chore: update to v1.5.5-rc2 (#3998)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

lnbits/core/crud/payments.py

@@ -306,7 +306,7 @@ async def update_payment_checking_id(
     await (conn or db).execute(
         f"""
             UPDATE apipayments
-            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder('now')}
+            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder("now")}
             WHERE checking_id = :old_id
         """,  # noqa: S608
         {
@@ -321,13 +321,15 @@ async def update_payment(
     payment: Payment,
     new_checking_id: str | None = None,
     conn: Connection | None = None,
-) -> None:
+) -> Payment:
     payment.updated_at = datetime.now(timezone.utc)
     await (conn or db).update(
         "apipayments", payment, "WHERE checking_id = :checking_id"
     )
     if new_checking_id and new_checking_id != payment.checking_id:
         await update_payment_checking_id(payment.checking_id, new_checking_id, conn)
+        payment.checking_id = new_checking_id
+    return payment
 
 
 async def get_payments_history(
@@ -399,7 +401,6 @@ async def get_payment_count_stats(
     user_id: str | None = None,
     conn: Connection | None = None,
 ) -> list[PaymentCountStat]:
-
     if not filters:
         filters = Filters()
     extra_stmts = []
@@ -432,7 +433,6 @@ async def get_daily_stats(
     user_id: str | None = None,
     conn: Connection | None = None,
 ) -> tuple[list[PaymentDailyStats], list[PaymentDailyStats]]:
-
     if not filters:
         filters = Filters()
 
@@ -482,7 +482,6 @@ async def get_wallets_stats(
     user_id: str | None = None,
     conn: Connection | None = None,
 ) -> list[PaymentWalletStats]:
-
     if not filters:
         filters = Filters()
 

lnbits/core/models/__init__.py

@@ -25,6 +25,7 @@ from .payments import (
     PaymentState,
     PaymentWalletStats,
     SettleInvoice,
+    UpdatePaymentExtra,
 )
 from .tinyurl import TinyURL
 from .users import (
@@ -90,6 +91,7 @@ __all__ = [
     "SimpleStatus",
     "TinyURL",
     "UpdateBalance",
+    "UpdatePaymentExtra",
     "UpdateSuperuserPassword",
     "UpdateUser",
     "UpdateUserPassword",

lnbits/core/models/payments.py

@@ -35,6 +35,11 @@ class PaymentExtra(BaseModel):
     lnurl_response: str | None = None
 
 
+class UpdatePaymentExtra(BaseModel):
+    payment_hash: str
+    extra: dict = Field(default_factory=dict)
+
+
 class PayInvoice(BaseModel):
     payment_request: str
     description: str | None = None

lnbits/core/services/payments.py

@@ -171,15 +171,15 @@ async def create_fiat_invoice(
 
     internal_payment.fiat_provider = fiat_provider_name
     internal_payment.extra["fiat_checking_id"] = fiat_invoice.checking_id
-    # todo: move to payent
+    # TODO: move to payment
     internal_payment.extra["fiat_payment_request"] = fiat_invoice.payment_request
     new_checking_id = (
         f"fiat_{fiat_provider_name}_"
         f"{fiat_invoice.checking_id or internal_payment.checking_id}"
     )
-    await update_payment(internal_payment, new_checking_id, conn=conn)
+    internal_payment = await update_payment(
-    internal_payment.checking_id = new_checking_id
+        internal_payment, new_checking_id, conn=conn
-
+    )
     return internal_payment
 
 
@@ -374,7 +374,7 @@ async def update_pending_payment(
     status = await check_payment_status(payment)
     if status.failed:
         payment.status = PaymentState.FAILED
-        await update_payment(payment, conn=conn)
+        payment = await update_payment(payment, conn=conn)
     elif status.success:
         payment = await update_payment_success_status(payment, status, conn=conn)
     return payment
@@ -876,7 +876,7 @@ async def update_payment_success_status(
         payment.status = PaymentState.SUCCESS
         payment.fee = -(abs(status.fee_msat or 0) + abs(service_fee_msat))
         payment.preimage = payment.preimage or status.preimage
-        await update_payment(payment, conn=conn)
+        payment = await update_payment(payment, conn=conn)
     return payment
 
 
@@ -1099,8 +1099,9 @@ async def update_invoice_callback(checking_id: str) -> Payment | None:
     payment.fee = status.fee_msat or payment.fee
     # only overwrite preimage if status.preimage provides it
     payment.preimage = status.preimage or payment.preimage
+
     payment.status = PaymentState.SUCCESS
-    await update_payment(payment)
+    payment = await update_payment(payment)
     if payment.fiat_provider:
         await handle_fiat_payment_confirmation(payment)
     return payment

lnbits/core/views/auth_api.py

@@ -36,6 +36,7 @@ from lnbits.decorators import (
     check_account_exists,
     check_admin,
     check_user_exists,
+    optional_user_id,
 )
 from lnbits.helpers import (
     create_access_token,
@@ -320,7 +321,10 @@ async def api_delete_user_api_token(
 
