: 'Minute',
   settings: 'Settings',
-  second: 'second',
-  hour: 'hour',
+  second: 'Second',
+  hour: 'Hour',
   disable_server_log: 'Disable Server Log',
   enable_server_log: 'Enable Server Log',
   coming_soon: 'Feature coming soon',
@@ -472,6 +476,12 @@ window.localisation.en = {
   api_token_id: 'Token Id',
   toggle_gradient: 'Toggle Gradient',
   gradient_background: 'Gradient Background',
+  rounded_ui: 'Rounded Cards & Buttons',
+  toggle_rounded_ui: 'Toggle rounded corners for cards and buttons',
+  card_gradient: 'Card Gradient',
+  toggle_card_gradient: 'Toggle gradient on cards',
+  card_shadow: 'Card Shadow',
+  toggle_card_shadow: 'Toggle shadow on cards',
   language: 'Language',
   assets: 'Assets',
   max_asset_size_mb: 'Max Asset Size (MB)',
@@ -530,36 +540,34 @@ window.localisation.en = {
   hash: 'Hash: ',
   welcome_lnbits: 'Welcome to LNbits',
   setup_su_account: 'Set up the Superuser account below.',
+  first_install_token: 'First Install Token',
   create_ticker_converter: 'Create Currency Ticker Converter',
   enable_audit: 'Enable Audit',
   recommended: 'Recommended',
-  audit_desc: 'Record HTTP requests according with the specified filters',
-  audit_record_req: 'Record Request Body',
-  audit_record_warning: 'Warning: ',
-  audit_record_req_warning_1:
-    'confidential data (like passwords) will be logged.',
-  audit_record_req_warning_2: 'the request body can have large size.',
-  audit_record_use: 'Use it with caution.',
-  audit_ip: 'Record IP Address',
-  audit_ip_desc: 'Record the IP address of the client',
-  audit_path_params: 'Record Path Parameters',
-  audit_query_params: 'Record Query Parameters',
+  audit_desc: 'Log HTTP requests according to the filters specified below.',
+  audit_record_req: 'Log Request Body',
+  audit_record_warning: 'Warning!',
+  audit_record_req_warning_1: 'Sensitive data (like passwords) will be logged.',
+  audit_record_req_warning_2:
+    'The request body can be large. This can fill up your logs quickly.',
+  audit_record_use: 'Use this with caution!',
+  audit_ip: 'Log IP Address',
+  audit_ip_desc: 'Log the IP address of users making requests to LNbits.',
+  audit_path_params: 'Log Path Parameters',
+  audit_query_params: 'Log Query Parameters',
   audit_http_methods: 'Include HTTP Methods',
   audit_http_methods_hint:
-    'List of HTTP methods to be included. Empty lists means all.',
-  audit_http_methods_label: 'HTTP Methods',
-  audit_resp_codes: 'Include HTTP Response Codes',
+    'List of HTTP methods to be logged. No value means all methods will be logged.',
+  audit_http_methods_label: 'HTTP Methods to Log',
   audit_resp_codes_hint:
     'List of HTTP codes to be included (regex match). Empty lists means all. Eg: 4.*, 5.*',
-  audit_resp_codes_label: 'HTTP Response code (regex)',
-  audit_paths: 'Include Paths',
+  audit_resp_codes_label: 'HTTP Response Codes to Log (regex)',
   audit_paths_hint:
     'List of paths to be included (regex match). Empty list means all.',
-  audit_paths_label: 'HTTP Path (regex)',
-  audit_paths_exclude: 'Exclude Paths',
+  audit_paths_label: 'HTTP Paths to Log (regex)',
   audit_paths_exclude_hint:
     'List of paths to be excluded (regex match). Empty list means none.',
-  audit_paths_exclude_label: 'HTTP Path (regex)',
+  audit_paths_exclude_label: 'HTTP Paths to Exclude from Logging (regex)',
   exchange_providers: 'Exchange Providers',
   admin_extensions: 'Admin Extensions',
   admin_extensions_label: 'Admin extensions',
@@ -579,41 +587,51 @@ window.localisation.en = {
   misc_disable_extensions_builder_label:
     'Enable Extensions Builder for non admin users.',
   misc_hide_api: 'Hide API',
-  misc_hide_api_label: 'Hides wallet api, extensions can choose to honor',
+  misc_hide_api_label: 'Hides wallet API, extensions can choose to honor',
   wallets_management: 'Wallets Management',
-  funding_source_info: 'Funding Source Info',
-  funding_source: 'Funding Source: {wallet_class}',
-  node_balance: 'Node Balance: {balance} sats',
-  lnbits_balance: 'LNbits Balance: {balance} sats',
-  funding_reserve_percent: 'Reserve Percent: {percent} %',
+  funding_source_info: 'Funding Source Information',
+  funding_source: 'Funding source: {wallet_class}',
+  node_balance: 'Node balance: {balance} sats',
+  lnbits_balance: 'LNbits balance: {balance} sats',
+  funding_reserve_percent: 'Funding reserve percentage: {percent} %',
   node_management: 'Node Management',
   node_management_not_supported:
-    'Node Management not supported by active funding source',
+    'Node management is not supported by the active funding source',
   toggle_node_ui: 'Node UI',
   toggle_public_node_ui: 'Public Node UI',
   toggle_transactions_node_ui: 'Transactions Tab (Disable on large CLN nodes)',
   invoice_expiry: 'Invoice Expiry',
-  invoice_expiry_label: 'Invoice expiry (seconds)',
-  fee_reserve: 'Fee Reserve',
-  fee_reserve_percent: 'Fee Reserve Percent',
-  fee_reserve_msats: 'Reserve fee in msats',