 @auth_router.get("/{provider}", description="SSO Provider")
 async def login_with_sso_provider(
-    request: Request, provider: str, user_id: str | None = None
+    request: Request,
+    provider: str,
+    user_id: str | None,
+    auth_user_id: str | None = Depends(optional_user_id),
 ):
     provider_sso = _new_sso(provider)
     if not provider_sso:
@@ -328,6 +332,8 @@ async def login_with_sso_provider(
             HTTPStatus.FORBIDDEN,
             f"Login by '{provider}' not allowed.",
         )
+    if user_id and user_id != auth_user_id:
+        raise HTTPException(HTTPStatus.FORBIDDEN, "User ID mismatch.")
 
     provider_sso.redirect_uri = str(request.base_url) + f"api/v1/auth/{provider}/token"
     with provider_sso:

lnbits/core/views/callback_api.py

@@ -357,16 +357,20 @@ async def handle_revolut_event(event: dict):
             return
 
         payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-        if not payment:
+        if payment:
+            await check_fiat_status(payment)
+            return
+
+        if event_type == "ORDER_COMPLETED":
             logger.warning(f"No payment found for Revolut order: '{order_id}'.")
             await _handle_revolut_subscription_order_paid(order_id)
             return
 
-        await check_fiat_status(payment)
+        logger.info(f"Ignoring Revolut authorised order without payment: '{order_id}'.")
         return
 
     if event_type == "SUBSCRIPTION_INITIATED":
-        await _handle_revolut_subscription_initiated(event)
+        logger.info("Revolut subscription initiated event received.")
         return
 
     if event_type in [
@@ -380,23 +384,6 @@ async def handle_revolut_event(event: dict):
     logger.warning(f"Unhandled Revolut event type: '{event_type}'.")
 
 
-async def _handle_revolut_subscription_initiated(event: dict):
-    subscription_id = event.get("subscription_id")
-    if not subscription_id:
-        subscription_id = event.get("id")
-
-    if not subscription_id:
-        logger.warning("Revolut subscription event missing subscription_id.")
-        return
-
-    fiat_provider = await _get_revolut_provider()
-    if not fiat_provider:
-        return
-
-    subscription = await fiat_provider.get_subscription(subscription_id)
-    await _handle_revolut_subscription(subscription, fiat_provider)
-
-
 async def _get_revolut_provider() -> RevolutWallet | None:
     fiat_provider = await get_fiat_provider("revolut")
     if not isinstance(fiat_provider, RevolutWallet):
@@ -406,7 +393,10 @@ async def _get_revolut_provider() -> RevolutWallet | None:
 
 
 async def _handle_revolut_subscription(
-    subscription: dict, fiat_provider: RevolutWallet
+    subscription: dict,
+    fiat_provider: RevolutWallet,
+    order_id: str | None = None,
+    order: dict | None = None,
 ):
     subscription_id = subscription.get("id")
     if not subscription_id:
@@ -420,16 +410,17 @@ async def _handle_revolut_subscription(
         logger.warning("Revolut subscription event missing LNbits metadata.")
         return
 
-    cycle_id = subscription.get("current_cycle_id")
-    if not cycle_id:
-        logger.warning("Revolut subscription missing current_cycle_id.")
-        return
-
-    cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
-    order_id = cycle.get("order_id")
     if not order_id:
-        logger.warning("Revolut subscription cycle missing order_id.")
+        cycle_id = subscription.get("current_cycle_id")
-        return
+        if not cycle_id:
+            logger.warning("Revolut subscription missing current_cycle_id.")
+            return
+
+        cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
+        order_id = cycle.get("order_id")
+        if not order_id:
+            logger.warning("Revolut subscription cycle missing order_id.")
+            return
 
     existing_payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
     if existing_payment:
@@ -439,7 +430,8 @@ async def _handle_revolut_subscription(
         await check_fiat_status(existing_payment)
         return
 
-    order = await fiat_provider.get_order(order_id)
+    if not order:
+        order = await fiat_provider.get_order(order_id)
     amount_minor = order.get("amount")
     currency = (order.get("currency") or "").upper()
     if amount_minor is None or not currency:
@@ -475,7 +467,9 @@ async def _handle_revolut_subscription_order_paid(order_id: str):
         return
 
     order = await fiat_provider.get_order(order_id)
-    if order.get("type") != "payment" or order.get("state") != "completed":
+    order_type = (order.get("type") or "").lower()
+    order_state = (order.get("state") or "").upper()
+    if order_type != "payment" or order_state != "COMPLETED":
         logger.warning(f"Revolut order is not a completed payment: '{order_id}'.")
         return
 
@@ -490,7 +484,9 @@ async def _handle_revolut_subscription_order_paid(order_id: str):
         logger.warning(f"Revolut subscription is not active: '{subscription_id}'.")
         return
 
-    await _handle_revolut_subscription_initiated(subscription)
+    await _handle_revolut_subscription(
+        subscription, fiat_provider, order_id=order_id, order=order
+    )
 
 
 async def _create_revolut_subscription_payment(

lnbits/core/views/payment_api.py

@@ -34,6 +34,7 @@ from lnbits.core.models import (
     PaymentWalletStats,
     SettleInvoice,
     SimpleStatus,
+    UpdatePaymentExtra,
 )
 from lnbits.core.models.payments import UpdatePaymentLabels
 from lnbits.core.models.users import AccountId
@@ -297,6 +298,38 @@ async def api_update_payment_labels(
     return SimpleStatus(success=True, message="Payment labels updated.")
 
 
+@payment_router.patch(
+    "/extra",
+    name="Update payment extra",
+    description="Append new extra metadata to a payment.",
+    response_model=Payment,
+)
+async def api_update_payment_extra(
+    data: UpdatePaymentExtra,
+    key_type: WalletTypeInfo = Depends(require_admin_key),
+) -> Payment:
+    payment = await get_standalone_payment(
+        data.payment_hash, wallet_id=key_type.wallet.id
+    )
+    if payment is None:
+        raise HTTPException(HTTPStatus.NOT_FOUND, "Payment does not exist.")
+    if not payment.success:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST, "Payment extra can only be updated after success."
+        )
+
+    duplicate_keys = sorted(set(payment.extra).intersection(data.extra))
+    if duplicate_keys:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST,
+            f"Extra keys already exist: {', '.join(duplicate_keys)}.",
+        )
+
+    payment.extra.update(data.extra)
+    await update_payment(payment)
+    return payment
+
+
 @payment_router.get("/fee-reserve")
 async def api_payments_fee_reserve(invoice: str = Query("invoice")) -> JSONResponse:
     invoice_obj = bolt11.decode(invoice)

lnbits/fiat/base.py

@@ -131,15 +131,15 @@ class FiatSubscriptionResponse(BaseModel):
 
 
 class FiatPaymentSuccessStatus(FiatPaymentStatus):
-    paid = True
+    paid = True  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class FiatPaymentFailedStatus(FiatPaymentStatus):
-    paid = False
+    paid = False  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class FiatPaymentPendingStatus(FiatPaymentStatus):
-    paid = None
+    paid = None  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class FiatProvider(ABC):

lnbits/settings.py

@@ -1047,7 +1047,7 @@ class EditableSettings(
 
 
 class UpdateSettings(EditableSettings):
-    class Config:
+    class Config(EditableSettings.Config):
         extra = Extra.forbid
 
 
@@ -1198,11 +1198,11 @@ class ReadOnlySettings(
 
 
 class Settings(EditableSettings, ReadOnlySettings, TransientSettings, BaseSettings):
-    class Config:
+    class Config(EditableSettings.Config, BaseSettings.Config):  # type: ignore[misc]
         env_file = ".env"
         env_file_encoding = "utf-8"
         case_sensitive = False
-        json_loads = list_parse_fallback
+        json_loads = list_parse_fallback  # type: ignore[assignment]
 
     def is_user_allowed(self, user_id: str) -> bool:
         return (

lnbits/static/css/base.css

@@ -212,12 +212,15 @@ body.bg-image .q-page-container {
   backdrop-filter: none; /* Ensure the page content is not affected */
 }
 
-body.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark),
+body.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
+  --q-dark: rgba(29, 29, 29, 0.3);
+  background-color: var(--q-dark);
+}
 body.body--dark .q-header,
 body.body--dark .q-drawer {
   --q-dark: rgba(29, 29, 29, 0.3);
   background-color: var(--q-dark);
-  backdrop-filter: blur(6px) brightness(0.8);
+  backdrop-filter: brightness(0.8);
 }
 
 body.rounded-ui .q-card,
@@ -388,11 +391,11 @@ body[data-theme=salvador].card-gradient.body--dark .q-drawer {
 }
 
 body.card-shadow .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-  filter: drop-shadow(0 10px 24px rgba(0, 0, 0, 0.18));
+  box-shadow: 0 10px 24px rgba(0, 0, 0, 0.18);
 }
 
 body.card-shadow.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-  filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
+  box-shadow: 0 12px 28px rgba(0, 0, 0, 0.45);
 }
 
 body.no-burger-background .q-drawer {

lnbits/static/js/components/lnbits-payment-list.js

@@ -360,18 +360,37 @@ window.app.component('lnbits-payment-list', {
     paymentTableRowKey(row) {
       return row.payment_hash + row.amount
     },
-    exportCSV(detailed = false) {
+    async exportCSV(detailed = false) {
       // status is important for export but it is not in paymentsTable
       // because it is manually added with payment detail link and icons
       // and would cause duplication in the list
       const pagination = this.paymentsTable.pagination
-      const query = {
+      const maxPages = 100
-        sortby: pagination.sortBy ?? 'time',
+      const limit = 1000
-        direction: pagination.descending ? 'desc' : 'asc'
+      let payments = []
-      }
+
-      const params = new URLSearchParams(query)
+      this.paymentsCSV.loading = true
-      LNbits.api.getPayments(this.wallet, params).then(response => {
+      try {
-        let payments = response.data.data.map(this.mapPayment)
+        for (let page = 0; page < maxPages; page++) {
+          const query = {
+            sortby: pagination.sortBy ?? 'time',
+            direction: pagination.descending ? 'desc' : 'asc',
+            limit,
+            offset: page * limit
+          }
+          const params = new URLSearchParams(query)
+          const response = await LNbits.api.getPayments(this.wallet, params)
+          const pagePayments = response.data.data || []
+          payments = payments.concat(pagePayments.map(this.mapPayment))
+
+          if (
+            pagePayments.length < limit ||
+            payments.length >= response.data.total
+          ) {
+            break
+          }
+        }
+
         let columns = this.paymentsCSV.columns
 