-  reserve_fee_in_percent: 'Reserve fee in percent',
-  payment_wait_time: 'Payment Wait Time (sec)',
+  routing_fee_reserve_calculations: 'Routing Fee Reserve Calculations',
+  routing_fee_reserve_calculations_desc:
+    'LNbits sets aside a “reserve amount” for each payment to cover routing fees. The maximum routing fee passed to the funding source is whichever is higher: the <strong>minimum routing fee reserve</strong> or the <strong>routing fee reserve percentage</strong>.',
+  millisats: 'millisats',
+  fee_reserve: 'Minimum Routing Fee Reserve',
+  fee_reserve_percent: 'Routing Fee Reserve Percentage',
+  fee_reserve_min_hint:
+    'The minimum fee reserved per payment.<br>This acts as a floor - the maximum allowed routing fee will never be lower than this value regardless of payment size.',
+  fee_reserve_percent_hint:
+    'The percentage of the payment amount to reserve for routing fees.',
+  payment_timeouts: 'Payment Timeouts',
+  payment_wait_time: 'Payment Wait Time',
+  seconds: 'seconds',
+  payment_pending_interval: 'Check payment interval (sec)',
+  payment_pending_interval_desc: 'Interval to check pending payments',
+  payment_pending_interval_tooltip:
+    'Controls how often LNbits checks for pending payments to update their status. Higher values can reduce the load on the node and speed up the payment process, but it will take longer for pending payments to be updated.',
   payment_wait_time_desc:
     'Wait time before marking an outgoing payment as pending. Default: 5s; raise for slow-settling invoices.',
   payment_wait_time_tooltip:
     'Controls how long LNbits waits for an outgoing payment attempt to confirm before marking it as pending. Higher values help when paying slow-settling invoices (e.g., HODL invoices, Boltz). The payment will be rechecked later and updated automatically or manually.',
   server_management: 'Server Management',
-  base_url: 'Base URL',
-  base_url_label: 'Static/Base url for the server',
+  base_url_label: 'Base URL of the server',
   authentication: 'Authentication',
-  auth_token_expiry_label: 'Token expire minutes',
+  auth_token_expiry_label: 'Token expiry (minutes)',
   auth_token_expiry_hint: 'Time in minutes until the token expires',
   auth_authentication_cache_label: 'Cache time (minutes)',
   auth_authentication_cache_hint:
     'Time in minutes to cache successful authentication (0 to disable)',
   auth_allowed_methods_label: 'Allowed authorization methods',
-  auth_allowed_methods_hint: 'Select authorization methods',
+  auth_allowed_methods_hint: 'Select allowed authorization methods',
   auth_nostr_label: 'Nostr Request URL',
   auth_nostr_hint: 'Absolute URL that the clients will use to login.',
   auth_google_ci_label: 'Google Client ID',
@@ -631,33 +649,37 @@ window.localisation.en = {
   auth_keycloak_cs_label: 'Keycloak Client Secret',
   auth_keycloak_custom_org_label: 'Keycloak Custom Organization',
   auth_keycloak_custom_icon_label: 'Keycloak Custom Icon (URL)',
+  auth_oidc_label: 'OIDC Discovery URL',
+  auth_oidc_ci_label: 'OIDC Client ID',
+  auth_oidc_ci_hint:
+    'Make sure that the authorization callback URL is set to https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'OIDC Client Secret',
+  auth_oidc_custom_org_label:
+    'OIDC Custom Organization Name (e.g., Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'OIDC Custom Icon (URL)',
   currency_settings: 'Currency Settings',
   allowed_currencies: 'Allowed Currencies',
-  allowed_currencies_hint: 'Limit the number of available fiat currencies',
-  default_account_currency: 'Default Account Currency',
-  default_account_currency_hint: 'Default currency for accounting',
+  allowed_currencies_hint:
+    'Set the allowed fiat currencies for the exchange features',
+  default_account_currency: 'Default Accounting Currency',
+  default_account_currency_hint:
+    'The default currency to use for accounting features.',
   min_incoming_payment_amount: 'Min Incoming Payment Amount',
   min_incoming_payment_amount_desc:
     'Minimum amount allowed for generating an invoice',
-  max_incoming_payment_amount: 'Max Incoming Payment Amount',
+  max_incoming_payment_amount: 'Maximum Incoming Payment Amount',
   max_incoming_payment_amount_desc:
-    'Maximum amount allowed for generating an invoice',
-  max_outgoing_payment_amount: 'Max Outgoing Payment Amount',
+    'Maximum amount allowed when generating an invoice',
+  max_outgoing_payment_amount: 'Maximum Outgoing Payment Amount',
   max_outgoing_payment_amount_desc:
-    'Maximum amount allowed for making a payment',
+    'Maximum amount allowed when making a payment',
+  service_fees: 'Service Fees',
   service_fee: 'Service Fee',
-  service_fee_label: 'Service fee (%)',
-  service_fee_hint: 'Fee charged per tx (%)',
-  service_fee_max: 'Service Fee Max',
-  service_fee_max_label: 'Service fee max (sats)',
-  service_fee_max_hint: 'Max service fee to charge in (sats)',
-  fee_wallet: 'Fee Wallet',
-  fee_wallet_label: 'Fee wallet (wallet ID)',