         if (detailed) {
@@ -400,7 +419,11 @@ window.app.component('lnbits-payment-list', {
           payments,
           this.wallet.name + '-payments'
         )
-      })
+      } catch (err) {
+        LNbits.utils.notifyApiError(err)
+      } finally {
+        this.paymentsCSV.loading = false
+      }
     },
     addFilterTag() {
       if (!this.exportTagName) return

lnbits/static/js/components/lnbits-qrcode-lnurl.js

@@ -8,6 +8,10 @@ window.app.component('lnbits-qrcode-lnurl', {
     prefix: {
       type: String,
       default: 'lnurlp'
+    },
+    href: {
+      type: String,
+      default: ''
     }
   },
   data() {
@@ -21,7 +25,10 @@ window.app.component('lnbits-qrcode-lnurl', {
       if (this.tab == 'bech32') {
         const bytes = new TextEncoder().encode(this.url)
         const bech32 = NostrTools.nip19.encodeBytes('lnurl', bytes)
-        this.lnurl = `lightning:${bech32.toUpperCase()}`
+        this.lnurl =
+          this.href && this.href.trim() !== ''
+            ? `${this.href}?lightning=${bech32.toUpperCase()}`
+            : `lightning:${bech32.toUpperCase()}`
       } else if (this.tab == 'lud17') {
         if (this.url.startsWith('http://')) {
           this.lnurl = this.url.replace('http://', this.prefix + '://')

lnbits/static/scss/background.scss

@@ -58,11 +58,15 @@ body.bg-image {
 }
 // transparent background for specific elements
 body.body--dark {
-  .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark),
+  .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
+    --q-dark: #{color.adjust(#1d1d1d, $alpha: -0.7)};
+    background-color: var(--q-dark);
+  }
+
   .q-header,
   .q-drawer {
     --q-dark: #{color.adjust(#1d1d1d, $alpha: -0.7)};
     background-color: var(--q-dark);
-    backdrop-filter: blur(6px) brightness(0.8);
+    backdrop-filter: brightness(0.8);
   }
 }

lnbits/static/scss/cards.scss

@@ -61,13 +61,13 @@ body.rounded-ui {
 
 body.card-shadow {
   .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-    filter: drop-shadow(0 10px 24px rgba(0, 0, 0, 0.18));
+    box-shadow: 0 10px 24px rgba(0, 0, 0, 0.18);
   }
 }
 
 body.card-shadow.body--dark {
   .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-    filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
+    box-shadow: 0 12px 28px rgba(0, 0, 0, 0.45);
   }
 }
 

lnbits/templates/pages/payments.vue

@@ -136,7 +136,7 @@
         </q-card>
       </div>
       <div
-        v-show="chartData.showPaymentStatus"
+        v-show="chartData.showPaymentTags"
         class="col-lg-3 col-md-6 col-sm-12 text-center"
       >
         <q-card class="q-pt-sm">

lnbits/wallets/base.py

@@ -94,15 +94,15 @@ class PaymentStatus(NamedTuple):
 
 
 class PaymentSuccessStatus(PaymentStatus):
-    paid = True
+    paid = True  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class PaymentFailedStatus(PaymentStatus):
-    paid = False
+    paid = False  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class PaymentPendingStatus(PaymentStatus):
-    paid = None
+    paid = None  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class Wallet(ABC):

lnbits/wallets/blink.py

@@ -8,7 +8,7 @@ from loguru import logger
 from pydantic import BaseModel
 from websockets import Subprotocol, connect
 
-from lnbits import bolt11
+from lnbits import bolt11 as bolt11_lib
 from lnbits.helpers import normalize_endpoint
 from lnbits.settings import settings
 
@@ -164,15 +164,13 @@ class BlinkWallet(Wallet):
                 ok=False, error_message=f"Unable to connect to {self.endpoint}."
             )
 
-    async def pay_invoice(
+    async def pay_invoice(self, bolt11: str, fee_limit_msat: int) -> PaymentResponse:
-        self, bolt11_invoice: str, fee_limit_msat: int
-    ) -> PaymentResponse:
         # https://dev.blink.sv/api/btc-ln-send
         # Future: add check fee estimate is < fee_limit_msat before paying invoice
 
         payment_variables = {
             "input": {
-                "paymentRequest": bolt11_invoice,
+                "paymentRequest": bolt11,
                 "walletId": self.wallet_id,
                 "memo": "Payment memo",
             }
@@ -190,7 +188,7 @@ class BlinkWallet(Wallet):
                 error_message = errors[0].get("message")
                 return PaymentResponse(ok=False, error_message=error_message)
 