-  fee_wallet_hint: 'Wallet ID to send funds to',
-  disable_fee: 'Disable Fee',
-  disable_fee_internal: 'Disable Service Fee for Internal Payments',
-  disable_fee_internal_desc:
-    'Disable Service Fee for Internal Lightning Payments',
+  service_fee_label: 'Service Fee Charged Per Transaction',
+  service_fee_max_label: 'Maximum Service Fee Limit',
+  fee_wallet_label: 'Service Fee Wallet ID',
+  fee_wallet_hint: 'The ID of the wallet to which to send service funds',
+  disable_fee: 'Disable Service Fees for Internal Payments',
   ui_management: 'UI Management',
   ui_site_title: 'Site Title',
   ui_changing_remove_lnbits_elements:
@@ -670,6 +692,7 @@ window.localisation.en = {
   ui_site_description_hint: 'Use plain text, Markdown, or raw HTML',
   ui_default_wallet_name: 'Default Wallet Name',
   ui_default_theme: 'Default Theme',
+  wallet_featured_button_title: 'Wallet - Featured Button',
   wallet_featured_button_label: 'Wallet Featured Button Label',
   wallet_featured_button_label_hint:
     'Show featured button on the wallet homepage',
@@ -678,33 +701,38 @@ window.localisation.en = {
     'On click the button will open this URL. Leave empty to hide the button.',
   wallet_featured_button_icon: 'Featured Button Icon',
   wallet_featured_button_icon_hint:
-    'Icon shown on the featured button (check quasar icons)',
+    'Icon shown on the featured button (Quasar icon name e.g. "bolt")',
   lnbits_wallet: 'LNbits wallet',
   denomination: 'Denomination',
   denomination_hint: 'The name for the FakeWallet token',
   denomination_error: 'Denomination must be 3 characters, or `sats`',
   ui_qr_code_logo: 'QR Code/Favicon Logo',
-  ui_qr_code_logo_hint: 'QR code and favicon logo url',
+  ui_qr_code_logo_hint: 'QR code icon and favicon logo URL',
   ui_apple_touch_icon: 'Apple Touch Icon',
-  ui_apple_touch_icon_hint: 'Apple touch icon url',
+  ui_apple_touch_icon_hint: 'Apple touch icon URL',
   ui_custom_image: 'Custom Image',
   ui_custom_image_label: 'URL to custom image',
-  ui_custom_image_hint: 'Image showed at homepage/login',
-  ui_custom_badge: 'Custom Badge',
+  ui_custom_image_hint:
+    'This image is shown on the LNbits homepage and login screen.',
+  ui_custom_badge_title: 'Custom Badge Settings',
+  ui_custom_badge_desc: 'Show a custom badge in the header of LNbits',
+  ui_custom_badge: 'Custom Badge Text',
   ui_custom_badge_label: "Custom Badge 'USE WITH CAUTION'",
   ui_custom_badge_color_label: 'Custom Badge Color',
   themes: 'Themes',
   themes_hint: 'Choose themes available for users',
   custom_logo: 'Custom Logo',
   custom_logo_hint: 'URL to logo image',
-  ad_space_title: 'Ad Space Title',
-  ad_space_title_label: 'Supported by',
+  ad_space_section_title: 'Advertisement Space',
+  ad_space_section_desc:
+    'Configure the advertisement space on the wallet sidebar.',
+  ad_space_title: 'Advertisement Space Title',
+  ad_space_title_hint: 'Title shown above the advertisement space',
   ad_slots: 'Advertisement Slots',
   ad_slots_hint:
-    'Ad url and image filepaths in CSV format, extensions can choose to honor',
-  ad_slots_label: 'url;img_light_url;img_dark_url, url...',
-  ads_enabled: 'Ads Enabled',
-  ads_disabled: 'Ads Disabled',
+    'Advertisement image filepaths in CSV format, extensions can choose to honor. Format: url;img_light_url;img_dark_url, url..',
+  ads_enabled: 'Enable Advertisement',
+  ads_disabled: 'Disabled Advertisement',
   user_management: 'User Management',
   admin_users: 'Admin Users',
   admin_users_hint: 'Users with admin privileges',
@@ -715,6 +743,25 @@ window.localisation.en = {
   allowed_users_label: 'User ID',
   allow_creation_user: 'Allow creation of new users',
   allow_creation_user_desc: 'Allow creation of new users on the index page',
+  require_user_activation: 'Require user activation',
+  require_user_activation_desc:
+    'New users will be activated only after they pass one of the confirmation methods. Admins can activate users manually from the admin panel.',
+  reusable_activation_code: 'Reusable activation code',
+  reusable_activation_code_label: 'Reusable activation code',
+  reusable_activation_code_hint:
+    'This activation code can be used multiple times by different users.',
+  one_time_activation_code: 'One-time activation codes',
+  one_time_activation_code_label: 'Add activation code',
+  one_time_activation_code_hint:
+    'List of one-time activation codes. Each code can be used only once, then will be reomved from the list.',
+  invitation_code: 'Invitation Code',
+  invitation_code_hint: 'The invitation code that you have received.',
+  email: 'Email',
+  email_confirmation_hint: 'Email address to send the confirmation code to.',
+  nostr_identifier: 'Nostr Identifier',
+  nostr_identifier_hint:
+    'Nostr nip5 identifier or <npub> to send the confirmation code to.',
+
   new_user_not_allowed: 'Registration is disabled.',
   start_user_impersonation: 'Impersonate this user',
   stop_user_impersonation: 'Stop User Impersonation',