-            checking_id = bolt11.decode(bolt11_invoice).payment_hash
+            checking_id = bolt11_lib.decode(bolt11).payment_hash
 
             payment_status = await self.get_payment_status(checking_id)
             fee_msat = payment_status.fee_msat
@@ -199,7 +197,7 @@ class BlinkWallet(Wallet):
                 ok=True, checking_id=checking_id, fee_msat=fee_msat, preimage=preimage
             )
         except Exception as exc:
-            logger.info(f"Failed to pay invoice {bolt11_invoice}")
+            logger.info(f"Failed to pay invoice {bolt11}")
             logger.warning(exc)
             return PaymentResponse(
                 error_message=f"Unable to connect to {self.endpoint}."

lnbits/wallets/breez.py

@@ -19,7 +19,7 @@ else:
 
     from bolt11 import Bolt11Exception
     from bolt11 import decode as bolt11_decode
-    from breez_sdk import (
+    from breez_sdk import (  # type: ignore[reportMissingImports]
         BreezEvent,
         ConnectRequest,
         EnvironmentType,
@@ -39,7 +39,9 @@ else:
         default_config,
         mnemonic_to_seed,
     )
-    from breez_sdk import PaymentStatus as BreezPaymentStatus
+    from breez_sdk import (
+        PaymentStatus as BreezPaymentStatus,  # type: ignore[reportMissingImports]
+    )
     from loguru import logger
 
     from lnbits.settings import settings

lnbits/wallets/breez_liquid.py

@@ -18,7 +18,7 @@ else:
     from pathlib import Path
 
     from bolt11 import decode as bolt11_decode
-    from breez_sdk_liquid import (
+    from breez_sdk_liquid import (  # type: ignore[reportMissingImports]
         ConnectRequest,
         EventListener,
         GetInfoResponse,

lnbits/wallets/fake.py

@@ -103,7 +103,7 @@ class FakeWallet(Wallet):
             preimage=preimage.hex(),
         )
 
-    async def pay_invoice(self, bolt11: str, _: int) -> PaymentResponse:
+    async def pay_invoice(self, bolt11: str, fee_limit_msat: int) -> PaymentResponse:
         try:
             invoice = decode(bolt11)
         except Bolt11Exception as exc:
@@ -130,7 +130,7 @@ class FakeWallet(Wallet):
             return PaymentPendingStatus()
         return PaymentFailedStatus()
 
-    async def get_payment_status(self, _: str) -> PaymentStatus:
+    async def get_payment_status(self, checking_id: str) -> PaymentStatus:
         return PaymentPendingStatus()
 
     async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:

lnbits/wallets/lndgrpc.py

@@ -118,7 +118,7 @@ class LndWallet(Wallet):
 
         cert = open(cert_path, "rb").read()
         creds = grpc.ssl_channel_credentials(cert)
-        auth_creds = grpc.metadata_call_credentials(self.metadata_callback)
+        auth_creds = grpc.metadata_call_credentials(self.metadata_callback)  # type: ignore[reportArgumentType]
         composite_creds = grpc.composite_channel_credentials(creds, auth_creds)
         channel = grpc.aio.secure_channel(
             f"{self.endpoint}:{self.port}", composite_creds

lnbits/wallets/nwc.py

@@ -88,6 +88,8 @@ class NWCWallet(Wallet):
                         payment_data = await self.conn.call(
                             "lookup_invoice", {"payment_hash": payment["checking_id"]}
                         )
+                        if payment_data.get("payment_hash") != payment["checking_id"]:
+                            raise Exception("Mismatched payment hash")
                         settled = (
                             "settled_at" in payment_data
                             and payment_data["settled_at"]
@@ -264,6 +266,8 @@ class NWCWallet(Wallet):
                 payment_data = await self.conn.call(
                     "lookup_invoice", {"payment_hash": checking_id}
                 )
+                if payment_data.get("payment_hash") != checking_id:
+                    raise Exception("Mismatched payment hash")
                 settled = payment_data.get("settled_at", None) and payment_data.get(
                     "preimage", None
                 )
@@ -520,8 +524,9 @@ class NWCConnection:
         """
         sub_id = cast(str, msg[1])
         event = cast(dict, msg[2])
-        if not verify_event(event):  # Ensure the event is valid (do not trust relays)
+        # Ensure the event is valid (do not trust relays)
-            raise Exception("Invalid event signature")
+        if not verify_event(event) or event.get("pubkey") != self.service_pubkey_hex:
+            raise Exception("Invalid event")
         tags = event["tags"]
         if event["kind"] == 13194:  # An info event
             # info events are handled specially,
@@ -687,6 +692,7 @@ class NWCConnection:
             "#p": [self.account_public_key_hex],
             "#e": [event["id"]],
             "since": event["created_at"],
+            "authors": [self.service_pubkey_hex],
         }
         sub_id = self._get_new_subid()
         # register a future to receive the response asynchronously