lnbits/static/i18n/es.js

@@ -142,6 +142,7 @@ window.localisation.es = {
   only_admins_can_install:
     '(Solo las cuentas de administrador pueden instalar extensiones)',
   admin_only: 'Solo administradores',
+  super_user_only: 'Solo superusuario',
   new_version: 'Nueva Versión',
   extension_depends_on: 'Depende de:',
   extension_rating_soon: 'Calificaciones próximamente',
@@ -379,6 +380,16 @@ window.localisation.es = {
   auth_keycloak_ci_hint:
     'Asegúrate de que la URL de devolución de llamada de autorización esté configurada en https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Secreto del Cliente de Keycloak',
+  auth_keycloak_custom_org_label: 'Organización personalizada de Keycloak',
+  auth_keycloak_custom_icon_label: 'Icono personalizado de Keycloak (URL)',
+  auth_oidc_label: 'URL de descubrimiento de OIDC',
+  auth_oidc_ci_label: 'ID de cliente de OIDC',
+  auth_oidc_ci_hint:
+    'Asegúrate de que la URL de devolución de llamada de autorización esté configurada en https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'Secreto del Cliente de OIDC',
+  auth_oidc_custom_org_label:
+    'Nombre de organización personalizada OIDC (ej. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Icono personalizado de OIDC (URL)',
   currency_settings: 'Configuración de moneda',
   allowed_currencies: 'Monedas permitidas',
   allowed_currencies_hint:

lnbits/static/i18n/fi.js

@@ -154,6 +154,7 @@ window.localisation.fi = {
   all: 'Kaikki',
   only_admins_can_install: '(Vain pääkäyttäjät voivat asentaa laajennuksia)',
   admin_only: 'Pääkäyttäjille',
+  super_user_only: 'Vain superkäyttäjälle',
   new_version: 'Uusi versio',
   extension_depends_on: 'Edellyttää:',
   extension_rating_soon: 'Arvostelut on tulossa pian',
@@ -520,6 +521,14 @@ window.localisation.fi = {
   auth_keycloak_cs_label: 'Keycloak-asiakassalasana',
   auth_keycloak_custom_org_label: 'Valinnainen Keycloak-organisaatio',
   auth_keycloak_custom_icon_label: 'Valinnainen Keycloak-kuvake (URL)',
+  auth_oidc_label: 'OIDC-discovery-URL',
+  auth_oidc_ci_label: 'OIDC-asiakastunnus',
+  auth_oidc_ci_hint:
+    'Varmista, että valtuutuksen palautus-URL on asetettu muotoon https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'OIDC-asiakassalasana',
+  auth_oidc_custom_org_label:
+    'OIDC mukautetun organisaation nimi (esim. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Valinnainen OIDC-kuvake (URL)',
   currency_settings: 'Valuutta-asetukset',
   allowed_currencies: 'Käytettävät valuutat',
   allowed_currencies_hint: 'Valitse käytettävissä olevat fiat-valuutat',

lnbits/static/i18n/fr.js

@@ -145,6 +145,7 @@ window.localisation.fr = {
   only_admins_can_install:
     'Seuls les comptes administrateurs peuvent installer des extensions',
   admin_only: 'Réservé aux administrateurs',
+  super_user_only: 'Réservé au super utilisateur',
   new_version: 'Nouvelle version',
   extension_depends_on: 'Dépend de :',
   extension_rating_soon: 'Notes des utilisateurs à venir bientôt',
@@ -381,6 +382,16 @@ window.localisation.fr = {
   auth_keycloak_ci_hint:
     "Assurez-vous que l'URL de rappel d'autorisation est définie sur https://{domain}/api/v1/auth/keycloak/token",
   auth_keycloak_cs_label: 'Secret client Keycloak',
+  auth_keycloak_custom_org_label: 'Organisation personnalisée Keycloak',
+  auth_keycloak_custom_icon_label: 'Icône personnalisée Keycloak (URL)',
+  auth_oidc_label: 'URL de découverte OIDC',
+  auth_oidc_ci_label: 'ID Client OIDC',
+  auth_oidc_ci_hint:
+    "Assurez-vous que l'URL de rappel d'autorisation est définie sur https://{domain}/api/v1/auth/oidc/token",
+  auth_oidc_cs_label: 'Secret client OIDC',
+  auth_oidc_custom_org_label:
+    "Nom de l'organisation personnalisée OIDC (par ex. Zitadel, Authentik)",
+  auth_oidc_custom_icon_label: 'Icône personnalisée OIDC (URL)',
   currency_settings: 'Paramètres de devise',
   allowed_currencies: 'Devises autorisées',
   allowed_currencies_hint:

lnbits/static/i18n/it.js

@@ -142,6 +142,7 @@ window.localisation.it = {
   only_admins_can_install:
     'Solo gli account amministratore possono installare estensioni.',
   admin_only: 'Solo amministratore',
+  super_user_only: 'Solo superutente',
   new_version: 'Nuova Versione',
   extension_depends_on: 'Dipende da:',
   extension_rating_soon: 'Valutazioni in arrivo',
@@ -378,6 +379,16 @@ window.localisation.it = {
   auth_keycloak_ci_hint:
     "Assicurati che l'URL di callback dell'autorizzazione sia impostato su https://{domain}/api/v1/auth/keycloak/token",
   auth_keycloak_cs_label: 'Keycloak Client Secret',
+  auth_keycloak_custom_org_label: 'Organizzazione personalizzata di Keycloak',
+  auth_keycloak_custom_icon_label: 'Icona personalizzata di Keycloak (URL)',
+  auth_oidc_label: 'URL di individuazione di OIDC',
+  auth_oidc_ci_label: 'ID client di OIDC',
+  auth_oidc_ci_hint:
+    "Assicurati che l'URL di callback dell'autorizzazione sia impostato su https://{domain}/api/v1/auth/oidc/token",
+  auth_oidc_cs_label: 'OIDC Client Secret',
+  auth_oidc_custom_org_label:
+    'Nome organizzazione personalizzata OIDC (es. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Icona personalizzata di OIDC (URL)',
   currency_settings: 'Impostazioni valuta',
   allowed_currencies: 'Valute consentite',
   allowed_currencies_hint: 'Limita il numero di valute fiat disponibili',