package-lock.json

@@ -24,7 +24,7 @@
         "clean-css-cli": "^5.6.3",
         "concat": "^1.0.3",
         "prettier": "^3.8.3",
-        "pyright": "1.1.289",
+        "pyright": "1.1.409",
         "sass": "^1.99.0",
         "terser": "^5.47.1"
       }
@@ -1808,9 +1808,9 @@
       }
     },
     "node_modules/pyright": {
-      "version": "1.1.289",
+      "version": "1.1.409",
-      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.289.tgz",
+      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.409.tgz",
-      "integrity": "sha512-fG3STxnwAt3i7bxbXUPJdYNFrcOWHLwCSEOySH2foUqtYdzWLcxDez0Kgl1X8LMQx0arMJ6HRkKghxfRD1/z6g==",
+      "integrity": "sha512-13VFQyw4mJzshZxcxiYbNjo1hG/WHSRDj70Y3lbJEHqCkI2dvBAUTti8VV6Ezsr5gT93pFvC0e/jAQS4JdHarA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -1818,7 +1818,10 @@
         "pyright-langserver": "langserver.index.js"
       },
       "engines": {
-        "node": ">=12.0.0"
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
       }
     },
     "node_modules/qrcode.vue": {

package.json

@@ -16,7 +16,7 @@
     "clean-css-cli": "^5.6.3",
     "concat": "^1.0.3",
     "prettier": "^3.8.3",
-    "pyright": "1.1.289",
+    "pyright": "1.1.409",
     "sass": "^1.99.0",
     "terser": "^5.47.1"
   },

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lnbits"
-version = "1.5.4"
+version = "1.5.5-rc2"
 requires-python = ">=3.10,<3.13"
 description = "LNbits, free and open-source Lightning wallet and accounts system."
 authors = [{ name = "Alan Bits", email = "alan@lnbits.com" }]

tests/api/test_auth_api.py

@@ -72,9 +72,43 @@ async def test_auth_api_sso_login_and_callback(http_client: AsyncClient, mocker)
     login_sso = _FakeSSO()
     mocker.patch("lnbits.core.views.auth_api._new_sso", return_value=login_sso)
 
-    response = await http_client.get(
+    unauthenticated = await http_client.get(
         f"/api/v1/auth/{provider}", params={"user_id": user.id}
     )
+    assert unauthenticated.status_code == 403
+    assert unauthenticated.json()["detail"] == "User ID mismatch."
+
+    other_user = await create_user_account(
+        Account(
+            id=uuid4().hex,
+            username=f"user_{uuid4().hex[:8]}",
+            email=f"user_{uuid4().hex[:8]}@lnbits.com",
+        )
+    )
+    other_login = await http_client.post(
+        "/api/v1/auth/usr", json={"usr": other_user.id}
+    )
+    http_client.cookies.clear()
+    assert other_login.status_code == 200
+    other_headers = {
+        "Authorization": f"Bearer {other_login.json()['access_token']}",
+    }
+    wrong_user = await http_client.get(
+        f"/api/v1/auth/{provider}",
+        params={"user_id": user.id},
+        headers=other_headers,
+    )
+    assert wrong_user.status_code == 403
+    assert wrong_user.json()["detail"] == "User ID mismatch."
+
+    login = await http_client.post("/api/v1/auth/usr", json={"usr": user.id})
+    http_client.cookies.clear()
+    assert login.status_code == 200
+    headers = {"Authorization": f"Bearer {login.json()['access_token']}"}
+
+    response = await http_client.get(
+        f"/api/v1/auth/{provider}", params={"user_id": user.id}, headers=headers
+    )
     assert response.status_code == 307
     assert response.headers["location"] == "https://example.com/sso/login"
     assert login_sso.redirect_uri == f"{http_client.base_url}/api/v1/auth/github/token"

tests/api/test_callback_api.py

@@ -194,7 +194,7 @@ async def test_callback_api_handles_revolut_subscription_event(
     settings.revolut_api_secret_key = "revolut-secret"
     settings.revolut_api_version = "2026-04-20"
     revolut_provider = RevolutWallet()
-    mocker.patch.object(
+    get_subscription_mock = mocker.patch.object(
         revolut_provider,
         "get_subscription",
         return_value={
@@ -253,23 +253,10 @@ async def test_callback_api_handles_revolut_subscription_event(
         }
     )
 
-    assert create_wallet_invoice_mock.await_count == 1
+    get_subscription_mock.assert_not_awaited()
-    called_wallet_id, invoice = create_wallet_invoice_mock.await_args.args
+    create_wallet_invoice_mock.assert_not_awaited()
-    assert called_wallet_id == "wallet_1"
+    update_payment_mock.assert_not_awaited()
-    assert invoice.amount == 9.25
+    fiat_status_mock.assert_not_awaited()
-    assert invoice.memo == "Revolut Members"
-    assert invoice.external_id == "SUBSCRIPTION_1"
-    assert invoice.internal is True
-    assert invoice.extra["fiat_method"] == "subscription"
-    assert invoice.extra["subscription"]["checking_id"] == "order_ORDER_SUB_1"
-    assert payment.fiat_provider == "revolut"
-    assert payment.fee == -2
-    assert payment.extra["fiat_checking_id"] == "order_ORDER_SUB_1"
-    assert payment.checking_id == "fiat_revolut_order_ORDER_SUB_1"
-    update_payment_mock.assert_awaited_once_with(
-        payment, "fiat_revolut_order_ORDER_SUB_1"
-    )
-    fiat_status_mock.assert_awaited_once_with(payment)
 