lnbits/static/i18n/jp.js

@@ -137,6 +137,7 @@ window.localisation.jp = {
   only_admins_can_install:
     '(管理者アカウントのみが拡張機能をインストールできます)',
   admin_only: '管理者のみ',
+  super_user_only: 'スーパー ユーザーのみ',
   new_version: '新しいバージョン',
   extension_depends_on: '依存先:',
   extension_rating_soon: '評価は近日公開',
@@ -369,6 +370,15 @@ window.localisation.jp = {
   auth_keycloak_ci_hint:
     '認証コールバックURLが https://{domain}/api/v1/auth/keycloak/token に設定されていることを確認してください。',
   auth_keycloak_cs_label: 'キークローククライアントシークレット',
+  auth_keycloak_custom_org_label: 'Keycloak カスタム組織',
+  auth_keycloak_custom_icon_label: 'Keycloak カスタムアイコン (URL)',
+  auth_oidc_label: 'OIDC ディスカバリー URL',
+  auth_oidc_ci_label: 'OIDC クライアント ID',
+  auth_oidc_ci_hint:
+    '認証コールバックURLが https://{domain}/api/v1/auth/oidc/token に設定されていることを確認してください。',
+  auth_oidc_cs_label: 'OIDC クライアントシークレット',
+  auth_oidc_custom_org_label: 'OIDC カスタム組織名（例：Zitadel、Authentik）',
+  auth_oidc_custom_icon_label: 'OIDC カスタムアイコン (URL)',
   currency_settings: '通貨設定',
   allowed_currencies: '許可されている通貨',
   allowed_currencies_hint: '利用可能な法定通貨の数を制限する',

lnbits/static/i18n/kr.js

@@ -139,6 +139,7 @@ window.localisation.kr = {
   all: '전체',
   only_admins_can_install: '(관리자 계정만이 확장 기능을 설치할 수 있습니다)',
   admin_only: '관리자 전용',
+  super_user_only: '슈퍼유저 전용',
   new_version: '새로운 버전',
   extension_depends_on: '의존성 존재:',
   extension_rating_soon: '평점 기능도 곧 구현됩니다',
@@ -365,6 +366,16 @@ window.localisation.kr = {
   auth_keycloak_ci_hint:
     '승인 콜백 URL이 https://{domain}/api/v1/auth/keycloak/token으로 설정되어 있는지 확인하십시오.',
   auth_keycloak_cs_label: 'Keycloak 클라이언트 시크릿',
+  auth_keycloak_custom_org_label: 'Keycloak 사용자 정의 조직',
+  auth_keycloak_custom_icon_label: 'Keycloak 사용자 정의 아이콘 (URL)',
+  auth_oidc_label: 'OIDC 디스커버리 URL',
+  auth_oidc_ci_label: 'OIDC 클라이언트 ID',
+  auth_oidc_ci_hint:
+    '승인 콜백 URL이 https://{domain}/api/v1/auth/oidc/token으로 설정되어 있는지 확인하십시오.',
+  auth_oidc_cs_label: 'OIDC 클라이언트 시크릿',
+  auth_oidc_custom_org_label:
+    'OIDC 사용자 정의 조직 이름 (예: Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'OIDC 사용자 정의 아이콘 (URL)',
   currency_settings: '통화 설정',
   allowed_currencies: '허용되는 통화',
   allowed_currencies_hint: '사용 가능한 법정 화폐의 수를 제한하십시오.',

lnbits/static/i18n/nl.js

@@ -143,6 +143,7 @@ window.localisation.nl = {
   only_admins_can_install:
     'Alleen beheerdersaccounts kunnen extensies installeren',
   admin_only: 'Alleen beheerder',
+  super_user_only: 'Alleen supergebruiker',
   new_version: 'Nieuwe Versie',
   extension_depends_on: 'Afhankelijk van:',
   extension_rating_soon: 'Beoordelingen binnenkort beschikbaar',
@@ -377,6 +378,16 @@ window.localisation.nl = {
   auth_keycloak_ci_hint:
     'Zorg ervoor dat de autorisatie callback-URL is ingesteld op https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Keycloak Clientgeheim',
+  auth_keycloak_custom_org_label: 'Keycloak Aangepaste Organisatie',
+  auth_keycloak_custom_icon_label: 'Keycloak Aangepast Pictogram (URL)',
+  auth_oidc_label: 'OIDC Ontdekking URL',
+  auth_oidc_ci_label: 'OIDC-client-ID',
+  auth_oidc_ci_hint:
+    'Zorg ervoor dat de autorisatie callback-URL is ingesteld op https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'OIDC Clientgeheim',
+  auth_oidc_custom_org_label:
+    'OIDC Aangepaste Organisatienaam (bijv. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'OIDC Aangepast Pictogram (URL)',
   currency_settings: 'Valuta-instellingen',
   allowed_currencies: "Toegestane valuta's",
   allowed_currencies_hint: "Beperk het aantal beschikbare fiatvaluta's",