 
 @pytest.mark.anyio
@@ -353,10 +340,9 @@ async def test_callback_api_handles_revolut_subscription_order_event(
 
     assert get_payment_mock.await_count == 2
     get_payment_mock.assert_any_await("fiat_revolut_order_ORDER_SUB_1")
-    assert get_order_mock.await_count == 2
+    assert get_order_mock.await_count == 1
     assert [call.args for call in get_subscription_mock.await_args_list] == [
         ("SUBSCRIPTION_1",),
-        ("SUBSCRIPTION_1",),
     ]
     assert create_wallet_invoice_mock.await_count == 1
     called_wallet_id, invoice = create_wallet_invoice_mock.await_args.args

tests/api/test_lnurl_api.py

@@ -1,3 +1,4 @@
+from typing import cast
 from uuid import uuid4
 
 import pytest
@@ -106,7 +107,7 @@ async def test_lnurl_api_auth_and_pay_flow(mocker):
         await api_perform_lnurlauth(auth_response, wallet_info)
 
     action_response = LnurlPayActionResponse(
-        pr=LightningInvoice(TEST_BOLT11),
+        pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11)),
         disposable=False,
         successAction=parse_obj_as(MessageAction, {"message": "paid"}),
     )

tests/api/test_payment_api.py

@@ -6,7 +6,7 @@ import pytest
 from fastapi import HTTPException
 from pydantic import ValidationError
 
-from lnbits.core.crud.payments import create_payment, get_payments
+from lnbits.core.crud.payments import create_payment, get_payment, get_payments
 from lnbits.core.models import Account, CreateInvoice, PaymentFilters, PaymentState
 from lnbits.core.models.payments import CancelInvoice, CreatePayment, SettleInvoice
 from lnbits.core.models.users import AccountId
@@ -161,7 +161,7 @@ async def test_payment_api_fee_reserve_and_hold_invoice_actions(mocker):
         wallet.id, CreateInvoice(out=False, amount=42, memo="reserve")
     )
     reserve = await api_payments_fee_reserve(invoice.bolt11)
-    assert json.loads(reserve.body)["fee_reserve"] >= 0
+    assert json.loads(bytes(reserve.body))["fee_reserve"] >= 0
 
     with pytest.raises(HTTPException, match="Invoice has no amount."):
         await api_payments_fee_reserve(ZERO_AMOUNT_INVOICE)
@@ -218,6 +218,164 @@ async def test_payment_api_fee_reserve_and_hold_invoice_actions(mocker):
     cancel_mock.assert_awaited_once()
 
 
+@pytest.mark.anyio
+async def test_payment_extra_update_appends_new_keys(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    checking_id = await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+        tag="splitpayments",
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={
+            "payment_hash": payment_hash,
+            "extra": {"child": "daughter", "compliance_note": "reviewed"},
+        },
+    )
+
+    assert response.status_code == 200
+    extra = response.json()["extra"]
+    assert extra["tag"] == "splitpayments"
+    assert extra["child"] == "daughter"
+    assert extra["compliance_note"] == "reviewed"
+
+    payment = await get_payment(checking_id)
+    assert payment.extra == extra
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_creates_extra_when_missing(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    checking_id = await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "reviewed"}},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["extra"] == {"note": "reviewed"}
+
+    payment = await get_payment(checking_id)
+    assert payment.extra == {"note": "reviewed"}
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_rejects_existing_keys(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    checking_id = await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+        tag="original",
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"tag": "overwritten"}},
+    )
+
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Extra keys already exist: tag."
+
+    payment = await get_payment(checking_id)
+    assert payment.extra == {"tag": "original"}
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_requires_admin_key(
+    client,
+    to_wallet,
+    inkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=inkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "invoice key"}},
+    )
+
+    assert response.status_code == 403
+    assert response.json()["detail"] == "Invalid adminkey."
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_is_wallet_scoped(
+    client,
+    from_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    await _create_payment(
+        from_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "wrong wallet"}},
+    )
+
+    assert response.status_code == 404
+    assert response.json()["detail"] == "Payment does not exist."
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_requires_successful_payment(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+        status=PaymentState.PENDING,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "too early"}},
+    )
+
+    assert response.status_code == 400
+    assert (
+        response.json()["detail"] == "Payment extra can only be updated after success."
+    )
+
+
 async def _create_payment(
     wallet_id: str,
     *,

tests/unit/test_services_lnurl.py

@@ -1,3 +1,4 @@
+from typing import cast
 from uuid import uuid4
 
 import pytest
@@ -86,7 +87,9 @@ async def test_get_pr_from_lnurl_success_and_error(mocker: MockerFixture):
     mocker.patch(
         "lnbits.core.services.lnurl.execute_pay_request",
         mocker.AsyncMock(
-            return_value=LnurlPayActionResponse(pr=LightningInvoice(TEST_BOLT11))
+            return_value=LnurlPayActionResponse(
+                pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11))
+            )
         ),
     )
 