lnbits/static/i18n/pi.js

@@ -141,6 +141,7 @@ window.localisation.pi = {
   all: 'Arr',
   only_admins_can_install: '(Only admin accounts can install extensions)',
   admin_only: "Cap'n Only",
+  super_user_only: "Big Cap'n Only",
   new_version: 'New Version',
   extension_depends_on: 'Depends on:',
   extension_rating_soon: "Ratings a'comin' soon",
@@ -371,6 +372,16 @@ window.localisation.pi = {
   auth_keycloak_ci_hint:
     "Make sure thant th' authorization callback URL be set t' https://{domain}/api/v1/auth/keycloak/token",
   auth_keycloak_cs_label: 'Keycloak Client Secret',
+  auth_keycloak_custom_org_label: 'Keycloak Custom Organization',
+  auth_keycloak_custom_icon_label: 'Keycloak Custom Icon (URL)',
+  auth_oidc_label: 'OIDC Discovery URL',
+  auth_oidc_ci_label: 'OIDC Client ID',
+  auth_oidc_ci_hint:
+    "Make sure thant th' authorization callback URL be set t' https://{domain}/api/v1/auth/oidc/token",
+  auth_oidc_cs_label: 'OIDC Client Secret',
+  auth_oidc_custom_org_label:
+    'OIDC Custom Organization Name (e.g., Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'OIDC Custom Icon (URL)',
   currency_settings: "Doubloon Settin's",
   allowed_currencies: "Allo'ed Doubloons",
   allowed_currencies_hint: 'Limit the number of available fiat doubloons',

lnbits/static/i18n/pl.js

@@ -140,6 +140,7 @@ window.localisation.pl = {
   only_admins_can_install:
     'Tylko konta administratorów mogą instalować rozszerzenia',
   admin_only: 'Tylko dla administratora',
+  super_user_only: 'Tylko dla superużytkownika',
   new_version: 'Nowa wersja',
   extension_depends_on: 'Zależy od:',
   extension_rating_soon: 'Oceny będą dostępne wkrótce',
@@ -372,6 +373,16 @@ window.localisation.pl = {
   auth_keycloak_ci_hint:
     'Upewnij się, że URL zwrotu autoryzacji jest ustawiony na https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Hasło klienta Keycloak',
+  auth_keycloak_custom_org_label: 'Własna organizacja Keycloak',
+  auth_keycloak_custom_icon_label: 'Własna ikona Keycloak (URL)',
+  auth_oidc_label: 'Adres URL Discovery OIDC',
+  auth_oidc_ci_label: 'Identyfikator klienta OIDC',
+  auth_oidc_ci_hint:
+    'Upewnij się, że URL zwrotu autoryzacji jest ustawiony na https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'Hasło klienta OIDC',
+  auth_oidc_custom_org_label:
+    'Nazwa własnej organizacji OIDC (np. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Własna ikona OIDC (URL)',
   currency_settings: 'Ustawienia waluty',
   allowed_currencies: 'Dozwolone waluty',
   allowed_currencies_hint: 'Ogranicz liczbę dostępnych walut fiducjarnych',

lnbits/static/i18n/pt.js

@@ -141,6 +141,7 @@ window.localisation.pt = {
   only_admins_can_install:
     'Apenas contas de administrador podem instalar extensões.',
   admin_only: 'Apenas para administradores',
+  super_user_only: 'Apenas para superusuário',
   new_version: 'Nova Versão',
   extension_depends_on: 'Depende de:',
   extension_rating_soon: 'Avaliações em breve',
@@ -375,6 +376,16 @@ window.localisation.pt = {
   auth_keycloak_ci_hint:
     'Certifique-se de que o URL de retorno de chamada de autorização esteja definido como https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Segredo do Cliente do Keycloak',
+  auth_keycloak_custom_org_label: 'Organização Personalizada do Keycloak',
+  auth_keycloak_custom_icon_label: 'Ícone Personalizado do Keycloak (URL)',
+  auth_oidc_label: 'URL de Descoberta do OIDC',
+  auth_oidc_ci_label: 'ID do Cliente do OIDC',
+  auth_oidc_ci_hint:
+    'Certifique-se de que o URL de retorno de chamada de autorização esteja definido como https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'Segredo do Cliente do OIDC',
+  auth_oidc_custom_org_label:
+    'Nome da Organização Personalizada OIDC (ex. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Ícone Personalizado do OIDC (URL)',
   currency_settings: 'Configurações de Moeda',
   allowed_currencies: 'Moedas Permitidas',
   allowed_currencies_hint: 'Limite o número de moedas fiduciárias disponíveis',

lnbits/static/i18n/sk.js

@@ -138,6 +138,7 @@ window.localisation.sk = {
   only_admins_can_install:
     '(Iba administrátorské účty môžu inštalovať rozšírenia)',
   admin_only: 'Iba pre administrátorov',
+  super_user_only: 'Iba pre superužívateľa',
   new_version: 'Nová verzia',
   extension_depends_on: 'Závisí na:',
   extension_rating_soon: 'Hodnotenia budú čoskoro dostupné',
@@ -371,6 +372,16 @@ window.localisation.sk = {
   auth_keycloak_ci_hint:
     'Uistite sa, že URL spätného volania autorizácie je nastavená na https://{domain}/api/v1/auth/keycloak/token',
   auth_keycloak_cs_label: 'Tajný kľúč klienta Keycloak',
+  auth_keycloak_custom_org_label: 'Vlastná organizácia Keycloak',
+  auth_keycloak_custom_icon_label: 'Vlastná ikona Keycloak (URL)',
+  auth_oidc_label: 'URL zistenia OIDC',
+  auth_oidc_ci_label: 'ID klienta OIDC',
+  auth_oidc_ci_hint:
+    'Uistite sa, že URL spätného volania autorizácie je nastavená na https://{domain}/api/v1/auth/oidc/token',
+  auth_oidc_cs_label: 'Tajný kľúč klienta OIDC',
+  auth_oidc_custom_org_label:
+    'Názov vlastnej organizácie OIDC (napr. Zitadel, Authentik)',
+  auth_oidc_custom_icon_label: 'Vlastná ikona OIDC (URL)',
   currency_settings: 'Nastavenia meny',
   allowed_currencies: 'Povolené meny',
   allowed_currencies_hint: 'Obmedzte počet dostupných fiat mien',

lnbits/static/i18n/we.js

@@ -139,6 +139,7 @@ window.localisation.we = {
   all: 'Pob',
   only_admins_can_install: 'Dim ond cyfrifon gweinyddwr all osod estyniadau',
   admin_only: 'Dim ond Gweinyddwr',
+  super_user_only: 'Dim ond Uwchddefnyddiwr',
   new_version: 'Fersiwn Newydd',
   extension_depends_on: 'Dibynnu ar:',
   extension_rating_soon: 'Sgôr yn dod yn fuan',
@@ -370,6 +371,16 @@ window.localisation.we = {
   auth_keycloak_ci_hint:
     "Gwnewch yn siŵr bod URL adalw awdurdodiad wedi'i osod i https://{domain}/api/v1/auth/keycloak/token",
   auth_keycloak_cs_label: 'Cyfrinach Cleient Keycloak',
+  auth_keycloak_custom_org_label: "Sefydliad Wedi'i Addasu Keycloak",
+  auth_keycloak_custom_icon_label: "Eicon Wedi'i Addasu Keycloak (URL)",
+  auth_oidc_label: 'URL Darganfod OIDC',
+  auth_oidc_ci_label: 'ID Cleient OIDC',
+  auth_oidc_ci_hint:
+    "Gwnewch yn siŵr bod URL adalw awdurdodiad wedi'i osod i https://{domain}/api/v1/auth/oidc/token",
+  auth_oidc_cs_label: 'Cyfrinach Cleient OIDC',
+  auth_oidc_custom_org_label:
+    "Enw Sefydliad Wedi'i Addasu OIDC (e.e. Zitadel, Authentik)",
+  auth_oidc_custom_icon_label: "Eicon Wedi'i Addasu OIDC (URL)",
   currency_settings: 'Gosodiadau Arian Cyfred',
   allowed_currencies: 'Ariannau a Ganiateir',
   allowed_currencies_hint: 'Cyfyngu nifer yr arian cyfred fiat sydd ar gael',

lnbits/static/images/generic-oidc-logo.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="100" height="100">
+  <!-- Background circle -->
+  <circle cx="50" cy="50" r="48" fill="#4A90E2" stroke="#2E5F8E" stroke-width="2"/>
+  
+  <!-- Lock body -->
+  <rect x="35" y="45" width="30" height="25" rx="2" fill="#FFFFFF"/>
+  
+  <!-- Lock shackle -->
+  <path d="M 40 45 L 40 35 Q 40 25 50 25 Q 60 25 60 35 L 60 45" 
+        fill="none" stroke="#FFFFFF" stroke-width="4" stroke-linecap="round"/>
+  
+  <!-- Keyhole -->
+  <circle cx="50" cy="55" r="3" fill="#4A90E2"/>
+  <rect x="48.5" y="55" width="3" height="8" fill="#4A90E2"/>
+  
+  <!-- ID letters -->
+  <text x="50" y="85" font-family="Arial, sans-serif" font-size="12" font-weight="bold" 
+        fill="#FFFFFF" text-anchor="middle">ID</text>
+</svg>