@@ -106,7 +109,7 @@ async def test_fetch_lnurl_pay_request_converts_currency_and_stores_paylink(
 ):
     pay_response = make_lnurl_pay_response(min_sendable_msat=1, text="Test")
     action_response = LnurlPayActionResponse(
-        pr=LightningInvoice(TEST_BOLT11), disposable=False
+        pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11)), disposable=False
     )
     mocker.patch(
         "lnbits.core.services.lnurl.fiat_amount_as_satoshis",
@@ -143,7 +146,7 @@ async def test_store_paylink_appends_and_updates_existing():
     wallet = await _create_wallet()
     pay_response = make_lnurl_pay_response(min_sendable_msat=1, text="Test")
     action_response = LnurlPayActionResponse(
-        pr=LightningInvoice(TEST_BOLT11), disposable=False
+        pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11)), disposable=False
     )
 
     await store_paylink(

tests/unit/test_services_users.py

@@ -1,3 +1,4 @@
+from typing import Any
 from uuid import uuid4
 
 import pytest
@@ -66,7 +67,7 @@ async def test_create_user_account_no_check_rejects_duplicate_identity_fields(
     existing = _account(**existing_data)
     await create_account(existing)
 
-    resolved = {
+    resolved: dict[str, Any] = {
         key: (value(existing) if callable(value) else value)
         for key, value in new_data.items()
     }

tests/unit/test_settings.py

@@ -1,3 +1,5 @@
+from typing import Any
+
 import pytest
 from pytest_mock.plugin import MockerFixture
 
@@ -14,22 +16,22 @@ from lnbits.settings import (
     set_cli_settings,
 )
 
-lnurlp_redirect_path = {
+lnurlp_redirect_path: dict[str, Any] = {
     "from_path": "/.well-known/lnurlp",
     "redirect_to_path": "/api/v1/well-known",
 }
-lnurlp_redirect_path_with_headers = {
+lnurlp_redirect_path_with_headers: dict[str, Any] = {
     "from_path": "/.well-known/lnurlp",
     "redirect_to_path": "/api/v1/well-known",
     "header_filters": {"accept": "application/nostr+json"},
 }
 
-lnaddress_redirect_path = {
+lnaddress_redirect_path: dict[str, Any] = {
     "from_path": "/.well-known/lnurlp",
     "redirect_to_path": "/api/v1/well-known",
 }
 
-nostrrelay_redirect_path = {
+nostrrelay_redirect_path: dict[str, Any] = {
     "from_path": "/",
     "redirect_to_path": "/api/v1/relay-info",
     "header_filters": {"accept": "application/nostr+json"},

tests/wallets/test_blink.py

@@ -1,4 +1,5 @@
 import os
+from typing import cast
 
 import pytest
 from loguru import logger
@@ -29,7 +30,7 @@ logger.info(f"settings.blink_api_endpoint: {settings.blink_api_endpoint}")
 logger.info(f"settings.blink_token: {settings.blink_token}")
 
 set_funding_source()
-funding_source = get_funding_source()
+funding_source = cast(BlinkWallet, get_funding_source())
 assert isinstance(funding_source, BlinkWallet)
 
 

tests/wallets/test_rpc_wallets.py

@@ -1,4 +1,5 @@
 import importlib
+from typing import Any
 from unittest.mock import AsyncMock, Mock
 
 import pytest
@@ -80,7 +81,9 @@ def _check_calls(expected_calls):
         for func_call in func_calls:
             req = func_call["request_data"]
             args = req["args"] if "args" in req else {}
-            kwargs = _eval_dict(req["kwargs"]) if "kwargs" in req else {}
+            kwargs: dict[str, Any] = (
+                _eval_dict(req["kwargs"]) or {} if "kwargs" in req else {}
+            )
 
             if "klass" in req:
                 *rest, cls = req["klass"].split(".")
@@ -166,7 +169,7 @@ def _mock_field(field):
     return response
 
 
-def _eval_dict(data: dict | None) -> dict | None:
+def _eval_dict(data: dict | None) -> dict[str, Any] | None:
     fn_prefix = "__eval__:"
     if not data:
         return data
@@ -215,9 +218,9 @@ def _data_mock(data: dict) -> Mock:
 def _raise(error: dict | None):
     if not error:
         return Exception()
-    data = error["data"] if "data" in error else None
+    data: dict[str, Any] = error["data"] if "data" in error else {}
     if "module" not in error or "class" not in error:
-        return Exception(data)
+        return Exception(data or None)
 
     error_module = importlib.import_module(error["module"])
     error_class = getattr(error_module, error["class"])

uv.lock

@@ -1075,11 +1075,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.14"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/05/b1/efac073e0c297ecf2fb33c346989a529d4e19164f1759102dee5953ee17e/idna-3.14.tar.gz", hash = "sha256:466d810d7a2cc1022bea9b037c39728d51ae7dad40d480fc9b7d7ecf98ba8ee3", size = 198272, upload-time = "2026-05-10T20:32:15.935Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6c/3c/3f62dee257eb3d6b2c1ef2a09d36d9793c7111156a73b5654d2c2305e5ce/idna-3.14-py3-none-any.whl", hash = "sha256:e677eaf072e290f7b725f9acf0b3a2bd55f9fd6f7c70abe5f0e34823d0accf69", size = 72184, upload-time = "2026-05-10T20:32:14.295Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -1275,7 +1275,7 @@ wheels = [
 
 [[package]]
 name = "lnbits"
-version = "1.5.4"
+version = "1.5.5rc2"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },