mock import

should open the way for custom root-path

.github/workflows/appimage.yml

@@ -7,10 +7,6 @@ on:
         description: 'The tag name for the release'
         required: true
         type: string
-      upload_url:
-        description: 'The upload URL for the release'
-        required: true
-        type: string
 
   workflow_dispatch:
     inputs:
@@ -18,10 +14,6 @@ on:
         description: 'The tag name for the release'
         required: true
         type: string
-      upload_url:
-        description: 'The upload URL for the release'
-        required: true
-        type: string
 
 jobs:
   build-linux-package:
@@ -113,11 +105,6 @@ jobs:
         shell: bash
 
       - name: Upload Linux Release Asset
-        uses: actions/upload-release-asset@v1
-        with:
-          upload_url: ${{ inputs.upload_url }}
-          asset_path: ${{ env.APPIMAGE_NAME }}
-          asset_name: ${{ env.APPIMAGE_NAME }}
-          asset_content_type: application/octet-stream
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "${{ inputs.tag_name }}" "${{ env.APPIMAGE_NAME }}" --clobber

.github/workflows/bundle.yml

@@ -10,15 +10,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.head_ref }}
+          ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || github.event.pull_request.head.sha }}
       - uses: lnbits/lnbits/.github/actions/prepare@dev
         with:
           python-version: "3.10"
           node-version: "24.x"
           npm: true
-      - run: make bundle
-      - name: Commit and push bundle changes
+      - name: Build and commit bundle (same-repo PR)
+        if: github.event.pull_request.head.repo.full_name == github.repository
         run: |
+          make bundle
           git config user.name "alan"
           git config user.email "alan@lnbits.com"
           git add lnbits/static
@@ -27,3 +28,6 @@ jobs:
           fi
           git commit -m "chore: make bundle [skip ci]"
           git push
+      - name: Check bundle is up-to-date (fork PR)
+        if: github.event.pull_request.head.repo.full_name != github.repository
+        run: make checkbundle

.github/workflows/regtest.yml

@@ -66,6 +66,7 @@ jobs:
           BOLTZ_MNEMONIC: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
           LNBITS_MAX_OUTGOING_PAYMENT_AMOUNT_SATS: 1000000000
           LNBITS_MAX_INCOMING_PAYMENT_AMOUNT_SATS: 1000000000
+          LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS: ${{ inputs.backend-wallet-class == 'CoreLightningRestWallet' && 60 || 5 }}
           ECLAIR_PASS: lnbits
           PYTHONUNBUFFERED: 1
           DEBUG: true

.github/workflows/release-rc.yml

@@ -12,8 +12,6 @@ jobs:
 
   release:
     runs-on: ubuntu-24.04
-    outputs:
-      upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
     steps:
       - uses: actions/checkout@v4
       - name: Create github pre-release
@@ -22,14 +20,6 @@ jobs:
           tag: ${{ github.ref_name }}
         run: |
           gh release create "$tag" --prerelease --generate-notes --draft
-      - id: get_upload_url
-        name: Get upload url of Github release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          tag: ${{ github.ref_name }}
-        run: |
-          upload_url=$(gh release view "$tag" --json uploadUrl -q ".uploadUrl")
-          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"
 
   docker:
     if: github.repository == 'lnbits/lnbits'
@@ -74,4 +64,3 @@ jobs:
     uses: ./.github/workflows/appimage.yml
     with:
       tag_name: ${{ github.ref_name }}
-      upload_url: ${{ needs.release.outputs.upload_url }}

.github/workflows/release.yml

@@ -13,8 +13,6 @@ jobs:
 
   release:
     runs-on: ubuntu-24.04
-    outputs:
-      upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
     steps:
       - uses: actions/checkout@v4
       - name: Create github release
@@ -23,14 +21,6 @@ jobs:
           tag: ${{ github.ref_name }}
         run: |
           gh release create "$tag" --generate-notes --draft
-      - id: get_upload_url
-        name: Get upload url of Github release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          tag: ${{ github.ref_name }}
-        run: |
-          upload_url=$(gh release view "$tag" --json uploadUrl -q ".uploadUrl")
-          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"
 
   docker:
     if: github.repository == 'lnbits/lnbits'
@@ -85,4 +75,3 @@ jobs:
     uses: ./.github/workflows/appimage.yml
     with:
       tag_name: ${{ github.ref_name }}
-      upload_url: ${{ needs.release.outputs.upload_url }}

docs/guide/installation.md

@@ -51,7 +51,7 @@ nav_order: 1
 sudo apt-get install jq libfuse2
 wget $(curl -s https://api.github.com/repos/lnbits/lnbits/releases/latest | jq -r '.assets[] | select(.name | endswith(".AppImage")) | .browser_download_url') -O LNbits-latest.AppImage
 chmod +x LNbits-latest.AppImage
-LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
+LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 AUTH_HTTPS_ONLY=false ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
 ```
 
 - LNbits will create a folder for DB and extension files **in the same directory** as the AppImage.
@@ -285,10 +285,7 @@ but you can also set the env variables or pass command line arguments:
 
 ```sh
 # .env variables are currently passed when running, but LNbits can be managed with the admin UI.
-LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000 --host 0.0.0.0
-
-# Once you have created a user, you can set as the super_user
-SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
+LNBITS_ADMIN_UI=true AUTH_HTTPS_ONLY=false ./result/bin/lnbits --port 9000 --host 0.0.0.0
 ```
 
 > ![NOTE](https://img.shields.io/badge/NOTE-3b82f6?labelColor=494949)

lnbits/app.py

@@ -23,29 +23,35 @@ from lnbits.core.crud import (
     get_installed_extensions,
     update_installed_extension_state,
 )
+from lnbits.core.crud.audit import delete_expired_audit_entries
 from lnbits.core.crud.extensions import create_installed_extension
 from lnbits.core.helpers import migrate_extension_database
 from lnbits.core.models.notifications import NotificationType
 from lnbits.core.services.extensions import deactivate_extension, get_valid_extensions
-from lnbits.core.services.notifications import enqueue_admin_notification
-from lnbits.core.services.payments import check_pending_payments
+from lnbits.core.services.funding_source import (
+    check_balance_delta_changed,
+    check_server_balance_against_node,
+)
+from lnbits.core.services.notifications import (
+    dispatch_payment_notification,
+    enqueue_admin_notification,
+    process_next_notification,
+)
+from lnbits.core.services.payments import (
+    check_pending_payments,
+    fundingsource_invoice_producer,
+)
 from lnbits.core.tasks import (
     audit_queue,
     collect_exchange_rates_data,
-    purge_audit_data,
-    run_by_the_minute_tasks,
-    wait_for_audit_data,
-    wait_for_paid_invoices,
-    wait_notification_messages,
+    notify_server_status,
+    process_next_audit_entry,
+    refresh_extension_cache,
 )
 from lnbits.exceptions import register_exception_handlers
 from lnbits.helpers import version_parse
+from lnbits.llms_txt import create_llms_txt_route
 from lnbits.settings import settings
-from lnbits.tasks import (
-    cancel_all_tasks,
-    create_permanent_task,
-    register_invoice_listener,
-)
 from lnbits.utils.cache import cache
 from lnbits.utils.logger import (
     configure_logger,
@@ -68,7 +74,7 @@ from .middleware import (
     add_profiler_middleware,
     add_ratelimit_middleware,
 )
-from .tasks import internal_invoice_listener, invoice_listener, run_interval
+from .task_manager import task_manager
 
 
 async def startup(app: FastAPI):
@@ -102,6 +108,9 @@ async def startup(app: FastAPI):
     # register core routes
     init_core_routers(app)
 
+    # register llms.txt endpoint for AI agents
+    create_llms_txt_route(app)
+
     # initialize tasks
     register_async_tasks()
 
@@ -129,7 +138,7 @@ async def shutdown():
     settings.lnbits_running = False
 
     # shutdown event
-    cancel_all_tasks()
+    task_manager.cancel_all_tasks()
 
     # wait a bit to allow them to finish, so that cleanup can run without problems
     await asyncio.sleep(0.1)
@@ -377,7 +386,6 @@ def register_custom_extensions_path():
     upgrades_dir = settings.lnbits_extensions_upgrade_path
     shutil.rmtree(upgrades_dir, True)
     Path(upgrades_dir).mkdir(parents=True, exist_ok=True)
-    sys.path.append(str(upgrades_dir))
 
     if settings.has_default_extension_path:
         return
@@ -432,10 +440,54 @@ def register_ext_tasks(ext: Extension) -> None:
 
 def register_ext_routes(app: FastAPI, ext: Extension) -> None:
     """Register FastAPI routes for extension."""
-    ext_module = importlib.import_module(ext.module_name)
+    module_name = ext.module_name
+    # Clear all cached sub-modules so a fresh import picks up new files from ext_dir.
+    # A simple reload() would reuse cached sub-modules (e.g. views_api) and serve
+    # stale code even after the extension files have been replaced on disk.
+    stale = [
+        k for k in sys.modules if k == module_name or k.startswith(f"{module_name}.")
+    ]
+    for k in stale:
+        del sys.modules[k]
+    if stale:
+        # Pydantic v1 keeps a global _FUNCS set of validator qualnames to detect
+        # duplicates. Clear the extension's entries so reimport doesn't raise
+        # "duplicate validator" errors for validators with the same qualname.
+        try:
+            import pydantic.class_validators as _pydantic_cv
+
+            _pydantic_cv._FUNCS = {
+                f for f in _pydantic_cv._FUNCS if not f.startswith(f"{module_name}.")
+            }
+        except (ImportError, AttributeError):
+            pass
+    ext_module = importlib.import_module(module_name)
 
     ext_route = getattr(ext_module, f"{ext.code}_ext")
 
+    ext_redirects = (
+        getattr(ext_module, f"{ext.code}_redirect_paths")
+        if hasattr(ext_module, f"{ext.code}_redirect_paths")
+        else []
+    )
+
+    settings.activate_extension_paths(ext.code, ext_redirects)
+
+    # Remove existing routes for this extension before re-registering so that
+    # an upgraded extension replaces the old one at the same paths (no prefix).
+    ext_prefix = f"/{ext.code}"
+    app.router.routes = [
+        r
+        for r in app.router.routes
+        if not (
+            getattr(r, "path", "") == ext_prefix
+            or getattr(r, "path", "").startswith(f"{ext_prefix}/")
+        )
+    ]
+    # Invalidate FastAPI's cached OpenAPI schema so the next /openapi.json
+    # request reflects the updated routes.
+    app.openapi_schema = None
+
     if hasattr(ext_module, f"{ext.code}_static_files"):
         ext_statics = getattr(ext_module, f"{ext.code}_static_files")
         for s in ext_statics:
@@ -444,17 +496,8 @@ def register_ext_routes(app: FastAPI, ext: Extension) -> None:
             )
             app.mount(s["path"], StaticFiles(directory=static_dir), s["name"])
 
-    ext_redirects = (
-        getattr(ext_module, f"{ext.code}_redirect_paths")
-        if hasattr(ext_module, f"{ext.code}_redirect_paths")
-        else []
-    )
-
-    settings.activate_extension_paths(ext.code, ext.upgrade_hash, ext_redirects)
-
     logger.trace(f"Adding route for extension {ext_module}.")
-    prefix = f"/upgrades/{ext.upgrade_hash}" if ext.upgrade_hash != "" else ""
-    app.include_router(router=ext_route, prefix=prefix)
+    app.include_router(router=ext_route)
 
 
 async def check_and_register_extensions(app: FastAPI) -> None:
@@ -469,29 +512,42 @@ async def check_and_register_extensions(app: FastAPI) -> None:
 
 def register_async_tasks() -> None:
 
-    create_permanent_task(wait_for_audit_data)
-    create_permanent_task(wait_notification_messages)
+    task_manager.init()
 
-    create_permanent_task(
-        run_interval(
-            settings.lnbits_funding_source_pending_interval_seconds,
-            check_pending_payments,
-        )
+    # listen to all incoming payments and dispatch payment notifications
+    # note: should be the first in task list for a bit quicker notifications
+    task_manager.register_invoice_listener(dispatch_payment_notification, "core")
+
+    # periodic tasks
+    task_manager.create_permanent_task(cache.invalidate_cache, interval=10)
+    task_manager.create_permanent_task(delete_expired_audit_entries, interval=60 * 60)
+    task_manager.create_permanent_task(
+        check_pending_payments,
+        interval=settings.lnbits_funding_source_pending_interval_seconds,
     )
-    create_permanent_task(invoice_listener)
-    create_permanent_task(internal_invoice_listener)
-    create_permanent_task(cache.invalidate_forever)
+    task_manager.create_permanent_task(
+        collect_exchange_rates_data,
+        interval=max(60, settings.lnbits_exchange_history_refresh_interval_seconds),
+    )
+    task_manager.create_permanent_task(check_balance_delta_changed, interval=60)
+    task_manager.create_permanent_task(
+        check_server_balance_against_node,
+        interval=60 * settings.lnbits_watchdog_interval_minutes,
+    )
+    task_manager.create_permanent_task(
+        notify_server_status,
+        interval=60 * 60 * settings.lnbits_notification_server_status_hours,
+    )
+    task_manager.create_permanent_task(refresh_extension_cache, interval=60)
 
-    # core invoice listener
-    invoice_queue: asyncio.Queue = asyncio.Queue()
-    register_invoice_listener(invoice_queue, "core")
-    create_permanent_task(lambda: wait_for_paid_invoices(invoice_queue))
-
-    create_permanent_task(run_by_the_minute_tasks)
-    create_permanent_task(purge_audit_data)
-    create_permanent_task(collect_exchange_rates_data)
+    # permanent tasks run in a loop, will be restarted if they fail
+    task_manager.create_permanent_task(fundingsource_invoice_producer)
+    task_manager.create_permanent_task(process_next_notification)
+    task_manager.create_permanent_task(process_next_audit_entry)
 
     # server logs for websocket
     if settings.lnbits_admin_ui:
         server_log_task = initialize_server_websocket_logger()
-        create_permanent_task(server_log_task)
+        task_manager.create_permanent_task(
+            server_log_task, name="server_websocket_logger"
+        )

lnbits/commands.py

@@ -1,6 +1,5 @@
 import asyncio
 import importlib
-import sys
 import time
 from functools import wraps
 from getpass import getpass
@@ -377,10 +376,6 @@ async def extensions_update(  # noqa: C901
     if not await _can_run_operation(url):
         return
 
-    upgrades_dir = settings.lnbits_extensions_upgrade_path
-    Path(upgrades_dir).mkdir(parents=True, exist_ok=True)
-    sys.path.append(str(upgrades_dir))
-
     if extension:
         await update_extension(extension, repo_index, source_repo, url, admin_user)
         return

lnbits/core/crud/payments.py

@@ -290,6 +290,7 @@ async def create_payment(
         webhook=data.webhook,
         fee=-abs(data.fee),
         tag=extra.get("tag", None),
+        extension=data.extension,
         extra=extra,
         labels=data.labels or [],
         external_id=data.external_id,
@@ -306,7 +307,7 @@ async def update_payment_checking_id(
     await (conn or db).execute(
         f"""
             UPDATE apipayments
-            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder('now')}
+            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder("now")}
             WHERE checking_id = :old_id
         """,  # noqa: S608
         {
@@ -321,13 +322,15 @@ async def update_payment(
     payment: Payment,
     new_checking_id: str | None = None,
     conn: Connection | None = None,
-) -> None:
+) -> Payment:
     payment.updated_at = datetime.now(timezone.utc)
     await (conn or db).update(
         "apipayments", payment, "WHERE checking_id = :checking_id"
     )
     if new_checking_id and new_checking_id != payment.checking_id:
         await update_payment_checking_id(payment.checking_id, new_checking_id, conn)
+        payment.checking_id = new_checking_id
+    return payment
 
 
 async def get_payments_history(
@@ -399,7 +402,6 @@ async def get_payment_count_stats(
     user_id: str | None = None,
     conn: Connection | None = None,
 ) -> list[PaymentCountStat]:
-
     if not filters:
         filters = Filters()
     extra_stmts = []
@@ -432,7 +434,6 @@ async def get_daily_stats(
     user_id: str | None = None,
     conn: Connection | None = None,
 ) -> tuple[list[PaymentDailyStats], list[PaymentDailyStats]]:
-
     if not filters:
         filters = Filters()
 
@@ -482,7 +483,6 @@ async def get_wallets_stats(
     user_id: str | None = None,
     conn: Connection | None = None,
 ) -> list[PaymentWalletStats]:
-
     if not filters:
         filters = Filters()
 

lnbits/core/crud/settings.py

@@ -8,11 +8,18 @@ from lnbits.db import dict_to_model
 from lnbits.settings import (
     AdminSettings,
     EditableSettings,
+    FundingSourcesSettings,
     SettingsField,
     SuperSettings,
     settings,
 )
 
+RESET_PRESERVED_SETTINGS = (
+    "lnbits_webpush_pubkey",
+    "lnbits_webpush_privkey",
+    *FundingSourcesSettings.__fields__,
+)
+
 
 async def get_super_settings() -> SuperSettings | None:
     data = await get_settings_by_tag("core")
@@ -69,16 +76,14 @@ async def delete_admin_settings(tag: str | None = "core") -> None:
 
 
 async def reset_core_settings() -> None:
-    await db.execute(
-        """
-        DELETE FROM system_settings WHERE tag = 'core'
-        AND id NOT IN (
-            'super_user',
-            'lnbits_webpush_pubkey',
-            'lnbits_webpush_privkey'
-        )
-        """,
-    )
+    core_settings = await get_settings_by_tag("core") or {}
+    super_user = await get_settings_field("super_user")
+    await delete_admin_settings()
+    if super_user:
+        await set_settings_field("super_user", super_user.value)
+    for field in RESET_PRESERVED_SETTINGS:
+        if field in core_settings:
+            await set_settings_field(field, core_settings[field])
 
 
 async def create_admin_settings(super_user: str, new_settings: dict) -> SuperSettings:

lnbits/core/models/__init__.py

@@ -25,6 +25,7 @@ from .payments import (
     PaymentState,
     PaymentWalletStats,
     SettleInvoice,
+    UpdatePaymentExtra,
 )
 from .tinyurl import TinyURL
 from .users import (
@@ -90,6 +91,7 @@ __all__ = [
     "SimpleStatus",
     "TinyURL",
     "UpdateBalance",
+    "UpdatePaymentExtra",
     "UpdateSuperuserPassword",
     "UpdateUser",
     "UpdateUserPassword",

lnbits/core/models/extensions.py

@@ -6,7 +6,6 @@ import json
 import os
 import shutil
 import zipfile
-from asyncio.tasks import create_task
 from pathlib import Path
 from typing import Any
 
@@ -21,6 +20,7 @@ from lnbits.helpers import (
     version_parse,
 )
 from lnbits.settings import settings
+from lnbits.task_manager import task_manager
 from lnbits.utils.cache import cache
 
 
@@ -55,9 +55,10 @@ class GitHubRelease(BaseModel):
 
 
 class Manifest(BaseModel):
-    featured: list[str] = []
     extensions: list[ExplicitRelease] = []
     repos: list[GitHubRelease] = []
+    featured: list[str] = []
+    categories: dict[str, list[str]] = {}
 
 
 class GitHubRepoRelease(BaseModel):
@@ -146,21 +147,13 @@ class Extension(BaseModel):
     name: str | None = None
     short_description: str | None = None
     tile: str | None = None
-    upgrade_hash: str | None = ""
 
     @property
     def module_name(self) -> str:
-        if self.is_upgrade_extension:
-            return f"{self.code}-{self.upgrade_hash}"
-
         if settings.has_default_extension_path:
             return f"lnbits.extensions.{self.code}"
         return self.code
 
-    @property
-    def is_upgrade_extension(self) -> bool:
-        return self.upgrade_hash != ""
-
     @classmethod
     def from_installable_ext(cls, ext_info: InstallableExtension) -> Extension:
         return Extension(
@@ -169,7 +162,6 @@ class Extension(BaseModel):
             name=ext_info.name,
             short_description=ext_info.short_description,
             tile=ext_info.icon,
-            upgrade_hash=ext_info.hash if ext_info.ext_upgrade_dir.is_dir() else "",
         )
 
 
@@ -308,7 +300,6 @@ class ExtensionRelease(BaseModel):
 
     @classmethod
     async def fetch_release_details(cls, details_link: str) -> dict | None:
-
         try:
             async with httpx.AsyncClient() as client:
                 resp = await client.get(details_link)
@@ -333,6 +324,7 @@ class ExtensionMeta(BaseModel):
     dependencies: list[str] = []
     archive: str | None = None
     featured: bool = False
+    categories: list[str] = []
     paid_features: str | None = None
     has_paid_release: bool = False
     has_free_release: bool = False
@@ -374,9 +366,6 @@ class InstallableExtension(BaseModel):
 
     @property
     def module_name(self) -> str:
-        if self.ext_upgrade_dir.is_dir():
-            return f"{self.id}-{self.hash}"
-
         if settings.has_default_extension_path:
             return f"lnbits.extensions.{self.id}"
         return self.id
@@ -467,6 +456,7 @@ class InstallableExtension(BaseModel):
 
         shutil.rmtree(self.ext_dir, True)
         shutil.copytree(Path(self.ext_upgrade_dir), Path(self.ext_dir))
+        shutil.rmtree(self.ext_upgrade_dir, True)
         logger.info(f"Extension {self.name} ({self.installed_version}) extracted.")
 
     def clean_extension_files(self):
@@ -641,7 +631,10 @@ class InstallableExtension(BaseModel):
 
         if cache_value.older_than(10 * 60) or post_refresh_cache:
             # refresh cache in background if older than 10 minutes or requested
-            create_task(cls._refresh_installable_extensions_cache())
+            task_manager.create_task(
+                cls._refresh_installable_extensions_cache(),
+                "refresh_installable_extensions_cache",
+            )
 
         extension_list = cache_value.value  # type: ignore
         return extension_list
@@ -680,6 +673,11 @@ class InstallableExtension(BaseModel):
 
                     meta = ext.meta or ExtensionMeta()
                     meta.featured = ext.id in manifest.featured
+                    meta.categories = [
+                        category
+                        for category, ext_ids in manifest.categories.items()
+                        if ext.id in ext_ids
+                    ]
                     ext.meta = meta
                     extension_list += [ext]
 
@@ -695,6 +693,11 @@ class InstallableExtension(BaseModel):
                     ext.check_release_updates(release)
                     meta = ext.meta or ExtensionMeta()
                     meta.featured = ext.id in manifest.featured
+                    meta.categories = [
+                        category
+                        for category, ext_ids in manifest.categories.items()
+                        if ext.id in ext_ids
+                    ]
                     ext.meta = meta
                     extension_list += [ext]
             except Exception as e:

lnbits/core/models/payments.py

@@ -35,6 +35,11 @@ class PaymentExtra(BaseModel):
     lnurl_response: str | None = None
 
 
+class UpdatePaymentExtra(BaseModel):
+    payment_hash: str
+    extra: dict = Field(default_factory=dict)
+
+
 class PayInvoice(BaseModel):
     payment_request: str
     description: str | None = None
@@ -49,6 +54,7 @@ class CreatePayment(BaseModel):
     amount_msat: int
     memo: str
     extra: dict | None = {}
+    extension: str | None = None
     preimage: str | None = None
     expiry: datetime | None = None
     webhook: str | None = None
@@ -135,22 +141,18 @@ class Payment(BaseModel):
         )
 
     # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_status(
-        self, skip_internal_payment_notifications: bool | None = False
-    ) -> PaymentStatus:
+    async def check_status(self) -> PaymentStatus:
         logger.warning("payment.check_status() is deprecated.")
         from lnbits.core.services.payments import check_payment_status
 
-        return await check_payment_status(self, skip_internal_payment_notifications)
+        return await check_payment_status(self)
 
     # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_fiat_status(
-        self, skip_internal_payment_notifications: bool | None = False
-    ) -> FiatPaymentStatus:
+    async def check_fiat_status(self) -> FiatPaymentStatus:
         logger.warning("payment.check_fiat_status() is deprecated.")
         from lnbits.core.services.fiat_providers import check_fiat_status
 
-        return await check_fiat_status(self, skip_internal_payment_notifications)
+        return await check_fiat_status(self)
 
 
 class PaymentFilters(FilterModel):
@@ -258,6 +260,7 @@ class CreateInvoice(BaseModel):
     )
     expiry: int | None = None
     extra: dict | None = None
+    extension: str | None = None
     webhook: str | None = None
     bolt11: str | None = None
     lnurl_withdraw: LnurlWithdrawResponse | None = None

lnbits/core/services/extensions.py

@@ -56,14 +56,10 @@ async def install_extension(
     else:
         await update_installed_extension(ext_info)
 
-    extension = Extension.from_installable_ext(ext_info)
-    if extension.is_upgrade_extension:
-        # call stop while the old routes are still active
+    if installed_ext:
         await stop_extension_background_work(ext_info.id)
 
-    await start_extension_background_work(ext_info.id)
-
-    return extension
+    return Extension.from_installable_ext(ext_info)
 
 
 async def check_extensions_limit(installed_ext: InstallableExtension | None = None):
@@ -103,16 +99,16 @@ async def stop_extension_background_work(ext_id: str) -> bool:
     Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
     Extension must expose a `myextension_stop()` function if it is starting tasks.
     """
-    upgrade_hash = settings.extension_upgrade_hash(ext_id)
-    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
+    ext = Extension(code=ext_id, is_valid=True)
+    module_name = ext.module_name
 
     try:
-        logger.info(f"Stopping background work for extension '{ext.module_name}'.")
-        old_module = importlib.import_module(ext.module_name)
+        logger.info(f"Stopping background work for extension '{module_name}'.")
+        old_module = importlib.import_module(module_name)
 
         stop_fn_name = f"{ext_id}_stop"
         if not hasattr(old_module, stop_fn_name):
-            raise ValueError(f"No stop function found for '{ext.module_name}'.")
+            raise ValueError(f"No stop function found for '{module_name}'.")
 
         stop_fn = getattr(old_module, stop_fn_name)
         if stop_fn:
@@ -120,9 +116,9 @@ async def stop_extension_background_work(ext_id: str) -> bool:
                 await stop_fn()
             else:
                 stop_fn()
-        logger.info(f"Stopped background work for extension '{ext.module_name}'.")
+        logger.info(f"Stopped background work for extension '{module_name}'.")
     except Exception as ex:
-        logger.warning(f"Failed to stop background work for '{ext.module_name}'.")
+        logger.warning(f"Failed to stop background work for '{module_name}'.")
         logger.warning(ex)
         return False
 
@@ -135,12 +131,12 @@ async def start_extension_background_work(ext_id: str) -> bool:
     Extension CAN expose a `myextension_start()` function if it is starting tasks.
     Extension MUST expose a `myextension_stop()` in that case.
     """
-    upgrade_hash = settings.extension_upgrade_hash(ext_id)
-    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
+    ext = Extension(code=ext_id, is_valid=True)
+    module_name = ext.module_name
 
     try:
-        logger.info(f"Starting background work for extension '{ext.module_name}'.")
-        new_module = importlib.import_module(ext.module_name)
+        logger.info(f"Starting background work for extension '{module_name}'.")
+        new_module = importlib.import_module(module_name)
         start_fn_name = f"{ext_id}_start"
 
         # start function is optional, return False if not found
@@ -153,10 +149,10 @@ async def start_extension_background_work(ext_id: str) -> bool:
                 await start_fn()
             else:
                 start_fn()
-        logger.info(f"Started background work for extension '{ext.module_name}'.")
+        logger.info(f"Started background work for extension '{module_name}'.")
         return True
     except Exception as ex:
-        logger.warning(f"Failed to start background work for '{ext.module_name}'.")
+        logger.warning(f"Failed to start background work for '{module_name}'.")
         logger.warning(ex)
         return False
 

lnbits/core/services/fiat_providers.py

@@ -8,7 +8,7 @@ import httpx
 from loguru import logger
 
 from lnbits.core.crud import get_wallet
-from lnbits.core.crud.payments import create_payment
+from lnbits.core.crud.payments import create_payment, update_payment
 from lnbits.core.models import CreatePayment, Payment, PaymentState
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.db import Connection
@@ -20,6 +20,7 @@ from lnbits.fiat.base import (
     FiatPaymentSuccessStatus,
 )
 from lnbits.settings import settings
+from lnbits.task_manager import task_manager
 
 
 async def handle_fiat_payment_confirmation(
@@ -36,9 +37,7 @@ async def handle_fiat_payment_confirmation(
         logger.warning(e)
 
 
-async def check_fiat_status(
-    payment: Payment, skip_internal_payment_notifications: bool | None = False
-) -> FiatPaymentStatus:
+async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
     if not payment.is_internal:
         return FiatPaymentPendingStatus()
     if payment.success:
@@ -58,14 +57,11 @@ async def check_fiat_status(
         return FiatPaymentPendingStatus()
     fiat_status = await fiat_provider.get_invoice_status(checking_id)
 
-    if skip_internal_payment_notifications:
-        return fiat_status
-
     if fiat_status.success:
-        # notify receivers asynchronously
-        from lnbits.tasks import internal_invoice_queue
-
-        await internal_invoice_queue.put(payment.checking_id)
+        payment.status = PaymentState.SUCCESS.value
+        await update_payment(payment)
+        await handle_fiat_payment_confirmation(payment)
+        task_manager.internal_invoice_queue.put_nowait(payment)
 
     return fiat_status
 

lnbits/core/services/funding_source.py

@@ -66,6 +66,8 @@ async def check_server_balance_against_node():
 
 
 async def check_balance_delta_changed():
+    if settings.notification_balance_delta_threshold_sats <= 0:
+        return
     status = await get_balance_delta()
     if settings.latest_balance_delta_sats is None:
         settings.latest_balance_delta_sats = status.delta_sats

lnbits/core/services/notifications.py

@@ -74,7 +74,7 @@ async def send_admin_notification(
     message: str,
     message_type: str | None = None,
 ) -> None:
-    return await send_notification(
+    return await send_notification_in_background(
         settings.lnbits_telegram_notifications_chat_id,
         settings.lnbits_nostr_notifications_identifiers,
         settings.lnbits_email_notifications_to_emails,
@@ -97,7 +97,7 @@ async def send_user_notification(
         if user_notifications.nostr_identifier
         else []
     )
-    return await send_notification(
+    return await send_notification_in_background(
         user_notifications.telegram_chat_id,
         nostr_identifiers,
         email_address,
@@ -222,12 +222,29 @@ async def send_email(
     msg["Subject"] = subject
     msg.attach(MIMEText(message, "plain"))
     username = username if len(username) > 0 else from_email
-    with smtplib.SMTP(server, port) as smtp_server:
-        smtp_server.starttls()
-        smtp_server.login(username, password)
-        smtp_server.sendmail(from_email, to_emails, msg.as_string())
+
+    def _send() -> bool:
+        with smtplib.SMTP(server, port) as smtp_server:
+            smtp_server.starttls()
+            smtp_server.login(username, password)
+            smtp_server.sendmail(from_email, to_emails, msg.as_string())
         return True
 
+    try:
+        return await asyncio.to_thread(_send)
+    except Exception as e:
+        logger.warning(f"Sending Email failed. {e!s}")
+        return False
+
+
+async def dispatch_payment_notification(payment: Payment) -> None:
+    """
+    This worker dispatches the payment notifications.
+    """
+    wallet = await get_wallet(payment.wallet_id)
+    if wallet:
+        await send_payment_notification(wallet, payment)
+
 
 async def dispatch_webhook(payment: Payment):
     """
@@ -294,6 +311,27 @@ def send_payment_notification_in_background(wallet: Wallet, payment: Payment):
         logger.warning(f"Error sending payment notification: {e}")
 
 
+async def send_notification_in_background(
+    telegram_chat_id: str | None,
+    nostr_identifiers: list[str] | None,
+    email_addresses: list[str] | None,
+    message: str,
+    message_type: str | None = None,
+):
+    try:
+        create_task(
+            send_notification(
+                telegram_chat_id,
+                nostr_identifiers,
+                email_addresses,
+                message,
+                message_type,
+            )
+        )
+    except Exception as e:
+        logger.warning(f"Error sending notification in background: {e}")
+
+
 async def send_ws_payment_notification(wallet: Wallet, payment: Payment):
     # TODO: websocket message should be a clean payment model
     # await websocket_manager.send(wallet.inkey, payment.json())

lnbits/core/services/payments.py

@@ -13,13 +13,13 @@ from lnbits.core.crud.payments import get_daily_stats
 from lnbits.core.db import db
 from lnbits.core.models import PaymentDailyStats, PaymentFilters
 from lnbits.core.models.payments import CreateInvoice
-from lnbits.core.services.fiat_providers import handle_fiat_payment_confirmation
 from lnbits.db import Connection, Filters
 from lnbits.decorators import check_user_extension_access
 from lnbits.exceptions import InvoiceError, PaymentError, UnsupportedError
 from lnbits.fiat import get_fiat_provider
 from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
+from lnbits.task_manager import task_manager
 from lnbits.utils.crypto import fake_privkey, random_secret_and_hash, verify_preimage
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
 from lnbits.wallets import fake_wallet, get_funding_source
@@ -171,15 +171,15 @@ async def create_fiat_invoice(
 
     internal_payment.fiat_provider = fiat_provider_name
     internal_payment.extra["fiat_checking_id"] = fiat_invoice.checking_id
-    # todo: move to payent
+    # TODO: move to payment
     internal_payment.extra["fiat_payment_request"] = fiat_invoice.payment_request
     new_checking_id = (
         f"fiat_{fiat_provider_name}_"
         f"{fiat_invoice.checking_id or internal_payment.checking_id}"
     )
-    await update_payment(internal_payment, new_checking_id, conn=conn)
-    internal_payment.checking_id = new_checking_id
-
+    internal_payment = await update_payment(
+        internal_payment, new_checking_id, conn=conn
+    )
     return internal_payment
 
 
@@ -215,6 +215,7 @@ async def create_wallet_invoice(wallet_id: str, data: CreateInvoice) -> Payment:
             unhashed_description=unhashed_description,
             expiry=data.expiry,
             extra=data.extra,
+            extension=data.extension,
             webhook=data.webhook,
             internal=data.internal,
             payment_hash=data.payment_hash,
@@ -260,6 +261,7 @@ async def create_invoice(
     webhook: str | None = None,
     internal: bool | None = False,
     payment_hash: str | None = None,
+    extension: str | None = None,
     labels: list[str] | None = None,
     external_id: str | None = None,
     conn: Connection | None = None,
@@ -343,6 +345,7 @@ async def create_invoice(
         expiry=invoice.expiry_date,
         memo=memo,
         extra=extra,
+        extension=extension,
         webhook=webhook,
         fee=invoice_response.fee_msat or 0,
         labels=labels,
@@ -374,7 +377,7 @@ async def update_pending_payment(
     status = await check_payment_status(payment)
     if status.failed:
         payment.status = PaymentState.FAILED
-        await update_payment(payment, conn=conn)
+        payment = await update_payment(payment, conn=conn)
     elif status.success:
         payment = await update_payment_success_status(payment, status, conn=conn)
     return payment
@@ -514,9 +517,7 @@ async def update_wallet_balance(
         )
         payment.status = PaymentState.SUCCESS
         await update_payment(payment, conn=conn)
-        from lnbits.tasks import internal_invoice_queue_put
-
-        await internal_invoice_queue_put(payment.checking_id)
+        task_manager.internal_invoice_queue.put_nowait(payment)
 
 
 async def check_wallet_limits(
@@ -630,18 +631,14 @@ async def check_transaction_status(
     return await check_payment_status(payment)
 
 
-async def check_payment_status(
-    payment: Payment, skip_internal_payment_notifications: bool | None = False
-) -> PaymentStatus:
+async def check_payment_status(payment: Payment) -> PaymentStatus:
     if payment.is_internal:
         if payment.success:
             return PaymentSuccessStatus()
         if payment.failed:
             return PaymentFailedStatus()
         if payment.is_in and payment.fiat_provider:
-            fiat_status = await check_fiat_status(
-                payment, skip_internal_payment_notifications
-            )
+            fiat_status = await check_fiat_status(payment)
             return PaymentStatus(paid=fiat_status.paid)
         return PaymentPendingStatus()
     funding_source = get_funding_source()
@@ -783,13 +780,16 @@ async def _pay_internal_invoice(
     await update_payment(internal_payment, conn=conn)
     logger.success(f"internal payment successful {internal_payment.checking_id}")
 
-    await _send_payment_notification_in_background(wallet.id, payment, conn=conn)
-
-    # notify receiver asynchronously
-    from lnbits.tasks import internal_invoice_queue
+    await _send_payment_notification_in_background(
+        wallet.id, payment, conn=conn
+    )  # notify the sender
+    await _send_payment_notification_in_background(
+        internal_payment.wallet_id, internal_payment, conn=conn
+    )  # notify the receiver
 
+    # notify receiver asynchronously (extension listeners)
     logger.debug(f"enqueuing internal invoice {internal_payment.checking_id}")
-    await internal_invoice_queue.put(internal_payment.checking_id)
+    task_manager.internal_invoice_queue.put_nowait(internal_payment)
 
     return payment
 
@@ -826,16 +826,15 @@ async def _pay_external_invoice(
 
     fee_reserve_msat = fee_reserve(amount_msat, internal=False)
 
-    from lnbits.tasks import create_task
-
-    task = create_task(
-        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat)
+    task = task_manager.create_task(
+        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat),
+        f"fundingsource_pay_invoice_{checking_id}",
     )
 
     # make sure a hold invoice or deferred payment is not blocking the server
     wait_time = max(1, settings.lnbits_funding_source_pay_invoice_wait_seconds)
     try:
-        payment_response = await asyncio.wait_for(task, timeout=wait_time)
+        payment_response = await asyncio.wait_for(task.task, timeout=wait_time)
     except asyncio.TimeoutError:
         # return pending payment on timeout
         logger.debug(
@@ -876,7 +875,7 @@ async def update_payment_success_status(
         payment.status = PaymentState.SUCCESS
         payment.fee = -(abs(status.fee_msat or 0) + abs(service_fee_msat))
         payment.preimage = payment.preimage or status.preimage
-        await update_payment(payment, conn=conn)
+        payment = await update_payment(payment, conn=conn)
     return payment
 
 
@@ -1079,28 +1078,44 @@ async def _send_payment_notification_in_background(
     send_payment_notification_in_background(wallet, payment)
 
 
-async def update_invoice_callback(checking_id: str) -> Payment | None:
+async def update_invoice_from_paid_invoices_stream(checking_id: str) -> Payment | None:
     """
-    Takes a checking_id of an incoming payment, from either paid_invoices_stream()
-    or internal_invoice_queue. Checks its status, updates and returns it.
-    returns None if no payment was found or it not and incoming payment.
+    Takes a checking_id of an incoming payment from paid_invoices_stream()
+    Checks its status, updates its status and returns it.
+    returns None if no incoming payment was found or the status is not successful
     """
     payment = await get_standalone_payment(checking_id, incoming=True)
     if not payment:
-        logger.warning(f"No payment found for '{checking_id}'.")
+        logger.warning(f"No incoming payment found for '{checking_id}'.")
         return None
-    if not payment.is_in:
-        logger.warning(f"Payment '{checking_id}' is not incoming, skipping.")
+
+    status = await check_payment_status(payment)
+
+    if not status.success:
+        logger.error(
+            "Unexpected status response from paid_invoices_stream. Skipping update."
+        )
         return None
 
-    status = await check_payment_status(
-        payment, skip_internal_payment_notifications=True
-    )
     payment.fee = status.fee_msat or payment.fee
     # only overwrite preimage if status.preimage provides it
     payment.preimage = status.preimage or payment.preimage
     payment.status = PaymentState.SUCCESS
-    await update_payment(payment)
-    if payment.fiat_provider:
-        await handle_fiat_payment_confirmation(payment)
+    payment = await update_payment(payment)
+
     return payment
+
+
+async def fundingsource_invoice_producer() -> None:
+    """
+    will collect all invoices that come directly from the backend wallet.
+
+    Called registered in the app startup sequence and run by taskmanager.
+    """
+    funding_source = get_funding_source()
+    async for checking_id in funding_source.paid_invoices_stream():
+        logger.info(f"got a payment notification {checking_id}")
+        payment = await update_invoice_from_paid_invoices_stream(checking_id)
+        if payment:
+            logger.success(f"fundingsource invoice {checking_id} settled")
+            task_manager.invoice_queue.put_nowait(payment)

lnbits/core/tasks.py

@@ -2,76 +2,43 @@ import asyncio
 
 from loguru import logger
 
-from lnbits.core.crud import (
-    create_audit_entry,
-    get_wallet,
-)
-from lnbits.core.crud.audit import delete_expired_audit_entries
+from lnbits.core.crud import create_audit_entry
 from lnbits.core.crud.payments import get_payments_status_count
 from lnbits.core.crud.users import get_accounts
 from lnbits.core.crud.wallets import get_wallets_count
 from lnbits.core.models.audit import AuditEntry
 from lnbits.core.models.extensions import InstallableExtension
 from lnbits.core.models.notifications import NotificationType
-from lnbits.core.services.funding_source import (
-    check_balance_delta_changed,
-    check_server_balance_against_node,
-    get_balance_delta,
-)
+from lnbits.core.services.funding_source import get_balance_delta
 from lnbits.core.services.notifications import (
     enqueue_admin_notification,
-    process_next_notification,
-    send_payment_notification,
 )
 from lnbits.db import Filters
 from lnbits.settings import settings
-from lnbits.utils.exchange_rates import btc_rates
+from lnbits.utils.cache import cache
+from lnbits.utils.exchange_rates import btc_price_from_aggregator, btc_rates
 
 audit_queue: asyncio.Queue[AuditEntry] = asyncio.Queue()
 
 
-async def run_by_the_minute_tasks() -> None:
-    minute_counter = 0
-    while settings.lnbits_running:
-        status_minutes = settings.lnbits_notification_server_status_hours * 60
-
-        if settings.notification_balance_delta_threshold_sats > 0:
-            try:
-                # runs by default every minute, the delta should not change that often
-                await check_balance_delta_changed()
-            except Exception as ex:
-                logger.error(ex)
-
-        if minute_counter % settings.lnbits_watchdog_interval_minutes == 0:
-            try:
-                await check_server_balance_against_node()
-            except Exception as ex:
-                logger.error(ex)
-
-        if minute_counter % status_minutes == 0:
-            try:
-                await _notify_server_status()
-            except Exception as ex:
-                logger.error(ex)
-
-        if minute_counter % 60 == 0:
-            try:
-                # initialize the list of all extensions
-                await InstallableExtension.get_installable_extensions(
-                    post_refresh_cache=True
-                )
-            except Exception as ex:
-                logger.error(ex)
-
-        minute_counter += 1
-        await asyncio.sleep(60)
+async def process_next_audit_entry() -> None:
+    """
+    Waits for audit entries to be pushed to the queue.
+    Then it inserts the entries into the DB.
+    """
+    data = await audit_queue.get()
+    await create_audit_entry(data)
 
 
-async def _notify_server_status() -> None:
+async def refresh_extension_cache() -> None:
+    # only refreshes every 10 minutes
+    await InstallableExtension.get_installable_extensions()
+
+
+async def notify_server_status() -> None:
     accounts = await get_accounts(filters=Filters(limit=0))
     wallets_count = await get_wallets_count()
     payments = await get_payments_status_count()
-
     status = await get_balance_delta()
     values = {
         "up_time": settings.lnbits_server_up_time,
@@ -88,76 +55,38 @@ async def _notify_server_status() -> None:
     enqueue_admin_notification(NotificationType.server_status, values)
 
 
-async def wait_for_paid_invoices(invoice_paid_queue: asyncio.Queue) -> None:
-    """
-    This worker dispatches events to all extensions and dispatches webhooks.
-    """
-    while settings.lnbits_running:
-        payment = await invoice_paid_queue.get()
-        logger.trace("received invoice paid event")
-        # payment notification
-        wallet = await get_wallet(payment.wallet_id)
-        if wallet:
-            await send_payment_notification(wallet, payment)
-
-
-async def wait_for_audit_data() -> None:
-    """
-    Waits for audit entries to be pushed to the queue.
-    Then it inserts the entries into the DB.
-    """
-    while settings.lnbits_running:
-        data = await audit_queue.get()
-        try:
-            await create_audit_entry(data)
-        except Exception as ex:
-            logger.warning(ex)
-            await asyncio.sleep(3)
-
-
-async def wait_notification_messages() -> None:
-
-    while settings.lnbits_running:
-        try:
-            await process_next_notification()
-        except Exception as ex:
-            logger.warning("Payment notification error", ex)
-            await asyncio.sleep(3)
-
-
-async def purge_audit_data() -> None:
-    """
-    Remove audit entries which have passed their retention period.
-    """
-    while settings.lnbits_running:
-        try:
-            await delete_expired_audit_entries()
-        except Exception as ex:
-            logger.warning(ex)
-
-        # clean every hour
-        await asyncio.sleep(60 * 60)
-
-
 async def collect_exchange_rates_data() -> None:
     """
     Collect exchange rates data. Used for monitoring only.
     """
-    while settings.lnbits_running:
-        currency = settings.lnbits_default_accounting_currency or "USD"
-        max_history_size = settings.lnbits_exchange_history_size
-        sleep_time = settings.lnbits_exchange_history_refresh_interval_seconds
-
-        if sleep_time > 0:
-            try:
-                rates = await btc_rates(currency)
-                if rates:
-                    rates_values = [r[1] for r in rates]
-                    lnbits_rate = sum(rates_values) / len(rates_values)
-                    rates.append(("LNbits", lnbits_rate))
-                settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
-            except Exception as ex:
-                logger.warning(ex)
+    currency = settings.lnbits_default_accounting_currency or "USD"
+    max_history_size = settings.lnbits_exchange_history_size
+    try:
+        if (
+            settings.lnbits_price_aggregator_enabled
+            and settings.lnbits_price_aggregator_url
+        ):
+            price = await btc_price_from_aggregator(currency)
+            if price:
+                cache.set(
+                    f"btc-price-{currency}",
+                    price,
+                    expiry=settings.lnbits_exchange_rate_cache_seconds,
+                )
+                settings.append_exchange_rate_datapoint(
+                    {"Aggregator": price}, max_history_size
+                )
         else:
-            sleep_time = 60
-        await asyncio.sleep(sleep_time)
+            rates = await btc_rates(currency)
+            if rates:
+                rates_values = [r[1] for r in rates]
+                lnbits_rate = sum(rates_values) / len(rates_values)
+                rates.append(("LNbits", lnbits_rate))
+                cache.set(
+                    f"btc-price-{currency}",
+                    lnbits_rate,
+                    expiry=settings.lnbits_exchange_rate_cache_seconds,
+                )
+            settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
+    except Exception as ex:
+        logger.warning(ex)

lnbits/core/views/admin_api.py

@@ -20,7 +20,7 @@ from lnbits.core.services.settings import dict_to_settings
 from lnbits.decorators import check_admin, check_super_user
 from lnbits.server import server_restart
 from lnbits.settings import AdminSettings, Settings, UpdateSettings, settings
-from lnbits.tasks import invoice_listeners
+from lnbits.task_manager import PublicTask, task_manager
 
 from .. import core_app_extra
 from ..crud import get_admin_settings, reset_core_settings, update_admin_settings
@@ -44,11 +44,10 @@ async def api_auditor():
     name="Monitor",
     description="show the current listeners and other monitoring data",
     dependencies=[Depends(check_admin)],
+    response_model=list[PublicTask],
 )
-async def api_monitor():
-    return {
-        "invoice_listeners": list(invoice_listeners.keys()),
-    }
+async def api_monitor() -> list[PublicTask]:
+    return task_manager.get_public_tasks()
 
 
 @admin_router.get(

lnbits/core/views/auth_api.py

@@ -36,6 +36,7 @@ from lnbits.decorators import (
     check_account_exists,
     check_admin,
     check_user_exists,
+    optional_user_id,
 )
 from lnbits.helpers import (
     create_access_token,
@@ -320,7 +321,10 @@ async def api_delete_user_api_token(
 
 @auth_router.get("/{provider}", description="SSO Provider")
 async def login_with_sso_provider(
-    request: Request, provider: str, user_id: str | None = None
+    request: Request,
+    provider: str,
+    user_id: str | None,
+    auth_user_id: str | None = Depends(optional_user_id),
 ):
     provider_sso = _new_sso(provider)
     if not provider_sso:
@@ -328,6 +332,8 @@ async def login_with_sso_provider(
             HTTPStatus.FORBIDDEN,
             f"Login by '{provider}' not allowed.",
         )
+    if user_id and user_id != auth_user_id:
+        raise HTTPException(HTTPStatus.FORBIDDEN, "User ID mismatch.")
 
     provider_sso.redirect_uri = str(request.base_url) + f"api/v1/auth/{provider}/token"
     with provider_sso:

lnbits/core/views/callback_api.py

@@ -357,16 +357,20 @@ async def handle_revolut_event(event: dict):
             return
 
         payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-        if not payment:
+        if payment:
+            await check_fiat_status(payment)
+            return
+
+        if event_type == "ORDER_COMPLETED":
             logger.warning(f"No payment found for Revolut order: '{order_id}'.")
             await _handle_revolut_subscription_order_paid(order_id)
             return
 
-        await check_fiat_status(payment)
+        logger.info(f"Ignoring Revolut authorised order without payment: '{order_id}'.")
         return
 
     if event_type == "SUBSCRIPTION_INITIATED":
-        await _handle_revolut_subscription_initiated(event)
+        logger.info("Revolut subscription initiated event received.")
         return
 
     if event_type in [
@@ -380,23 +384,6 @@ async def handle_revolut_event(event: dict):
     logger.warning(f"Unhandled Revolut event type: '{event_type}'.")
 
 
-async def _handle_revolut_subscription_initiated(event: dict):
-    subscription_id = event.get("subscription_id")
-    if not subscription_id:
-        subscription_id = event.get("id")
-
-    if not subscription_id:
-        logger.warning("Revolut subscription event missing subscription_id.")
-        return
-
-    fiat_provider = await _get_revolut_provider()
-    if not fiat_provider:
-        return
-
-    subscription = await fiat_provider.get_subscription(subscription_id)
-    await _handle_revolut_subscription(subscription, fiat_provider)
-
-
 async def _get_revolut_provider() -> RevolutWallet | None:
     fiat_provider = await get_fiat_provider("revolut")
     if not isinstance(fiat_provider, RevolutWallet):
@@ -406,7 +393,10 @@ async def _get_revolut_provider() -> RevolutWallet | None:
 
 
 async def _handle_revolut_subscription(
-    subscription: dict, fiat_provider: RevolutWallet
+    subscription: dict,
+    fiat_provider: RevolutWallet,
+    order_id: str | None = None,
+    order: dict | None = None,
 ):
     subscription_id = subscription.get("id")
     if not subscription_id:
@@ -420,16 +410,17 @@ async def _handle_revolut_subscription(
         logger.warning("Revolut subscription event missing LNbits metadata.")
         return
 
-    cycle_id = subscription.get("current_cycle_id")
-    if not cycle_id:
-        logger.warning("Revolut subscription missing current_cycle_id.")
-        return
-
-    cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
-    order_id = cycle.get("order_id")
     if not order_id:
-        logger.warning("Revolut subscription cycle missing order_id.")
-        return
+        cycle_id = subscription.get("current_cycle_id")
+        if not cycle_id:
+            logger.warning("Revolut subscription missing current_cycle_id.")
+            return
+
+        cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
+        order_id = cycle.get("order_id")
+        if not order_id:
+            logger.warning("Revolut subscription cycle missing order_id.")
+            return
 
     existing_payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
     if existing_payment:
@@ -439,7 +430,8 @@ async def _handle_revolut_subscription(
         await check_fiat_status(existing_payment)
         return
 
-    order = await fiat_provider.get_order(order_id)
+    if not order:
+        order = await fiat_provider.get_order(order_id)
     amount_minor = order.get("amount")
     currency = (order.get("currency") or "").upper()
     if amount_minor is None or not currency:
@@ -447,7 +439,7 @@ async def _handle_revolut_subscription(
 
     extra = {
         **(reference.extra or {}),
-        "subscription_request_id": reference.subscription_request_id,
+        "subscription_request_id": subscription_id,
         "fiat_method": "subscription",
         "tag": reference.tag,
         "subscription": {
@@ -475,7 +467,9 @@ async def _handle_revolut_subscription_order_paid(order_id: str):
         return
 
     order = await fiat_provider.get_order(order_id)
-    if order.get("type") != "payment" or order.get("state") != "completed":
+    order_type = (order.get("type") or "").lower()
+    order_state = (order.get("state") or "").upper()
+    if order_type != "payment" or order_state != "COMPLETED":
         logger.warning(f"Revolut order is not a completed payment: '{order_id}'.")
         return
 
@@ -490,7 +484,9 @@ async def _handle_revolut_subscription_order_paid(order_id: str):
         logger.warning(f"Revolut subscription is not active: '{subscription_id}'.")
         return
 
-    await _handle_revolut_subscription_initiated(subscription)
+    await _handle_revolut_subscription(
+        subscription, fiat_provider, order_id=order_id, order=order
+    )
 
 
 async def _create_revolut_subscription_payment(

lnbits/core/views/extension_api.py

@@ -292,7 +292,6 @@ async def api_deactivate_extension(ext_id: str) -> SimpleStatus:
 
 @extension_router.delete("/{ext_id}", dependencies=[Depends(check_admin)])
 async def api_uninstall_extension(ext_id: str) -> SimpleStatus:
-
     extension = await get_installed_extension(ext_id)
     if not extension:
         raise HTTPException(
@@ -567,6 +566,7 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
             "shortDescription": ext.short_description,
             "stars": ext.stars,
             "isFeatured": ext.meta.featured if ext.meta else False,
+            "categories": ext.meta.categories if ext.meta else [],
             "dependencies": ext.meta.dependencies if ext.meta else "",
             "isInstalled": ext.id in installed_exts_ids,
             "hasDatabaseTables": next(

lnbits/core/views/generic.py

@@ -20,7 +20,7 @@ from lnbits.decorators import (
     check_first_install,
     check_user_exists,
 )
-from lnbits.helpers import check_callback_url, extension_id_from_path, template_renderer
+from lnbits.helpers import check_callback_url, template_renderer
 from lnbits.settings import settings
 
 from ..crud import get_user
@@ -198,9 +198,7 @@ admin_ui_checks = [Depends(check_admin), Depends(check_admin_ui)]
 async def index(
     request: Request, user: User = Depends(check_user_exists)
 ) -> HTMLResponse:
-    return template_renderer(
-        extension_id=extension_id_from_path(request.url.path)
-    ).TemplateResponse(
+    return template_renderer().TemplateResponse(
         request,
         "base.html",
         {
@@ -213,9 +211,7 @@ async def index(
 @generic_router.get("/node/public")
 @generic_router.get("/first_install", dependencies=[Depends(check_first_install)])
 async def index_public(request: Request) -> HTMLResponse:
-    return template_renderer(
-        extension_id=extension_id_from_path(request.url.path)
-    ).TemplateResponse(request, "base.html", {"public": True})
+    return template_renderer().TemplateResponse(request, "base.html", {"public": True})
 
 
 @generic_router.get("/uuidv4/{hex_value}")

lnbits/core/views/payment_api.py

@@ -34,6 +34,7 @@ from lnbits.core.models import (
     PaymentWalletStats,
     SettleInvoice,
     SimpleStatus,
+    UpdatePaymentExtra,
 )
 from lnbits.core.models.payments import UpdatePaymentLabels
 from lnbits.core.models.users import AccountId
@@ -297,6 +298,38 @@ async def api_update_payment_labels(
     return SimpleStatus(success=True, message="Payment labels updated.")
 
 
+@payment_router.patch(
+    "/extra",
+    name="Update payment extra",
+    description="Append new extra metadata to a payment.",
+    response_model=Payment,
+)
+async def api_update_payment_extra(
+    data: UpdatePaymentExtra,
+    key_type: WalletTypeInfo = Depends(require_admin_key),
+) -> Payment:
+    payment = await get_standalone_payment(
+        data.payment_hash, wallet_id=key_type.wallet.id
+    )
+    if payment is None:
+        raise HTTPException(HTTPStatus.NOT_FOUND, "Payment does not exist.")
+    if not payment.success:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST, "Payment extra can only be updated after success."
+        )
+
+    duplicate_keys = sorted(set(payment.extra).intersection(data.extra))
+    if duplicate_keys:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST,
+            f"Extra keys already exist: {', '.join(duplicate_keys)}.",
+        )
+
+    payment.extra.update(data.extra)
+    await update_payment(payment)
+    return payment
+
+
 @payment_router.get("/fee-reserve")
 async def api_payments_fee_reserve(invoice: str = Query("invoice")) -> JSONResponse:
     invoice_obj = bolt11.decode(invoice)

lnbits/fiat/base.py

@@ -131,15 +131,15 @@ class FiatSubscriptionResponse(BaseModel):
 
 
 class FiatPaymentSuccessStatus(FiatPaymentStatus):
-    paid = True
+    paid = True  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class FiatPaymentFailedStatus(FiatPaymentStatus):
-    paid = False
+    paid = False  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class FiatPaymentPendingStatus(FiatPaymentStatus):
-    paid = None
+    paid = None  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class FiatProvider(ABC):

lnbits/fiat/revolut.py

@@ -283,7 +283,7 @@ class RevolutWallet(FiatProvider):
             return FiatSubscriptionResponse(
                 ok=True,
                 checkout_session_url=checkout_url,
-                subscription_request_id=payment_options.subscription_request_id,
+                subscription_request_id=revolut_subscription_id,
             )
         except json.JSONDecodeError:
             return FiatSubscriptionResponse(
@@ -302,6 +302,15 @@ class RevolutWallet(FiatProvider):
         **kwargs,
     ) -> FiatSubscriptionResponse:
         try:
+            subscription = await self.get_subscription(subscription_id)
+            reference = self.deserialize_subscription_reference(
+                subscription.get("external_reference")
+            )
+            if not reference or reference.wallet_id != correlation_id:
+                return FiatSubscriptionResponse(
+                    ok=False, error_message="Subscription not found."
+                )
+
             r = await self.client.post(
                 f"/api/subscriptions/{subscription_id}/cancel",
                 timeout=REVOLUT_REQUEST_TIMEOUT,

lnbits/helpers.py

@@ -52,45 +52,7 @@ def static_url_for(static: str, path: str) -> str:
     return f"/{static}/{path}?v={settings.server_startup_time}"
 
 
-def extension_id_from_path(path: str) -> str | None:
-    parts = [part for part in path.split("/") if part]
-    if not parts:
-        return None
-
-    if len(parts) >= 3 and parts[0] == "upgrades":
-        return parts[2]
-
-    ext_id = parts[0]
-    ext_i18n_dir = Path(
-        settings.lnbits_extensions_path, "extensions", ext_id, "static", "i18n"
-    )
-    if ext_i18n_dir.is_dir():
-        return ext_id
-
-    return None
-
-
-def extension_i18n_urls(extension_id: str | None) -> list[str]:
-    if not extension_id:
-        return []
-
-    i18n_dir = Path(
-        settings.lnbits_extensions_path, "extensions", extension_id, "static", "i18n"
-    )
-    if not i18n_dir.is_dir():
-        return []
-
-    files = [file.name for file in i18n_dir.glob("*.js") if file.is_file()]
-    return [
-        static_url_for(f"{extension_id}/static", f"i18n/{filename}")
-        for filename in sorted(files, key=lambda name: (name != "en.js", name))
-    ]
-
-
-def template_renderer(
-    additional_folders: list | None = None,
-    extension_id: str | None = None,
-) -> Jinja2Templates:
+def template_renderer(additional_folders: list | None = None) -> Jinja2Templates:
     folders = [
         "lnbits/templates",
         settings.extension_builder_working_dir_path.as_posix(),
@@ -124,14 +86,6 @@ def template_renderer(
             t.env.globals["INCLUDED_CSS"] = vendor_files["css"]
             t.env.globals["INCLUDED_COMPONENTS"] = vendor_files["components"]
 
-    if not extension_id and additional_folders:
-        for folder in additional_folders:
-            parts = Path(folder).parts
-            if parts and parts[-1] == "templates" and len(parts) >= 2:
-                extension_id = parts[-2]
-                break
-    t.env.globals["INCLUDED_EXTENSION_I18N"] = extension_i18n_urls(extension_id)
-
     # backwards compatibility for extensions (tpos)
     t.env.globals["LNBITS_DENOMINATION"] = settings.lnbits_denomination
 
@@ -356,12 +310,7 @@ def get_api_routes(routes: list) -> dict[str, str]:
 
 def path_segments(path: str) -> list[str]:
     path = path.strip("/")
-    segments = path.split("/")
-    if len(segments) < 2:
-        return segments
-    if segments[0] == "upgrades":
-        return segments[2:]
-    return segments[0:]
+    return path.split("/")
 
 
 def normalize_path(path: str | None) -> str:

lnbits/llms_txt.py

@@ -0,0 +1,78 @@
+"""Generate llms.txt markdown from FastAPI OpenAPI schema for AI agents."""
+
+from typing import Any
+
+from fastapi import FastAPI
+from fastapi.responses import PlainTextResponse
+
+
+def generate_llms_txt(app: FastAPI) -> str:
+    """Convert an OpenAPI schema to llms.txt markdown format."""
+    openapi_schema = app.openapi()
+    lines: list[str] = []
+
+    # H1: API Title
+    info = openapi_schema.get("info", {})
+    title = info.get("title", "API")
+    lines.append(f"# {title}")
+    lines.append("")
+
+    # Blockquote: Description
+    description = info.get("description")
+    if description:
+        for line in description.strip().split("\n"):
+            lines.append(f"> {line}")
+        lines.append("")
+
+    # Group endpoints by tag
+    paths = openapi_schema.get("paths", {})
+    endpoints_by_tag: dict[str, list[dict[str, Any]]] = {}
+
+    for path, path_item in paths.items():
+        for method in ["get", "post", "put", "patch", "delete", "head", "options"]:
+            if method not in path_item:
+                continue
+            operation = path_item[method]
+            tags = operation.get("tags", ["Endpoints"])
+            tag = tags[0] if tags else "Endpoints"
+            if tag not in endpoints_by_tag:
+                endpoints_by_tag[tag] = []
+            endpoints_by_tag[tag].append(
+                {
+                    "path": path,
+                    "method": method.upper(),
+                    "operation": operation,
+                }
+            )
+
+    # Generate sections by tag
+    for tag, endpoints in endpoints_by_tag.items():
+        lines.append(f"## {tag}")
+        lines.append("")
+        for endpoint in endpoints:
+            method = endpoint["method"]
+            path = endpoint["path"]
+            operation = endpoint["operation"]
+            summary = operation.get("summary", "")
+            if summary:
+                lines.append(f"### `{method} {path}` - {summary}")
+            else:
+                lines.append(f"### `{method} {path}`")
+            lines.append("")
+        lines.append("")
+
+    return "\n".join(lines).strip() + "\n"
+
+
+def create_llms_txt_route(app: FastAPI) -> None:
+    """Add a /llms.txt endpoint to the app."""
+
+    @app.get(
+        "/llms.txt",
+        response_class=PlainTextResponse,
+        include_in_schema=False,
+        summary="Get LLM-friendly API documentation",
+    )
+    async def get_llms_txt() -> str:
+        """Return the API documentation in llms.txt markdown format."""
+        return generate_llms_txt(app)

lnbits/middleware.py

@@ -51,14 +51,6 @@ class InstalledExtensionMiddleware:
             await self.app(scope, receive, send)
             return
 
-        # re-route all trafic if the extension has been upgraded
-        if top_path in settings.lnbits_upgraded_extensions:
-            upgrade_path = (
-                f"""{settings.lnbits_upgraded_extensions[top_path]}/{top_path}"""
-            )
-            tail = "/".join(rest)
-            scope["path"] = f"/upgrades/{upgrade_path}/{tail}"
-
         await self.app(scope, receive, send)
 
     def _response_by_accepted_type(

lnbits/settings.py

@@ -166,8 +166,6 @@ class ExchangeRateProvider(BaseModel):
 class InstalledExtensionsSettings(LNbitsSettings):
     # installed extensions that have been deactivated
     lnbits_deactivated_extensions: set[str] = Field(default=set())
-    # upgraded extensions that require API redirects
-    lnbits_upgraded_extensions: dict[str, str] = Field(default={})
     # list of redirects that extensions want to perform
     lnbits_extensions_redirects: list[RedirectPath] = Field(default=[])
 
@@ -190,18 +188,10 @@ class InstalledExtensionsSettings(LNbitsSettings):
     def activate_extension_paths(
         self,
         ext_id: str,
-        upgrade_hash: str | None = None,
         ext_redirects: list[dict] | None = None,
     ):
         self.lnbits_deactivated_extensions.discard(ext_id)
 
-        """
-        Update the list of upgraded extensions. The middleware will perform
-        redirects based on this
-        """
-        if upgrade_hash:
-            self.lnbits_upgraded_extensions[ext_id] = upgrade_hash
-
         if ext_redirects:
             self._activate_extension_redirects(ext_id, ext_redirects)
 
@@ -211,9 +201,6 @@ class InstalledExtensionsSettings(LNbitsSettings):
         self.lnbits_deactivated_extensions.add(ext_id)
         self._remove_extension_redirects(ext_id)
 
-    def extension_upgrade_hash(self, ext_id: str) -> str:
-        return settings.lnbits_upgraded_extensions.get(ext_id, "")
-
     def _activate_extension_redirects(self, ext_id: str, ext_redirects: list[dict]):
         ext_redirect_paths = [
             RedirectPath(**{"ext_id": ext_id, **er}) for er in ext_redirects
@@ -359,9 +346,11 @@ class FeeSettings(LNbitsSettings):
 
 
 class ExchangeProvidersSettings(LNbitsSettings):
-    lnbits_exchange_rate_cache_seconds: int = Field(default=30, ge=0)
+    lnbits_exchange_rate_cache_seconds: int = Field(default=60, ge=0)
     lnbits_exchange_history_size: int = Field(default=60, ge=0)
     lnbits_exchange_history_refresh_interval_seconds: int = Field(default=300, ge=0)
+    lnbits_price_aggregator_enabled: bool = Field(default=True)
+    lnbits_price_aggregator_url: str = Field(default="https://price.lnbits.com")
 
     lnbits_exchange_rate_providers: list[ExchangeRateProvider] = Field(
         default=[
@@ -587,6 +576,7 @@ class PhoenixdFundingSource(LNbitsSettings):
     phoenixd_api_password: str | None = Field(default=None)
     phoenixd_data_dir: str | None = Field(default=None)
     phoenixd_mnemonic: str | None = Field(default=None)
+    phoenixd_mnemonic_backup_confirmed: bool = Field(default=False)
 
 
 class AlbyFundingSource(LNbitsSettings):
@@ -611,6 +601,7 @@ class SparkL2FundingSource(LNbitsSettings):
     spark_l2_external_endpoint: str | None = Field(default="http://localhost:8765")
     spark_l2_external_api_key: str | None = Field(default=None)
     spark_l2_mnemonic: str | None = Field(default=None)
+    spark_l2_mnemonic_backup_confirmed: bool = Field(default=False)
     spark_l2_pay_wait_ms: int = Field(default=4000, ge=0)
     spark_l2_pay_poll_ms: int = Field(default=500, ge=0)
     spark_l2_stream_keepalive_ms: int = Field(default=15000, ge=0)
@@ -648,6 +639,7 @@ class BoltzFundingSource(LNbitsSettings):
     boltz_client_password: str = Field(default="")
     boltz_client_cert: str | None = Field(default=None)
     boltz_mnemonic: str | None = Field(default=None)
+    boltz_mnemonic_backup_confirmed: bool = Field(default=False)
 
 
 class StrikeFundingSource(LNbitsSettings):
@@ -1047,7 +1039,7 @@ class EditableSettings(
 
 
 class UpdateSettings(EditableSettings):
-    class Config:
+    class Config(EditableSettings.Config):
         extra = Extra.forbid
 
 
@@ -1072,11 +1064,12 @@ class EnvSettings(LNbitsSettings):
     log_rotation: str = Field(default="100 MB")
     log_retention: str = Field(default="3 months")
     first_install_token: str | None = Field(default=None)
-
     cleanup_wallets_days: int = Field(default=90, ge=0)
     funding_source_max_retries: int = Field(default=4, ge=0)
     lnbits_max_users: int = Field(default=0, ge=0)
     lnbits_max_extensions: int = Field(default=0, ge=0)
+    task_heart_beat_verbose: bool = Field(default=False)
+    task_heart_beat_interval: int = Field(default=30)
 
     @property
     def has_default_extension_path(self) -> bool:
@@ -1198,11 +1191,11 @@ class ReadOnlySettings(
 
 
 class Settings(EditableSettings, ReadOnlySettings, TransientSettings, BaseSettings):
-    class Config:
+    class Config(EditableSettings.Config, BaseSettings.Config):  # type: ignore[misc]
         env_file = ".env"
         env_file_encoding = "utf-8"
         case_sensitive = False
-        json_loads = list_parse_fallback
+        json_loads = list_parse_fallback  # type: ignore[assignment]
 
     def is_user_allowed(self, user_id: str) -> bool:
         return (

lnbits/static/css/base.css

@@ -212,12 +212,15 @@ body.bg-image .q-page-container {
   backdrop-filter: none; /* Ensure the page content is not affected */
 }
 
-body.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark),
+body.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
+  --q-dark: rgba(29, 29, 29, 0.3);
+  background-color: var(--q-dark);
+}
 body.body--dark .q-header,
 body.body--dark .q-drawer {
   --q-dark: rgba(29, 29, 29, 0.3);
   background-color: var(--q-dark);
-  backdrop-filter: blur(6px) brightness(0.8);
+  backdrop-filter: brightness(0.8);
 }
 
 body.rounded-ui .q-card,
@@ -388,11 +391,11 @@ body[data-theme=salvador].card-gradient.body--dark .q-drawer {
 }
 
 body.card-shadow .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-  filter: drop-shadow(0 10px 24px rgba(0, 0, 0, 0.18));
+  box-shadow: 0 10px 24px rgba(0, 0, 0, 0.18);
 }
 
 body.card-shadow.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-  filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
+  box-shadow: 0 12px 28px rgba(0, 0, 0, 0.45);
 }
 
 body.no-burger-background .q-drawer {

lnbits/static/i18n/en.js

@@ -184,6 +184,7 @@ window.localisation.en = {
   release_notes: 'Release Notes',
   activate_extension_details: 'Make extension available/unavailable for users',
   featured: 'Featured',
+  categories: 'Categories',
   all: 'All',
   only_admins_can_install: '(Only admin accounts can install extensions)',
   only_admins_can_create_extensions:

lnbits/static/js/components/admin/lnbits-admin-exchange-providers.js

@@ -62,12 +62,6 @@ window.app.component('lnbits-admin-exchange-providers', {
   mounted() {
     this.getExchangeRateHistory()
   },
-  created() {
-    const hash = window.location.hash.replace('#', '')
-    if (hash === 'exchange_providers') {
-      this.showExchangeProvidersTab(hash)
-    }
-  },
   methods: {
     getDefaultSetting(fieldName) {
       LNbits.api.getDefaultSetting(fieldName).then(response => {
@@ -127,18 +121,21 @@ window.app.component('lnbits-admin-exchange-providers', {
       this.exchangeData.showTickerConversion = true
     },
     initExchangeChart(data) {
+      if (this.exchangeRatesChart) {
+        this.exchangeRatesChart.destroy()
+        this.exchangeRatesChart = null
+      }
       const xValues = data.map(d =>
         this.utils.formatTimestamp(d.timestamp, 'HH:mm')
       )
-      const exchanges = [
-        ...this.formData.lnbits_exchange_rate_providers,
-        {name: 'LNbits'}
-      ]
+      const exchanges = this.formData.lnbits_price_aggregator_enabled
+        ? [{name: 'Aggregator'}]
+        : [...this.formData.lnbits_exchange_rate_providers, {name: 'LNbits'}]
       const datasets = exchanges.map(exchange => ({
         label: exchange.name,
         data: data.map(d => d.rates[exchange.name]),
         pointStyle: true,
-        borderWidth: exchange.name === 'LNbits' ? 4 : 1,
+        borderWidth: exchange.name === 'LNbits' ? 4 : 2,
         tension: 0.4
       }))
       this.exchangeRatesChart = new Chart(
@@ -148,7 +145,11 @@ window.app.component('lnbits-admin-exchange-providers', {
           options: {
             plugins: {
               legend: {
-                display: false
+                display: true
+              },
+              title: {
+                display: true,
+                text: 'Bitcoin Price History'
               }
             }
           },

lnbits/static/js/components/admin/lnbits-admin-funding-seed-backup.js

@@ -0,0 +1,151 @@
+window.app.component('lnbits-admin-funding-seed-backup', {
+  props: ['active', 'is-super-user', 'form-data', 'settings'],
+  template: '#lnbits-admin-funding-seed-backup',
+  data() {
+    return {
+      dialog: {
+        show: false,
+        step: 1,
+        seed: '',
+        visible: false,
+        challenge: [],
+        answers: {},
+        error: '',
+        confirmField: ''
+      }
+    }
+  },
+  watch: {
+    active(isActive) {
+      if (isActive) {
+        this.openIfRequired()
+      }
+    },
+    'formData.lnbits_backend_wallet_class'(walletClass, previousWalletClass) {
+      const source = this.seedBackupSource(walletClass)
+      if (previousWalletClass && source && this.formData[source.seedField]) {
+        this.formData[source.confirmField] = false
+      }
+      this.openIfRequired()
+    },
+    'formData.boltz_mnemonic'() {
+      this.formData.boltz_mnemonic_backup_confirmed =
+        this.formData.boltz_mnemonic === this.settings.boltz_mnemonic
+          ? this.settings.boltz_mnemonic_backup_confirmed
+          : false
+      this.openIfRequired()
+    },
+    'formData.phoenixd_mnemonic'() {
+      this.formData.phoenixd_mnemonic_backup_confirmed =
+        this.formData.phoenixd_mnemonic === this.settings.phoenixd_mnemonic
+          ? this.settings.phoenixd_mnemonic_backup_confirmed
+          : false
+      this.openIfRequired()
+    },
+    'formData.spark_l2_mnemonic'() {
+      this.formData.spark_l2_mnemonic_backup_confirmed =
+        this.formData.spark_l2_mnemonic === this.settings.spark_l2_mnemonic
+          ? this.settings.spark_l2_mnemonic_backup_confirmed
+          : false
+      this.openIfRequired()
+    }
+  },
+  computed: {
+    seedWords() {
+      return this.dialog.seed
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((word, index) => ({index, word}))
+    }
+  },
+  created() {
+    this.openIfRequired()
+  },
+  methods: {
+    seedBackupSource(walletClass = this.formData.lnbits_backend_wallet_class) {
+      if (walletClass === 'BoltzWallet') {
+        return {
+          seedField: 'boltz_mnemonic',
+          confirmField: 'boltz_mnemonic_backup_confirmed'
+        }
+      }
+      if (walletClass === 'PhoenixdWallet') {
+        return {
+          seedField: 'phoenixd_mnemonic',
+          confirmField: 'phoenixd_mnemonic_backup_confirmed'
+        }
+      }
+      if (walletClass === 'SparkL2Wallet') {
+        return {
+          seedField: 'spark_l2_mnemonic',
+          confirmField: 'spark_l2_mnemonic_backup_confirmed'
+        }
+      }
+    },
+    openIfRequired() {
+      if (!this.active || !this.isSuperUser) return
+
+      const source = this.seedBackupSource()
+      if (!source) return
+
+      const seed = (this.formData[source.seedField] || '').trim()
+      const confirmed = this.formData[source.confirmField]
+      if (!seed || confirmed || this.dialog.show) return
+
+      this.dialog = {
+        show: true,
+        step: 1,
+        seed,
+        visible: false,
+        challenge: [],
+        answers: {},
+        error: '',
+        confirmField: source.confirmField
+      }
+    },
+    prepareChallenge() {
+      const words = this.dialog.seed.split(/\s+/).filter(Boolean)
+      const count = Math.min(4, words.length)
+      const indexes = _.shuffle([...Array(words.length).keys()]).slice(0, count)
+      this.dialog.challenge = indexes
+        .sort((a, b) => a - b)
+        .map(index => ({index, word: words[index]}))
+      this.dialog.answers = {}
+      this.dialog.error = ''
+      this.dialog.step = 2
+    },
+    submitChallenge() {
+      const isValid = this.dialog.challenge.every(({index, word}) => {
+        const answer = this.dialog.answers[index] || ''
+        return answer.trim().toLowerCase() === word.toLowerCase()
+      })
+      if (!isValid) {
+        this.dialog.error =
+          'One or more words are incorrect. Check your backup and try again.'
+        return
+      }
+
+      const field = this.dialog.confirmField
+      LNbits.api
+        .request(
+          'PATCH',
+          '/admin/api/v1/settings',
+          this.g.user.wallets[0].adminkey,
+          {
+            [field]: true
+          }
+        )
+        .then(() => {
+          this.formData[field] = true
+          this.settings[field] = true
+          this.dialog.show = false
+          Quasar.Notify.create({
+            type: 'positive',
+            message: 'Seed backup confirmed',
+            icon: 'check'
+          })
+        })
+        .catch(LNbits.utils.notifyApiError)
+    }
+  }
+})

lnbits/static/js/components/admin/lnbits-admin-funding.js

@@ -1,5 +1,5 @@
 window.app.component('lnbits-admin-funding', {
-  props: ['is-super-user', 'form-data', 'settings'],
+  props: ['active', 'is-super-user', 'form-data', 'settings'],
   template: '#lnbits-admin-funding',
   data() {
     return {

lnbits/static/js/components/lnbits-payment-list.js

@@ -360,18 +360,37 @@ window.app.component('lnbits-payment-list', {
     paymentTableRowKey(row) {
       return row.payment_hash + row.amount
     },
-    exportCSV(detailed = false) {
+    async exportCSV(detailed = false) {
       // status is important for export but it is not in paymentsTable
       // because it is manually added with payment detail link and icons
       // and would cause duplication in the list
       const pagination = this.paymentsTable.pagination
-      const query = {
-        sortby: pagination.sortBy ?? 'time',
-        direction: pagination.descending ? 'desc' : 'asc'
-      }
-      const params = new URLSearchParams(query)
-      LNbits.api.getPayments(this.wallet, params).then(response => {
-        let payments = response.data.data.map(this.mapPayment)
+      const maxPages = 100
+      const limit = 1000
+      let payments = []
+
+      this.paymentsCSV.loading = true
+      try {
+        for (let page = 0; page < maxPages; page++) {
+          const query = {
+            sortby: pagination.sortBy ?? 'time',
+            direction: pagination.descending ? 'desc' : 'asc',
+            limit,
+            offset: page * limit
+          }
+          const params = new URLSearchParams(query)
+          const response = await LNbits.api.getPayments(this.wallet, params)
+          const pagePayments = response.data.data || []
+          payments = payments.concat(pagePayments.map(this.mapPayment))
+
+          if (
+            pagePayments.length < limit ||
+            payments.length >= response.data.total
+          ) {
+            break
+          }
+        }
+
         let columns = this.paymentsCSV.columns
 
         if (detailed) {
@@ -400,7 +419,11 @@ window.app.component('lnbits-payment-list', {
           payments,
           this.wallet.name + '-payments'
         )
-      })
+      } catch (err) {
+        LNbits.utils.notifyApiError(err)
+      } finally {
+        this.paymentsCSV.loading = false
+      }
     },
     addFilterTag() {
       if (!this.exportTagName) return

lnbits/static/js/components/lnbits-qrcode-lnurl.js

@@ -8,6 +8,10 @@ window.app.component('lnbits-qrcode-lnurl', {
     prefix: {
       type: String,
       default: 'lnurlp'
+    },
+    href: {
+      type: String,
+      default: ''
     }
   },
   data() {
@@ -21,7 +25,10 @@ window.app.component('lnbits-qrcode-lnurl', {
       if (this.tab == 'bech32') {
         const bytes = new TextEncoder().encode(this.url)
         const bech32 = NostrTools.nip19.encodeBytes('lnurl', bytes)
-        this.lnurl = `lightning:${bech32.toUpperCase()}`
+        this.lnurl =
+          this.href && this.href.trim() !== ''
+            ? `${this.href}?lightning=${bech32.toUpperCase()}`
+            : `lightning:${bech32.toUpperCase()}`
       } else if (this.tab == 'lud17') {
         if (this.url.startsWith('http://')) {
           this.lnurl = this.url.replace('http://', this.prefix + '://')

lnbits/static/js/components/lnbits-qrcode.js

@@ -85,6 +85,9 @@ window.app.component('lnbits-qrcode', {
         event.preventDefault()
         event.stopPropagation()
         return false
+      } else if (this.href && this.href.startsWith('http')) {
+        window.open(this.href, '_blank')
+        event.preventDefault()
       }
     },
     async writeNfcTag() {

lnbits/static/js/init-app.js

@@ -27,6 +27,14 @@ const DynamicComponent = {
             name: r.name,
             component: async () => {
               await LNbits.utils.loadTemplate(r.template)
+              if (r.i18n) {
+                const locale =
+                  window.i18n?.global?.locale?.value ??
+                  window.i18n?.global?.locale ??
+                  window.g.locale ??
+                  'en'
+                await LNbits.utils.loadExtI18n(r.i18n, locale)
+              }
               await LNbits.utils.loadScript(r.component)
               return window[r.name]
             }
@@ -151,6 +159,30 @@ window.i18n = new VueI18n.createI18n({
   fallbackLocale: 'en',
   messages: window.localisation
 })
+;(function () {
+  let _applying = false
+  let _target = null
+  Vue.watch(
+    () => window.i18n.global.locale,
+    async (locale, prevLocale) => {
+      if (_applying || !LNbits.utils._extI18nDirs.size) return
+      _target = locale
+      _applying = true
+      window.i18n.global.locale = prevLocale
+      _applying = false
+      await Promise.all(
+        [...LNbits.utils._extI18nDirs].map(dir =>
+          LNbits.utils.loadExtI18n(dir, locale)
+        )
+      )
+      if (_target !== locale) return
+      _applying = true
+      window.i18n.global.locale = locale
+      _applying = false
+    },
+    {flush: 'sync'}
+  )
+})()
 
 window.app.mixin({
   data() {

lnbits/static/js/pages/extensions.js

@@ -10,6 +10,7 @@ window.PageExtensions = {
       tab: 'installed',
       manageExtensionTab: 'releases',
       filteredExtensions: [],
+      categories: new Set(),
       updatableExtensions: [],
       showUninstallDialog: false,
       showManageExtensionDialog: false,
@@ -106,6 +107,10 @@ window.PageExtensions = {
         }
       }
 
+      const isCategoryTab = !['installed', 'all', 'featured'].includes(tab)
+      const isInSelectedCategory = extension =>
+        extension.categories?.includes(tab) ?? false
+
       this.filteredExtensions = this.extensions
         .filter(e => (tab === 'all' ? !e.isInstalled : true))
         .filter(e => (tab === 'installed' ? e.isInstalled : true))
@@ -113,6 +118,7 @@ window.PageExtensions = {
           tab === 'installed' ? (e.isActive ? true : !!this.g.user.admin) : true
         )
         .filter(e => (tab === 'featured' ? e.isFeatured : true))
+        .filter(e => (isCategoryTab ? isInSelectedCategory(e) : true))
         .filter(extensionNameContains(term))
         .map(e => ({
           ...e,
@@ -832,6 +838,9 @@ window.PageExtensions = {
     async fetchAllExtensions() {
       try {
         const {data} = await LNbits.api.request('GET', `/api/v1/extension/all`)
+        data.forEach(ext => {
+          ext.categories?.forEach(category => this.categories.add(category))
+        })
         return data
       } catch (error) {
         console.warn(error)

lnbits/static/js/pages/wallet.js

@@ -223,6 +223,12 @@ window.PageWallet = {
           if (data.tag === 'payRequest') {
             this.parse.lnurlpay = Object.freeze(data)
             this.parse.data.amount = data.minSendable / 1000
+            this.receive.units = [
+              'sats',
+              ...(this.g.allowedCurrencies.length > 0
+                ? this.g.allowedCurrencies
+                : this.g.currencies)
+            ]
           } else if (data.tag === 'login') {
             this.parse.lnurlauth = Object.freeze(data)
           } else if (data.tag === 'withdrawRequest') {
@@ -408,12 +414,19 @@ window.PageWallet = {
             switch (action.tag) {
               case 'url':
                 Quasar.Notify.create({
-                  message: `<a target="_blank" style="color: inherit" href="${action.url}">${action.url}</a>`,
+                  message: action.url,
                   caption: action.description,
-                  html: true,
+                  html: false,
                   type: 'positive',
                   timeout: 0,
-                  closeBtn: true
+                  closeBtn: true,
+                  actions: [
+                    {
+                      label: 'Open link',
+                      color: 'white',
+                      handler: () => this.utils.openUrlInNewTab(action.url)
+                    }
+                  ]
                 })
                 break
               case 'message':
@@ -425,15 +438,29 @@ window.PageWallet = {
                 })
                 break
               case 'aes':
-                this.utils.decryptLnurlPayAES(action, response.data.preimage)
-                Quasar.Notify.create({
-                  message: value,
-                  caption: extra.success_action.description,
-                  html: true,
-                  type: 'positive',
-                  timeout: 0,
-                  closeBtn: true
-                })
+                this.utils
+                  .decryptLnurlPayAES(action, response.data.preimage)
+                  .then(value => {
+                    Quasar.Notify.create({
+                      message: value,
+                      caption: action.description,
+                      html: false,
+                      type: 'positive',
+                      timeout: 0,
+                      closeBtn: true
+                    })
+                  })
+                  .catch(error => {
+                    Quasar.Notify.create({
+                      message: action.description || 'Payment successful.',
+                      caption: 'Could not decrypt success action.',
+                      html: false,
+                      type: 'warning',
+                      timeout: 0,
+                      closeBtn: true
+                    })
+                  })
+                break
             }
           }
         })

lnbits/static/js/utils.js

@@ -323,6 +323,20 @@ window._lnbitsUtils = {
     converter.setOption('simpleLineBreaks', true)
     return converter.makeHtml(text)
   },
+  _extI18nDirs: new Set(),
+  _extI18nLoaded: {},
+  loadExtI18n(dir, locale) {
+    this._extI18nDirs.add(dir)
+    const loaded = (this._extI18nLoaded[dir] ??= {})
+    if (loaded[locale]) return loaded[locale]
+    loaded[locale] = this.loadScript(`${dir}/${locale}.js`).catch(() => {
+      if (locale !== 'en') {
+        loaded['en'] ??= this.loadScript(`${dir}/en.js`).catch(() => {})
+        return loaded['en']
+      }
+    })
+    return loaded[locale]
+  },
   async decryptLnurlPayAES(success_action, preimage) {
     let keyb = new Uint8Array(
       preimage.match(/[\da-f]{2}/gi).map(h => parseInt(h, 16))
@@ -351,5 +365,27 @@ window._lnbitsUtils = {
         let decoder = new TextDecoder('utf-8')
         return decoder.decode(valueb)
       })
+  },
+  validateBrowsableUrl(urlString, allowLoopback = false) {
+    const url = new URL(urlString)
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      throw new Error('Invalid protocol')
+    }
+    if (!allowLoopback) {
+      const host = url.hostname
+      if (
+        host === 'localhost' ||
+        host === '[::1]' ||
+        host === '::1' ||
+        host.startsWith('127.') ||
+        host.startsWith('::ffff:127.')
+      ) {
+        throw new Error('Loopback addresses are not allowed')
+      }
+    }
+  },
+  openUrlInNewTab(urlString, allowLoopback = false) {
+    this.validateBrowsableUrl(urlString, allowLoopback)
+    window.open(urlString, '_blank', 'noopener,noreferrer')
   }
 }

lnbits/static/scss/background.scss

@@ -58,11 +58,15 @@ body.bg-image {
 }
 // transparent background for specific elements
 body.body--dark {
-  .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark),
+  .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
+    --q-dark: #{color.adjust(#1d1d1d, $alpha: -0.7)};
+    background-color: var(--q-dark);
+  }
+
   .q-header,
   .q-drawer {
     --q-dark: #{color.adjust(#1d1d1d, $alpha: -0.7)};
     background-color: var(--q-dark);
-    backdrop-filter: blur(6px) brightness(0.8);
+    backdrop-filter: brightness(0.8);
   }
 }

lnbits/static/scss/cards.scss

@@ -61,13 +61,13 @@ body.rounded-ui {
 
 body.card-shadow {
   .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-    filter: drop-shadow(0 10px 24px rgba(0, 0, 0, 0.18));
+    box-shadow: 0 10px 24px rgba(0, 0, 0, 0.18);
   }
 }
 
 body.card-shadow.body--dark {
   .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-    filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
+    box-shadow: 0 12px 28px rgba(0, 0, 0, 0.45);
   }
 }
 

lnbits/static/vendor.json

@@ -58,6 +58,7 @@
     "js/pages/users.js",
     "js/pages/account.js",
     "js/pages/admin.js",
+    "js/components/admin/lnbits-admin-funding-seed-backup.js",
     "js/components/admin/lnbits-admin-funding.js",
     "js/components/admin/lnbits-admin-funding-sources.js",
     "js/components/admin/lnbits-admin-fiat-providers.js",

lnbits/task_manager.py

@@ -0,0 +1,200 @@
+import asyncio
+import traceback
+import uuid
+from collections.abc import Callable, Coroutine
+from datetime import datetime, timezone
+
+from loguru import logger
+from pydantic import BaseModel
+
+from lnbits.core.models import Payment
+from lnbits.settings import settings
+
+
+class PublicTask(BaseModel):
+    """Public model used to expose task information via the API."""
+
+    name: str
+    created_at: datetime
+
+
+class Task:
+    """Model used on the backend to keep track of background tasks."""
+
+    coro: Coroutine
+    name: str
+    created_at: datetime
+    task: asyncio.Task
+    invoice_queue: asyncio.Queue[Payment] | None = None
+
+    def __init__(
+        self,
+        coro: Coroutine,
+        name: str | None = None,
+        invoice_queue: asyncio.Queue | None = None,
+    ) -> None:
+        self.coro = coro
+        self.name = name or f"task_{uuid.uuid4()}"
+        self.created_at = datetime.now(timezone.utc)
+        self.task = asyncio.create_task(self.coro, name=self.name)
+        self.invoice_queue = invoice_queue
+
+
+class TaskManager:
+    """Singleton class to manage background tasks."""
+
+    tasks: list[Task] = []
+    invoice_queue: asyncio.Queue[Payment] = asyncio.Queue()
+    internal_invoice_queue: asyncio.Queue[Payment] = asyncio.Queue()
+
+    def init(self) -> None:
+        self.create_permanent_task(
+            func=self._heart_beat,
+            interval=settings.task_heart_beat_interval,
+        )
+        self.create_permanent_task(self._invoice_listener_consumer)
+        self.create_permanent_task(self._internal_invoice_listener_consumer)
+
+    def get_task(self, name: str) -> Task | None:
+        """Get a running task by name."""
+        for task in self.tasks:
+            if task.name == name:
+                return task
+        return None
+
+    def get_public_tasks(self) -> list[PublicTask]:
+        """Get a list of public tasks."""
+        return [PublicTask(name=t.name, created_at=t.created_at) for t in self.tasks]
+
+    def cancel_task(self, task: Task) -> None:
+        """Cancel a running task."""
+        self.tasks.remove(task)
+        try:
+            task.task.cancel()
+        except Exception as exc:
+            logger.warning(f"error while cancelling task `{task.name}`: {exc!s}")
+
+    def cancel_all_tasks(self) -> None:
+        """Cancel all running tasks."""
+        for task in list(self.tasks):
+            self.cancel_task(task)
+
+    def create_task(
+        self,
+        coro: Coroutine,
+        name: str | None = None,
+        invoice_queue: asyncio.Queue | None = None,
+    ) -> Task:
+        """Create a task. If a task with the same name exists, it will be cancelled."""
+        if name:
+            task = self.get_task(name)
+            if task:
+                self.cancel_task(task)
+        task = Task(coro=coro, name=name, invoice_queue=invoice_queue)
+        self.tasks.append(task)
+        return task
+
+    def create_permanent_task(
+        self,
+        func: Callable[[], Coroutine],
+        invoice_queue: asyncio.Queue | None = None,
+        name: str | None = None,
+        interval: int = 0,
+    ) -> Task:
+        """Create a task that runs forever and restarts on failure."""
+
+        async def wrapper():
+            while settings.lnbits_running:
+                await self._catch_everything_and_restart(func)
+                if interval > 0:
+                    await asyncio.sleep(interval)
+
+        return self.create_task(
+            coro=wrapper(), name=name or func.__name__, invoice_queue=invoice_queue
+        )
+
+    def register_invoice_listener(
+        self,
+        func: Callable[[Payment], Coroutine],
+        name: str | None = None,
+    ) -> Task:
+        """
+        A method intended for extensions to call when they want to be notified about
+        incoming payments. Will call provided Coroutine with the updated payment.
+        """
+        name = f"{name or uuid.uuid4()}_invoice_listener"
+        queue: asyncio.Queue[Payment] = asyncio.Queue()
+        return self.create_permanent_task(
+            self._invoice_listener_worker(func, queue),
+            name=name,
+            invoice_queue=queue,
+        )
+
+    async def _heart_beat(self) -> None:
+        """A heartbeat that removes done tasks logs the number of tasks."""
+        for task in self.tasks:
+            state = task.task._state if task.task else "NOT RUNNING"
+            if settings.task_heart_beat_verbose:
+                logger.debug(
+                    f"Task Manager: `{task.name}` state: `{state}` "
+                    f"created: {task.created_at.strftime('%Y-%m-%d %H:%M:%S')}`"
+                )
+            if task.task and task.task.done():
+                logger.debug(f"Task Manager: task `{task.name}` is done.")
+                self.cancel_task(task)
+        listeners_count = sum(1 for task in self.tasks if task.invoice_queue)
+        logger.debug(
+            f"Task Manager: {len(self.tasks) - listeners_count} tasks "
+            f"and {listeners_count} invoice listeners."
+        )
+
+    async def _catch_everything_and_restart(
+        self,
+        func: Callable[[], Coroutine],
+        restart_interval: int = 5,
+    ) -> None:
+        """Catches all exceptions from a function and restarts it after 5 seconds."""
+        while settings.lnbits_running:
+            try:
+                return await func()
+            except asyncio.CancelledError:
+                raise  # because we must pass this up
+            except Exception as exc:
+                if not settings.lnbits_running:
+                    return
+                logger.error(f"exception in background task `{func.__name__}`:", exc)
+                logger.error(traceback.format_exc())
+                logger.info(
+                    f"`{func.__name__}` restarts in {restart_interval} seconds."
+                )
+                await asyncio.sleep(restart_interval)
+
+    def _invoice_listener_worker(
+        self, func: Callable[[Payment], Coroutine], queue: asyncio.Queue[Payment]
+    ) -> Callable:
+        async def wrapper() -> None:
+            payment: Payment = await queue.get()
+            await func(payment)
+
+        return wrapper
+
+    def _invoice_dispatcher(self, payment: Payment) -> None:
+        """Dispatches a payment to all registered invoice listeners."""
+        for task in self.tasks:
+            if not task.invoice_queue:
+                continue
+            logger.debug(f"Enqueing payment to task {task.name}")
+            task.invoice_queue.put_nowait(payment)
+
+    async def _invoice_listener_consumer(self) -> None:
+        payment = await self.invoice_queue.get()
+        logger.info(f"got a payment notification {payment.checking_id}")
+        self._invoice_dispatcher(payment)
+
+    async def _internal_invoice_listener_consumer(self) -> None:
+        payment = await self.internal_invoice_queue.get()
+        logger.info(f"got an internal payment notification {payment.checking_id}")
+        self._invoice_dispatcher(payment)
+
+
+task_manager = TaskManager()

lnbits/tasks.py

@@ -1,143 +1,83 @@
 import asyncio
-import traceback
 import uuid
 from collections.abc import Callable, Coroutine
 
 from loguru import logger
 
 from lnbits.core.models import Payment
-from lnbits.core.services.payments import update_invoice_callback
+from lnbits.core.services.payments import get_standalone_payment
 from lnbits.settings import settings
-from lnbits.wallets import get_funding_source
-
-tasks: list[asyncio.Task] = []
-unique_tasks: dict[str, asyncio.Task] = {}
+from lnbits.task_manager import task_manager
 
 
+# DEPRECATED: use task_manager.create_task instead.
 def create_task(coro: Coroutine) -> asyncio.Task:
-    task = asyncio.create_task(coro)
-    tasks.append(task)
-    return task
+    logger.debug("DEPRECATED: use task_manager.create_task instead.")
+    return task_manager.create_task(coro).task
 
 
+# DEPRECATED: use task_manager.create_task with `name` kwarg.
 def create_unique_task(name: str, coro: Coroutine) -> asyncio.Task:
-    if unique_tasks.get(name):
-        logger.warning(f"task `{name}` already exists, cancelling it")
-        try:
-            unique_tasks[name].cancel()
-        except Exception as exc:
-            logger.warning(f"error while cancelling task `{name}`: {exc!s}")
-    task = asyncio.create_task(coro)
-    unique_tasks[name] = task
-    return task
+    logger.debug("DEPRECATED: use task_manager.create_task instead.")
+    return task_manager.create_task(coro, name=name).task
 
 
+# DEPRECATED: use task_manager.create_permanent_task instead.
 def create_permanent_task(func: Callable[[], Coroutine]) -> asyncio.Task:
-    return create_task(catch_everything_and_restart(func))
+    logger.debug("DEPRECATED: use task_manager.create_permanent_task instead.")
+    return task_manager.create_permanent_task(func).task
 
 
+# DEPRECATED: use task_manager.create_permanent_task with `name` argument instead.
 def create_permanent_unique_task(
     name: str, coro: Callable[[], Coroutine]
 ) -> asyncio.Task:
     return create_unique_task(name, catch_everything_and_restart(coro, name))
 
 
-def cancel_all_tasks() -> None:
-    for task in tasks:
-        try:
-            task.cancel()
-        except Exception as exc:
-            logger.warning(f"error while cancelling task: {exc!s}")
-    for name, task in unique_tasks.items():
-        try:
-            task.cancel()
-        except Exception as exc:
-            logger.warning(f"error while cancelling task `{name}`: {exc!s}")
-
-
+# DEPRECATED don't use this, use task_manager.create_permanent_task instead.
 async def catch_everything_and_restart(
     func: Callable[[], Coroutine],
     name: str = "unnamed",
-) -> Coroutine:
-    try:
-        return await func()
-    except asyncio.CancelledError:
-        raise  # because we must pass this up
-    except Exception as exc:
-        logger.error(f"exception in background task `{name}`:", exc)
-        logger.error(traceback.format_exc())
-        logger.error("will restart the task in 5 seconds.")
-        await asyncio.sleep(5)
-        return await catch_everything_and_restart(func, name)
+) -> None:
+    _ = name
+    return await task_manager._catch_everything_and_restart(func)
 
 
-invoice_listeners: dict[str, asyncio.Queue] = {}
-
-
-# TODO: name should not be optional
-# some extensions still dont use a name, but they should
 def register_invoice_listener(send_chan: asyncio.Queue, name: str | None = None):
     """
-    A method intended for extensions (and core/tasks.py) to call when they want to be
-    notified about new invoice payments incoming. Will emit all incoming payments.
+    DEPRECATED: use task_manager.register_invoice_listener instead,
+    which also allows to pass a callback instead of a queue.
+    This method will still work but it is not recommended for new code.
     """
-    if not name:
-        # fallback to a random name if extension didn't provide one
-        name = f"no_name_{str(uuid.uuid4())[:8]}"
+    logger.debug("DEPRECATED: use task_manager.register_invoice_listener instead.")
+    name = f"forward_{name or str(uuid.uuid4())[:8]}"
 
-    if invoice_listeners.get(name):
-        logger.warning(f"invoice listener `{name}` already exists, replacing it")
+    # here we just forwarding the payments to the provided queue
+    async def forward_queue(payment: Payment):
+        send_chan.put_nowait(payment)
 
-    logger.trace(f"registering invoice listener `{name}`")
-    invoice_listeners[name] = send_chan
-
-
-internal_invoice_queue: asyncio.Queue = asyncio.Queue(0)
+    task_manager.register_invoice_listener(forward_queue, name=name)
 
 
 async def internal_invoice_queue_put(checking_id: str) -> None:
     """
+    DEPRECATED: use task_manager.internal_invoice_queue instead,
     A method to call when it wants to notify about an internal invoice payment.
     """
-    await internal_invoice_queue.put(checking_id)
-
-
-async def internal_invoice_listener() -> None:
-    """
-    internal_invoice_queue will be filled directly in core/services.py
-    after the payment was deemed to be settled internally.
-
-    Called by the app startup sequence.
-    """
-    while settings.lnbits_running:
-        checking_id = await internal_invoice_queue.get()
-        logger.info(f"got an internal payment notification {checking_id}")
-        payment = await update_invoice_callback(checking_id)
-        if payment:
-            logger.success(f"internal invoice {checking_id} settled")
-            await invoice_callback_dispatcher(payment)
-
-
-async def invoice_listener() -> None:
-    """
-    invoice_listener will collect all invoices that come directly
-    from the backend wallet.
-
-    Called by the app startup sequence.
-    """
-    funding_source = get_funding_source()
-    async for checking_id in funding_source.paid_invoices_stream():
-        logger.info(f"got a payment notification {checking_id}")
-        payment = await update_invoice_callback(checking_id)
-        if payment:
-            logger.success(f"fundingsource invoice {checking_id} settled")
-            await invoice_callback_dispatcher(payment)
+    payment = await get_standalone_payment(checking_id, incoming=True)
+    if not payment:
+        logger.warning(f"internal_invoice_queue_put: payment {checking_id} not found")
+        return
+    await task_manager.internal_invoice_queue.put(payment)
 
 
+# DEPRECATED use task_manager.register_invoice_listener(coro, name="myext")
 def wait_for_paid_invoices(
     invoice_listener_name: str,
     func: Callable[[Payment], Coroutine],
 ) -> Callable[[], Coroutine]:
+    logger.debug("DEPRECATED: use task_manager.register_invoice_listener instead.")
 
     async def wrapper() -> None:
         invoice_queue: asyncio.Queue = asyncio.Queue()
@@ -147,27 +87,3 @@ def wait_for_paid_invoices(
             await func(payment)
 
     return wrapper
-
-
-def run_interval(
-    interval_seconds: int,
-    func: Callable[[], Coroutine],
-) -> Callable[[], Coroutine]:
-    """Run a function at a specified interval in seconds, while the server is running"""
-
-    async def wrapper() -> None:
-        while settings.lnbits_running:
-            try:
-                await func()
-            except Exception as e:
-                logger.error(f"Error occurred in interval task: {e}")
-                logger.warning(traceback.format_exc())
-            await asyncio.sleep(interval_seconds)
-
-    return wrapper
-
-
-async def invoice_callback_dispatcher(payment: Payment):
-    for name, send_chan in invoice_listeners.items():
-        logger.trace(f"invoice listeners: sending to `{name}`")
-        await send_chan.put(payment)

lnbits/templates/base.html

@@ -90,9 +90,7 @@
       window.g.isPublicPage = false
       {% endif %}
     </script>
-    {% endif %} {% for url in INCLUDED_EXTENSION_I18N %}
-    <script src="{{ url }}"></script>
-    {% endfor %}
+    {% endif %}
     <!-- app init -->
     <script>
       window.app = Vue.createApp({

lnbits/templates/components.vue

@@ -1,4 +1,5 @@
-{% include('components/admin/funding.vue') %} {%
+{% include('components/admin/funding_seed_backup.vue') %} {%
+include('components/admin/funding.vue') %} {%
 include('components/admin/funding_sources.vue') %} {%
 include('components/admin/fiat_providers.vue') %} {%
 include('components/admin/exchange_providers.vue') %} {%

lnbits/templates/components/admin/exchange_providers.vue

@@ -1,7 +1,46 @@
 <template id="lnbits-admin-exchange-providers">
-  <h6 class="q-my-none q-mb-sm">
-    <span v-text="$t('exchange_providers')"></span>
-  </h6>
+  <h6 class="q-my-none q-mb-xs">LNbits Price Aggregator</h6>
+  <p class="q-mb-md text-caption text-grey">
+    A privacy-friendly, open-source Bitcoin price aggregator maintained by the
+    LNbits team. Aggregates prices from multiple exchanges and returns a median,
+    no API keys required.
+    <a href="https://price.lnbits.com" target="_blank" rel="noopener"
+      >price.lnbits.com</a
+    >
+    &mdash;
+    <a
+      href="https://github.com/lnbits/lnbits-price-aggregator"
+      target="_blank"
+      rel="noopener"
+      >GitHub</a
+    >
+  </p>
+
+  <div class="row q-mb-md items-start">
+    <div class="col-auto q-mr-md q-mt-sm">
+      <q-toggle
+        v-model="formData.lnbits_price_aggregator_enabled"
+        @update:model-value="formData.touch = null"
+        label="Use Price Aggregator"
+      >
+      </q-toggle>
+    </div>
+    <div class="col-12 col-md-7">
+      <q-input
+        filled
+        v-model="formData.lnbits_price_aggregator_url"
+        type="text"
+        label="Price Aggregator URL"
+        hint="Fetch BTC price from this aggregator instead of individual providers below."
+        :disable="!formData.lnbits_price_aggregator_enabled"
+        @update:model-value="formData.touch = null"
+      >
+      </q-input>
+    </div>
+  </div>
+
+  <q-separator class="q-my-md"></q-separator>
+  <h6 class="q-my-none q-mb-sm">Bitcoin Price History</h6>
 
   <div class="row">
     <div class="col-12 col-md-8">
@@ -53,6 +92,11 @@
     </div>
   </div>
 
+  <q-separator class="q-my-md"></q-separator>
+  <h6 class="q-my-none q-mb-sm">
+    <span v-text="$t('exchange_providers')"></span>
+  </h6>
+
   <div class="row q-mt-md">
     <div class="col-6">
       <q-btn
@@ -60,6 +104,7 @@
         label="Add Exchange Provider"
         color="primary"
         class="q-mb-md"
+        :disable="formData.lnbits_price_aggregator_enabled"
       >
       </q-btn>
     </div>
@@ -70,12 +115,20 @@
         :label="$t('reset_defaults')"
         color="primary"
         class="float-right"
+        :disable="formData.lnbits_price_aggregator_enabled"
       >
       </q-btn>
     </div>
   </div>
 
-  <div class="overflow-auto">
+  <div
+    class="overflow-auto"
+    :style="
+      formData.lnbits_price_aggregator_enabled
+        ? 'opacity:0.4;pointer-events:none'
+        : ''
+    "
+  >
     <q-table
       row-key="name"
       :rows="formData.lnbits_exchange_rate_providers"

lnbits/templates/components/admin/funding.vue

@@ -301,5 +301,11 @@
         </div>
       </div>
     </div>
+    <lnbits-admin-funding-seed-backup
+      :active="active"
+      :is-super-user="isSuperUser"
+      :form-data="formData"
+      :settings="settings"
+    ></lnbits-admin-funding-seed-backup>
   </q-card-section>
 </template>

lnbits/templates/components/admin/funding_seed_backup.vue

@@ -0,0 +1,136 @@
+<template id="lnbits-admin-funding-seed-backup">
+  <q-dialog v-model="dialog.show">
+    <q-card style="width: 760px; max-width: 95vw; border-radius: 8px">
+      <q-card-section class="q-pb-md">
+        <div class="row q-col-gutter-sm">
+          <div class="col-6">
+            <q-chip
+              square
+              class="full-width"
+              icon="looks_one"
+              :color="dialog.step === 1 ? 'primary' : 'grey-9'"
+              text-color="white"
+              label="Backup"
+            ></q-chip>
+          </div>
+          <div class="col-6">
+            <q-chip
+              square
+              class="full-width"
+              icon="looks_two"
+              :color="dialog.step === 2 ? 'primary' : 'grey-9'"
+              text-color="white"
+              label="Verify"
+            ></q-chip>
+          </div>
+        </div>
+      </q-card-section>
+
+      <q-separator></q-separator>
+
+      <q-card-section v-if="dialog.step === 1">
+        <div class="row items-center justify-between q-mb-md">
+          <div>
+            <div
+              class="text-subtitle1"
+              v-text="`${seedWords.length}-word recovery phrase`"
+            ></div>
+            <div
+              class="text-caption text-grey-5"
+              v-text="'Write these words down in order.'"
+            ></div>
+          </div>
+          <q-btn
+            outline
+            no-caps
+            color="primary"
+            :icon="dialog.visible ? 'visibility_off' : 'visibility'"
+            :label="dialog.visible ? 'Hide words' : 'Show words'"
+            @click="dialog.visible = !dialog.visible"
+          ></q-btn>
+        </div>
+
+        <div class="row q-col-gutter-sm">
+          <div
+            class="col-4 col-md-3"
+            v-for="word in seedWords"
+            :key="word.index"
+          >
+            <div
+              class="row items-center no-wrap rounded-borders"
+              style="
+                min-height: 42px;
+                border: 1px solid rgba(255, 255, 255, 0.14);
+                background: rgba(255, 255, 255, 0.035);
+              "
+            >
+              <div
+                class="text-caption text-grey-5 text-center"
+                style="
+                  width: 42px;
+                  border-right: 1px solid rgba(255, 255, 255, 0.1);
+                "
+                v-text="word.index + 1"
+              ></div>
+              <div
+                class="text-body2 text-weight-medium q-px-sm"
+                style="min-width: 0; overflow-wrap: anywhere"
+                v-text="dialog.visible ? word.word : '••••••'"
+              ></div>
+            </div>
+          </div>
+        </div>
+
+        <div class="row justify-end q-mt-lg">
+          <q-btn
+            color="primary"
+            no-caps
+            label="I have written it down"
+            @click="prepareChallenge"
+          ></q-btn>
+        </div>
+      </q-card-section>
+
+      <q-card-section v-if="dialog.step === 2">
+        <div class="q-mb-md">
+          <div class="text-subtitle1" v-text="'Confirm your backup'"></div>
+          <div
+            class="text-caption text-grey-5"
+            v-text="
+              'Enter the requested words from your written recovery phrase.'
+            "
+          ></div>
+        </div>
+
+        <div class="row q-col-gutter-md">
+          <div
+            class="col-12 col-sm-6"
+            v-for="word in dialog.challenge"
+            :key="word.index"
+          >
+            <q-input
+              v-model.trim="dialog.answers[word.index]"
+              filled
+              :label="`Word ${word.index + 1}`"
+            ></q-input>
+          </div>
+        </div>
+        <div
+          class="text-negative q-mt-sm"
+          v-if="dialog.error"
+          v-text="dialog.error"
+        ></div>
+        <div class="row justify-between q-mt-lg">
+          <q-btn flat no-caps label="Back" @click="dialog.step = 1"></q-btn>
+          <q-btn
+            color="primary"
+            icon="check"
+            no-caps
+            label="Confirm backup"
+            @click="submitChallenge"
+          ></q-btn>
+        </div>
+      </q-card-section>
+    </q-card>
+  </q-dialog>
+</template>

lnbits/templates/components/lnbits-wallet-api-docs.vue

@@ -6,6 +6,9 @@
     :content-inset-level="0.5"
   >
     <q-card-section>
+      <q-banner dense rounded class="bg-warning text-black q-mb-md">
+        These keys should be kept safe, sharing them could risk losing funds.
+      </q-banner>
       <q-list>
         <q-item dense class="q-pa-none">
           <q-item-section>

lnbits/templates/pages/admin.vue

@@ -199,6 +199,7 @@
                 >
                   <q-tab-panel name="funding">
                     <lnbits-admin-funding
+                      :active="tab === 'funding'"
                       :is-super-user="isSuperUser"
                       :settings="settings"
                       :form-data="formData"

lnbits/templates/pages/extensions.vue

@@ -7,7 +7,29 @@
             <q-tabs v-model="tab" active-color="primary" align="left">
               <q-tab name="installed" :label="$t('installed')"></q-tab>
               <q-tab name="all" :label="$t('all')"></q-tab>
-              <q-tab name="featured" :label="$t('featured')"></q-tab>
+              <q-tab
+                v-show="$q.screen.gt.xs"
+                name="featured"
+                :label="$t('featured')"
+              ></q-tab>
+              <q-btn-dropdown auto-close stretch flat :label="$t('categories')">
+                <q-list>
+                  <q-item
+                    clickable
+                    v-close-popup
+                    v-for="category in categories"
+                    @click="tab = category"
+                    :key="category"
+                  >
+                    <q-item-section>
+                      <q-item-label
+                        class="text-capitalize"
+                        v-text="category"
+                      ></q-item-label>
+                    </q-item-section>
+                  </q-item>
+                </q-list>
+              </q-btn-dropdown>
               <i
                 v-if="!g.user.admin && tab != 'installed'"
                 v-text="$t('only_admins_can_install')"

lnbits/templates/pages/payments.vue

@@ -136,7 +136,7 @@
         </q-card>
       </div>
       <div
-        v-show="chartData.showPaymentStatus"
+        v-show="chartData.showPaymentTags"
         class="col-lg-3 col-md-6 col-sm-12 text-center"
       >
         <q-card class="q-pt-sm">

lnbits/utils/cache.py

@@ -1,13 +1,8 @@
 from __future__ import annotations
 
-import asyncio
 from time import time
 from typing import Any, NamedTuple
 
-from loguru import logger
-
-from lnbits.settings import settings
-
 
 class Cached(NamedTuple):
     value: Any
@@ -22,8 +17,7 @@ class Cache:
     Small caching utility providing simple get/set interface (very much like redis)
     """
 
-    def __init__(self, interval: float = 10) -> None:
-        self.interval = interval
+    def __init__(self) -> None:
         self._values: dict[Any, Cached] = {}
 
     def value(self, key: str) -> Cached | None:
@@ -59,16 +53,11 @@ class Cache:
             self.set(key, value, expiry=expiry)
             return value
 
-    async def invalidate_forever(self):
-        while settings.lnbits_running:
-            try:
-                await asyncio.sleep(self.interval)
-                ts = time()
-                expired = [k for k, v in self._values.items() if v.expiry < ts]
-                for k in expired:
-                    self._values.pop(k)
-            except Exception:
-                logger.error("Error invalidating cache")
+    async def invalidate_cache(self):
+        ts = time()
+        expired = [k for k, v in self._values.items() if v.expiry < ts]
+        for k in expired:
+            self._values.pop(k)
 
 
 cache = Cache()

lnbits/utils/electrum.py

@@ -0,0 +1,439 @@
+"""
+Electrum protocol client (https://github.com/spesmilo/electrum-protocol).
+
+JSON-RPC 2.0 over TCP / SSL (newline-delimited), with request/response
+correlation, subscription dispatch, and automatic keepalive pings.
+server.version is sent automatically on connect as required by the spec.
+"""
+
+import asyncio
+import hashlib
+import itertools
+import json
+import ssl
+from collections.abc import Callable
+from typing import Any
+from urllib.parse import urlparse
+
+from loguru import logger
+from pydantic import BaseModel
+
+
+class ElectrumError(Exception):
+    pass
+
+
+def scripthash_from_scriptpubkey(scriptpubkey: bytes) -> str:
+    """Electrum script hash: SHA-256 of scriptPubKey, byte-reversed to hex."""
+    return hashlib.sha256(scriptpubkey).digest()[::-1].hex()
+
+
+# ---------------------------------------------------------------------------
+# Response models
+# ---------------------------------------------------------------------------
+
+
+class Balance(BaseModel):
+    confirmed: int
+    unconfirmed: int
+
+
+class HistoryEntry(BaseModel):
+    tx_hash: str
+    height: int
+    fee: int | None = None  # present for mempool entries
+
+
+class MempoolEntry(BaseModel):
+    tx_hash: str
+    height: int
+    fee: int
+
+
+class UTXO(BaseModel):
+    tx_hash: str
+    tx_pos: int
+    height: int
+    value: int  # satoshis
+
+
+class BlockHeader(BaseModel):
+    height: int
+    hex: str
+
+
+class BlockHeaderProof(BaseModel):
+    """Returned by get_block_header when cp_height > 0."""
+
+    branch: list[str]
+    header: str
+    root: str
+
+
+class BlockHeaders(BaseModel):
+    count: int
+    hex: str
+    max: int
+
+
+class MerkleProof(BaseModel):
+    block_height: int
+    merkle: list[str]
+    pos: int
+
+
+class TxIdWithMerkle(BaseModel):
+    tx_hash: str
+    merkle: list[str]
+
+
+class FeeHistogramEntry(BaseModel):
+    fee_rate: float
+    vsize: float
+
+
+class ServerFeatures(BaseModel):
+    class Config:
+        extra = "allow"
+
+    genesis_hash: str = ""
+    protocol_max: str = ""
+    protocol_min: str = ""
+    server_version: str = ""
+    pruning: int | None = None
+    hash_function: str = "sha256d"
+    hosts: dict[str, Any] = {}
+
+
+# ---------------------------------------------------------------------------
+# Client
+# ---------------------------------------------------------------------------
+
+
+class ElectrumClient:
+    """
+    Async Electrum protocol client over plain TCP or SSL.
+
+    Messages are newline-terminated JSON-RPC 2.0, as required by the spec.
+    Handles request/response correlation by id, routes push notifications to
+    registered callbacks, and sends periodic pings to keep the connection alive.
+
+    Usage::
+
+        # Plain TCP
+        async with ElectrumClient("tcp://blockstream.info:110") as client:
+            height = await client.get_height()
+
+        # SSL
+        async with ElectrumClient("ssl://electrum.blockstream.info:50002") as c:
+            height = await c.get_height()
+    """
+
+    def __init__(
+        self,
+        url: str,
+        client_name: str = "lnbits",
+        protocol_version: str = "1.4",
+        ping_interval: float = 60.0,
+    ) -> None:
+        parsed = urlparse(url)
+        self.host = parsed.hostname or ""
+        self.port = parsed.port or (
+            50002 if parsed.scheme in ("ssl", "https") else 50001
+        )
+        self.use_ssl = parsed.scheme in ("ssl", "https")
+        self.client_name = client_name
+        self.protocol_version = protocol_version
+        self.ping_interval = ping_interval
+        self._counter = itertools.count(1)
+        self._pending: dict[int, asyncio.Future[Any]] = {}
+        self._subscriptions: dict[str, list[Callable[[list[Any]], Any]]] = {}
+        self._recv_task: asyncio.Task[None] | None = None
+        self._ping_task: asyncio.Task[None] | None = None
+        self._reader: asyncio.StreamReader | None = None
+        self._writer: asyncio.StreamWriter | None = None
+        self.server_version: str = ""
+        self.negotiated_protocol: str = ""
+
+    async def connect(self, timeout: float = 10.0) -> None:
+        ssl_ctx: ssl.SSLContext | None = None
+        if self.use_ssl:
+            ssl_ctx = ssl.create_default_context()
+        self._reader, self._writer = await asyncio.wait_for(
+            asyncio.open_connection(
+                self.host, self.port, ssl=ssl_ctx, limit=4 * 1024 * 1024
+            ),
+            timeout=timeout,
+        )
+        self._recv_task = asyncio.create_task(self._recv_loop())
+        result = await self._call(
+            "server.version", [self.client_name, self.protocol_version], timeout=timeout
+        )
+        self.server_version, self.negotiated_protocol = result[0], result[1]
+        logger.debug(
+            f"Electrum connected: server={self.server_version}"
+            f" protocol={self.negotiated_protocol}"
+        )
+        if self.ping_interval > 0:
+            self._ping_task = asyncio.create_task(self._ping_loop())
+
+    async def close(self) -> None:
+        for task in (self._ping_task, self._recv_task):
+            if task:
+                task.cancel()
+                try:
+                    await task
+                except asyncio.CancelledError:
+                    pass
+                except Exception:
+                    logger.debug("Electrum: error while cancelling task")
+        self._ping_task = None
+        self._recv_task = None
+        if self._writer:
+            self._writer.close()
+            try:
+                await asyncio.wait_for(self._writer.wait_closed(), timeout=5.0)
+            except Exception:
+                logger.debug("Electrum: error while closing writer")
+        self._reader = None
+        self._writer = None
+
+    async def __aenter__(self) -> "ElectrumClient":
+        try:
+            await self.connect()
+        except BaseException:
+            await self.close()
+            raise
+        return self
+
+    async def __aexit__(self, *_: Any) -> None:
+        await self.close()
+
+    # ---- internal plumbing ----
+
+    async def _call(
+        self,
+        method: str,
+        params: list[Any] | dict[str, Any] | None = None,
+        timeout: float = 30.0,
+    ) -> Any:
+        if not self._writer:
+            raise ElectrumError("Not connected")
+        req_id = next(self._counter)
+        fut: asyncio.Future[Any] = asyncio.get_running_loop().create_future()
+        self._pending[req_id] = fut
+        self._writer.write(
+            json.dumps(
+                {
+                    "jsonrpc": "2.0",
+                    "id": req_id,
+                    "method": method,
+                    "params": params if params is not None else [],
+                }
+            ).encode()
+            + b"\n"
+        )
+        await self._writer.drain()
+        try:
+            return await asyncio.wait_for(asyncio.shield(fut), timeout=timeout)
+        except asyncio.TimeoutError as exc:
+            self._pending.pop(req_id, None)
+            raise ElectrumError(f"Timeout waiting for response to {method!r}") from exc
+
+    def _dispatch(self, msg: dict[str, Any]) -> None:
+        msg_id = msg.get("id")
+        if msg_id is not None:
+            fut = self._pending.pop(msg_id, None)
+            if fut and not fut.done():
+                err = msg.get("error")
+                if err:
+                    fut.set_exception(ElectrumError(err))
+                else:
+                    fut.set_result(msg.get("result"))
+        else:
+            method = msg.get("method", "")
+            params = msg.get("params", [])
+            for cb in list(self._subscriptions.get(method, [])):
+                try:
+                    result = cb(params)
+                    if asyncio.iscoroutine(result):
+                        self._bg_tasks.add(asyncio.create_task(result))
+                except Exception:
+                    logger.exception(f"Electrum: callback error for {method!r}")
+
+    async def _recv_loop(self) -> None:
+        assert self._reader
+        self._bg_tasks: set[asyncio.Task[Any]] = set()
+        buf = b""
+        try:
+            while True:
+                chunk = await self._reader.read(65536)
+                if not chunk:
+                    break
+                buf += chunk
+                while b"\n" in buf:
+                    line, buf = buf.split(b"\n", 1)
+                    if not line.strip():
+                        continue
+                    try:
+                        msg: dict[str, Any] = json.loads(line)
+                    except json.JSONDecodeError:
+                        logger.warning(f"Electrum: invalid JSON: {line!r}")
+                        continue
+                    self._dispatch(msg)
+        except asyncio.CancelledError:
+            pass
+        except Exception:
+            logger.exception("Electrum: recv loop error")
+        finally:
+            for fut in self._pending.values():
+                if not fut.done():
+                    fut.set_exception(ElectrumError("Connection closed"))
+            self._pending.clear()
+
+    async def _ping_loop(self) -> None:
+        try:
+            while True:
+                await asyncio.sleep(self.ping_interval)
+                await self._call("server.ping")
+        except asyncio.CancelledError:
+            pass
+        except Exception:
+            logger.exception("Electrum: ping loop error")
+
+    # ---- subscription management ----
+
+    def on(self, method: str, callback: Callable[[list[Any]], Any]) -> None:
+        """Register a notification callback for a subscription method."""
+        self._subscriptions.setdefault(method, []).append(callback)
+
+    def off(self, method: str, callback: Callable[[list[Any]], Any]) -> None:
+        """Remove a previously registered notification callback."""
+        cbs = self._subscriptions.get(method)
+        if cbs and callback in cbs:
+            cbs.remove(callback)
+
+    # ---- server methods ----
+
+    async def server_ping(self) -> None:
+        await self._call("server.ping")
+
+    async def server_banner(self) -> str:
+        return await self._call("server.banner")
+
+    async def server_features(self) -> ServerFeatures:
+        data = await self._call("server.features")
+        return ServerFeatures.parse_obj(data)
+
+    async def server_peers(self) -> list[Any]:
+        return await self._call("server.peers.subscribe")
+
+    # ---- scripthash methods ----
+
+    async def get_balance(self, scripthash: str) -> Balance:
+        data = await self._call("blockchain.scripthash.get_balance", [scripthash])
+        return Balance.parse_obj(data)
+
+    async def get_history(self, scripthash: str) -> list[HistoryEntry]:
+        data = await self._call("blockchain.scripthash.get_history", [scripthash])
+        return [HistoryEntry.parse_obj(e) for e in data]
+
+    async def get_mempool(self, scripthash: str) -> list[MempoolEntry]:
+        data = await self._call("blockchain.scripthash.get_mempool", [scripthash])
+        return [MempoolEntry.parse_obj(e) for e in data]
+
+    async def listunspent(self, scripthash: str) -> list[UTXO]:
+        data = await self._call("blockchain.scripthash.listunspent", [scripthash])
+        return [UTXO.parse_obj(e) for e in data]
+
+    async def subscribe_scripthash(
+        self,
+        scripthash: str,
+        callback: Callable[[list[Any]], Any] | None = None,
+    ) -> str | None:
+        """Subscribe to status changes; returns current status hash or None."""
+        if callback:
+            self.on("blockchain.scripthash.subscribe", callback)
+        return await self._call("blockchain.scripthash.subscribe", [scripthash])
+
+    async def unsubscribe_scripthash(
+        self,
+        scripthash: str,
+        callback: Callable[[list[Any]], Any] | None = None,
+    ) -> bool:
+        if callback:
+            self.off("blockchain.scripthash.subscribe", callback)
+        return await self._call("blockchain.scripthash.unsubscribe", [scripthash])
+
+    async def subscribe_headers(
+        self,
+        callback: Callable[[list[Any]], Any] | None = None,
+    ) -> BlockHeader:
+        """Subscribe to new block headers; returns current tip."""
+        if callback:
+            self.on("blockchain.headers.subscribe", callback)
+        data = await self._call("blockchain.headers.subscribe")
+        return BlockHeader.parse_obj(data)
+
+    # ---- transaction methods ----
+
+    async def broadcast(self, raw_tx: str) -> str:
+        """Broadcast a raw transaction hex; returns txid on success."""
+        return await self._call("blockchain.transaction.broadcast", [raw_tx])
+
+    async def get_transaction(
+        self, txid: str, verbose: bool = False
+    ) -> str | dict[str, Any]:
+        return await self._call("blockchain.transaction.get", [txid, verbose])
+
+    async def get_merkle(self, txid: str, height: int) -> MerkleProof:
+        data = await self._call("blockchain.transaction.get_merkle", [txid, height])
+        return MerkleProof.parse_obj(data)
+
+    async def get_tx_id_from_pos(
+        self, height: int, tx_pos: int, merkle: bool = False
+    ) -> str | TxIdWithMerkle:
+        data = await self._call(
+            "blockchain.transaction.id_from_pos", [height, tx_pos, merkle]
+        )
+        if isinstance(data, dict):
+            return TxIdWithMerkle.parse_obj(data)
+        return data
+
+    # ---- block methods ----
+
+    async def get_tip(self) -> BlockHeader:
+        """Returns current chain tip."""
+        data = await self._call("blockchain.headers.subscribe")
+        return BlockHeader.parse_obj(data)
+
+    async def get_height(self) -> int:
+        """Returns the current best block height."""
+        return (await self.get_tip()).height
+
+    async def get_block_header(
+        self, height: int, cp_height: int = 0
+    ) -> str | BlockHeaderProof:
+        data = await self._call("blockchain.block.header", [height, cp_height])
+        if isinstance(data, dict):
+            return BlockHeaderProof.parse_obj(data)
+        return data
+
+    async def get_block_headers(
+        self, start_height: int, count: int, cp_height: int = 0
+    ) -> BlockHeaders:
+        data = await self._call(
+            "blockchain.block.headers", [start_height, count, cp_height]
+        )
+        return BlockHeaders.parse_obj(data)
+
+    # ---- fee methods ----
+
+    async def estimate_fee(self, num_blocks: int) -> float:
+        """Returns estimated fee rate in BTC/kB for confirmation within num_blocks."""
+        return await self._call("blockchain.estimatefee", [num_blocks])
+
+    async def fee_histogram(self) -> list[FeeHistogramEntry]:
+        """Returns mempool fee histogram as FeeHistogramEntry(fee_rate, vsize) list."""
+        data = await self._call("mempool.get_fee_histogram")
+        return [FeeHistogramEntry(fee_rate=r[0], vsize=r[1]) for r in data]

lnbits/utils/exchange_rates.py

@@ -289,7 +289,32 @@ async def btc_rates(currency: str) -> list[tuple[str, float]]:
     return apply_trimmed_mean_filter(all_rates)
 
 
+async def btc_price_from_aggregator(currency: str) -> float | None:
+    url = settings.lnbits_price_aggregator_url.rstrip("/")
+    try:
+        headers = {"User-Agent": settings.user_agent}
+        async with httpx.AsyncClient(headers=headers) as client:
+            r = await client.get(f"{url}/rate/{currency.upper()}", timeout=3)
+            r.raise_for_status()
+            data = r.json()
+            median = data.get("rates", {}).get("median")
+            if median:
+                return float(median)
+    except Exception as e:
+        logger.warning(f"Failed to fetch price from aggregator {url}: {e}")
+    return None
+
+
 async def btc_price(currency: str) -> float:
+    if (
+        settings.lnbits_price_aggregator_enabled
+        and settings.lnbits_price_aggregator_url
+    ):
+        price = await btc_price_from_aggregator(currency)
+        if price:
+            return price
+        logger.warning("Price aggregator failed, falling back to exchange providers.")
+
     rates = await btc_rates(currency)
     if not rates:
         logger.warning("Could not fetch any Bitcoin price.")

lnbits/utils/logger.py

@@ -41,19 +41,16 @@ def log_server_info():
 
 def initialize_server_websocket_logger() -> Callable:
     super_user_hash = sha256(settings.super_user.encode("utf-8")).hexdigest()
-
     serverlog_queue: asyncio.Queue = asyncio.Queue()
-
-    async def update_websocket_serverlog():
-        while settings.lnbits_running:
-            msg = await serverlog_queue.get()
-            await websocket_updater(super_user_hash, msg)
-
     logger.add(
         lambda msg: serverlog_queue.put_nowait(msg),
         format=Formatter().format,
     )
 
+    async def update_websocket_serverlog():
+        msg = await serverlog_queue.get()
+        await websocket_updater(super_user_hash, msg)
+
     return update_websocket_serverlog
 
 

lnbits/wallets/base.py

@@ -94,15 +94,15 @@ class PaymentStatus(NamedTuple):
 
 
 class PaymentSuccessStatus(PaymentStatus):
-    paid = True
+    paid = True  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class PaymentFailedStatus(PaymentStatus):
-    paid = False
+    paid = False  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class PaymentPendingStatus(PaymentStatus):
-    paid = None
+    paid = None  # type: ignore[reportIncompatibleVariableOverride]
 
 
 class Wallet(ABC):

lnbits/wallets/blink.py

@@ -8,7 +8,7 @@ from loguru import logger
 from pydantic import BaseModel
 from websockets import Subprotocol, connect
 
-from lnbits import bolt11
+from lnbits import bolt11 as bolt11_lib
 from lnbits.helpers import normalize_endpoint
 from lnbits.settings import settings
 
@@ -164,15 +164,13 @@ class BlinkWallet(Wallet):
                 ok=False, error_message=f"Unable to connect to {self.endpoint}."
             )
 
-    async def pay_invoice(
-        self, bolt11_invoice: str, fee_limit_msat: int
-    ) -> PaymentResponse:
+    async def pay_invoice(self, bolt11: str, fee_limit_msat: int) -> PaymentResponse:
         # https://dev.blink.sv/api/btc-ln-send
         # Future: add check fee estimate is < fee_limit_msat before paying invoice
 
         payment_variables = {
             "input": {
-                "paymentRequest": bolt11_invoice,
+                "paymentRequest": bolt11,
                 "walletId": self.wallet_id,
                 "memo": "Payment memo",
             }
@@ -190,7 +188,7 @@ class BlinkWallet(Wallet):
                 error_message = errors[0].get("message")
                 return PaymentResponse(ok=False, error_message=error_message)
 
-            checking_id = bolt11.decode(bolt11_invoice).payment_hash
+            checking_id = bolt11_lib.decode(bolt11).payment_hash
 
             payment_status = await self.get_payment_status(checking_id)
             fee_msat = payment_status.fee_msat
@@ -199,7 +197,7 @@ class BlinkWallet(Wallet):
                 ok=True, checking_id=checking_id, fee_msat=fee_msat, preimage=preimage
             )
         except Exception as exc:
-            logger.info(f"Failed to pay invoice {bolt11_invoice}")
+            logger.info(f"Failed to pay invoice {bolt11}")
             logger.warning(exc)
             return PaymentResponse(
                 error_message=f"Unable to connect to {self.endpoint}."

lnbits/wallets/breez.py

@@ -19,7 +19,7 @@ else:
 
     from bolt11 import Bolt11Exception
     from bolt11 import decode as bolt11_decode
-    from breez_sdk import (
+    from breez_sdk import (  # type: ignore[reportMissingImports]
         BreezEvent,
         ConnectRequest,
         EnvironmentType,
@@ -39,7 +39,9 @@ else:
         default_config,
         mnemonic_to_seed,
     )
-    from breez_sdk import PaymentStatus as BreezPaymentStatus
+    from breez_sdk import (
+        PaymentStatus as BreezPaymentStatus,  # type: ignore[reportMissingImports]
+    )
     from loguru import logger
 
     from lnbits.settings import settings

lnbits/wallets/breez_liquid.py

@@ -18,7 +18,7 @@ else:
     from pathlib import Path
 
     from bolt11 import decode as bolt11_decode
-    from breez_sdk_liquid import (
+    from breez_sdk_liquid import (  # type: ignore[reportMissingImports]
         ConnectRequest,
         EventListener,
         GetInfoResponse,

lnbits/wallets/fake.py

@@ -103,7 +103,7 @@ class FakeWallet(Wallet):
             preimage=preimage.hex(),
         )
 
-    async def pay_invoice(self, bolt11: str, _: int) -> PaymentResponse:
+    async def pay_invoice(self, bolt11: str, fee_limit_msat: int) -> PaymentResponse:
         try:
             invoice = decode(bolt11)
         except Bolt11Exception as exc:
@@ -130,7 +130,7 @@ class FakeWallet(Wallet):
             return PaymentPendingStatus()
         return PaymentFailedStatus()
 
-    async def get_payment_status(self, _: str) -> PaymentStatus:
+    async def get_payment_status(self, checking_id: str) -> PaymentStatus:
         return PaymentPendingStatus()
 
     async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:

lnbits/wallets/lndgrpc.py

@@ -118,7 +118,7 @@ class LndWallet(Wallet):
 
         cert = open(cert_path, "rb").read()
         creds = grpc.ssl_channel_credentials(cert)
-        auth_creds = grpc.metadata_call_credentials(self.metadata_callback)
+        auth_creds = grpc.metadata_call_credentials(self.metadata_callback)  # type: ignore[reportArgumentType]
         composite_creds = grpc.composite_channel_credentials(creds, auth_creds)
         channel = grpc.aio.secure_channel(
             f"{self.endpoint}:{self.port}", composite_creds
@@ -192,6 +192,8 @@ class LndWallet(Wallet):
             fee_limit_msat=fee_limit_msat,
             timeout_seconds=30,
             no_inflight_updates=True,
+            max_parts=16,
+            time_pref=0.9,
         )
         try:
             res: Payment = await self.router_rpc.SendPaymentV2(req).read()

lnbits/wallets/lndrest.py

@@ -3,6 +3,7 @@ import base64
 import hashlib
 import json
 from collections.abc import AsyncGenerator
+from typing import Any
 
 import httpx
 from loguru import logger
@@ -123,8 +124,8 @@ class LndRestWallet(Wallet):
                 hashlib.sha256(unhashed_description).digest()
             ).decode("ascii")
 
-        preimage, _payment_hash = random_secret_and_hash()
-        _data["r_hash"] = base64.b64encode(bytes.fromhex(_payment_hash)).decode()
+        preimage, payment_hash = random_secret_and_hash()
+        _data["r_hash"] = base64.b64encode(bytes.fromhex(payment_hash)).decode()
         _data["r_preimage"] = base64.b64encode(bytes.fromhex(preimage)).decode()
 
         try:
@@ -132,34 +133,7 @@ class LndRestWallet(Wallet):
             r.raise_for_status()
             data = r.json()
 
-            if len(data) == 0:
-                return InvoiceResponse(ok=False, error_message="no data")
-
-            if "error" in data:
-                return InvoiceResponse(
-                    ok=False, error_message=f"""Server error: '{data["error"]}'"""
-                )
-
-            if r.is_error:
-                return InvoiceResponse(
-                    ok=False, error_message=f"Server error: '{r.text}'"
-                )
-
-            if "payment_request" not in data or "r_hash" not in data:
-                return InvoiceResponse(
-                    ok=False, error_message="Server error: 'missing required fields'"
-                )
-
-            payment_request = data["payment_request"]
-            payment_hash = base64.b64decode(data["r_hash"]).hex()
-            checking_id = payment_hash
-            return InvoiceResponse(
-                ok=True,
-                checking_id=checking_id,
-                payment_request=payment_request,
-                preimage=preimage,
-            )
-
+            return self._parse_create_invoice_response(r, data, preimage)
         except json.JSONDecodeError:
             return InvoiceResponse(
                 ok=False, error_message="Server error: 'invalid json response'"
@@ -242,12 +216,13 @@ class LndRestWallet(Wallet):
             logger.warning(f"Error getting invoice status: {e}")
             return PaymentPendingStatus()
 
-        if r.is_error or data.get("settled") is None:
+        if r.is_error or data.get("state") is None:
             # this must also work when checking_id is not a hex recognizable by lnd
-            # it will return an error and no "settled" attribute on the object
+            # it will return an error and no "state" attribute on the object
+            logger.warning(f"Error checking invoice from LND REST API: {r.text}")
             return PaymentPendingStatus()
 
-        if data.get("settled") is True:
+        if data.get("state") == "SETTLED":
             return PaymentSuccessStatus()
 
         if data.get("state") == "CANCELED":
@@ -264,10 +239,11 @@ class LndRestWallet(Wallet):
                 "ascii"
             )
         except ValueError:
+            logger.warning("Invalid checking_id format, must be hex: {checking_id}")
             return PaymentPendingStatus()
 
         url = f"/v2/router/track/{checking_id}"
-        async with self.client.stream("GET", url, timeout=None) as r:
+        async with self.client.stream("GET", url, timeout=30) as r:
             async for json_line in r.aiter_lines():
                 try:
                     line = json.loads(json_line)
@@ -298,7 +274,7 @@ class LndRestWallet(Wallet):
                     return PaymentFailedStatus()
                 elif status == "IN_FLIGHT":
                     logger.info(f"LNDRest Payment in flight: {checking_id}")
-                    return PaymentPendingStatus()
+                    continue
 
         logger.info(f"LNDRest Payment non-existent: {checking_id}")
         return PaymentPendingStatus()
@@ -311,13 +287,12 @@ class LndRestWallet(Wallet):
                     async for line in r.aiter_lines():
                         try:
                             inv = json.loads(line)["result"]
-                            if not inv["settled"]:
+                            if not inv.get("state") == "SETTLED":
                                 continue
+                            payment_hash = base64.b64decode(inv.get("r_hash")).hex()
                         except Exception as exc:
                             logger.debug(exc)
                             continue
-
-                        payment_hash = base64.b64decode(inv["r_hash"]).hex()
                         yield payment_hash
             except Exception as exc:
                 logger.warning(
@@ -363,8 +338,6 @@ class LndRestWallet(Wallet):
             return InvoiceResponse(ok=False, error_message=str(exc))
 
         payment_request = data["payment_request"]
-        payment_hash = base64.b64encode(bytes.fromhex(payment_hash)).decode("ascii")
-
         return InvoiceResponse(
             ok=True, checking_id=payment_hash, payment_request=payment_request
         )
@@ -399,3 +372,31 @@ class LndRestWallet(Wallet):
         except Exception as exc:
             logger.warning(exc)
             return InvoiceResponse(ok=False, error_message=str(exc))
+
+    def _parse_create_invoice_response(
+        self, r: Any, data: dict, preimage: str
+    ) -> InvoiceResponse:
+        if not data:
+            return InvoiceResponse(ok=False, error_message="no data")
+        if "error" in data:
+            return InvoiceResponse(
+                ok=False, error_message=f"Server error: '{data['error']}'"
+            )
+        if r.is_error:
+            return InvoiceResponse(ok=False, error_message=f"Server error: '{r.text}'")
+        if "payment_request" not in data or "r_hash" not in data:
+            return InvoiceResponse(
+                ok=False, error_message="Server error: 'missing required fields'"
+            )
+        try:
+            payment_hash = base64.b64decode(data["r_hash"]).hex()
+        except Exception:
+            return InvoiceResponse(
+                ok=False, error_message=f"Unable to b64decode to {data['r_hash']}."
+            )
+        return InvoiceResponse(
+            ok=True,
+            checking_id=payment_hash,
+            payment_request=data["payment_request"],
+            preimage=preimage,
+        )

lnbits/wallets/phoenixd.py

@@ -117,11 +117,12 @@ class PhoenixdWallet(Wallet):
             # PhoenixD description limited to 128 characters
             if description_hash:
                 data["descriptionHash"] = description_hash.hex()
+            elif unhashed_description:
+                data["descriptionHash"] = hashlib.sha256(
+                    unhashed_description
+                ).hexdigest()
             else:
-                desc = memo
-                if desc is None and unhashed_description:
-                    desc = unhashed_description.decode()
-                desc = desc or ""
+                desc = memo or ""
                 if len(desc) > 128:
                     data["descriptionHash"] = hashlib.sha256(desc.encode()).hexdigest()
                 else:

package-lock.json

@@ -24,7 +24,7 @@
         "clean-css-cli": "^5.6.3",
         "concat": "^1.0.3",
         "prettier": "^3.8.3",
-        "pyright": "1.1.289",
+        "pyright": "1.1.409",
         "sass": "^1.99.0",
         "terser": "^5.47.1"
       }
@@ -1808,9 +1808,9 @@
       }
     },
     "node_modules/pyright": {
-      "version": "1.1.289",
-      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.289.tgz",
-      "integrity": "sha512-fG3STxnwAt3i7bxbXUPJdYNFrcOWHLwCSEOySH2foUqtYdzWLcxDez0Kgl1X8LMQx0arMJ6HRkKghxfRD1/z6g==",
+      "version": "1.1.409",
+      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.409.tgz",
+      "integrity": "sha512-13VFQyw4mJzshZxcxiYbNjo1hG/WHSRDj70Y3lbJEHqCkI2dvBAUTti8VV6Ezsr5gT93pFvC0e/jAQS4JdHarA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -1818,7 +1818,10 @@
         "pyright-langserver": "langserver.index.js"
       },
       "engines": {
-        "node": ">=12.0.0"
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
       }
     },
     "node_modules/qrcode.vue": {

package.json

@@ -16,7 +16,7 @@
     "clean-css-cli": "^5.6.3",
     "concat": "^1.0.3",
     "prettier": "^3.8.3",
-    "pyright": "1.1.289",
+    "pyright": "1.1.409",
     "sass": "^1.99.0",
     "terser": "^5.47.1"
   },
@@ -111,6 +111,7 @@
       "js/pages/users.js",
       "js/pages/account.js",
       "js/pages/admin.js",
+      "js/components/admin/lnbits-admin-funding-seed-backup.js",
       "js/components/admin/lnbits-admin-funding.js",
       "js/components/admin/lnbits-admin-funding-sources.js",
       "js/components/admin/lnbits-admin-fiat-providers.js",

poetry.lock

@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
 
 [[package]]
 name = "aiohappyeyeballs"
@@ -665,6 +665,19 @@ bitstring = "*"
 click = "*"
 coincurve = "*"
 
+[[package]]
+name = "boltz-client"
+version = "0.4.0"
+description = "Boltz Swap library"
+optional = true
+python-versions = ">=3.10"
+groups = ["main"]
+markers = "extra == \"liquid\""
+files = [
+    {file = "boltz_client-0.4.0-py3-none-manylinux_2_34_x86_64.whl", hash = "sha256:ed0b520209cf1b05a8523002f5d8f26fa29c04d2faecc9cbde3621b4ddc417e6"},
+    {file = "boltz_client-0.4.0.tar.gz", hash = "sha256:a3f5a6b637350267856e3ab680cd92158de720fa2d5805fc075e4583d020cb2a"},
+]
+
 [[package]]
 name = "breez-sdk"
 version = "0.8.0"
@@ -2134,7 +2147,7 @@ files = [
 
 [package.dependencies]
 attrs = ">=22.2.0"
-jsonschema-specifications = ">=2023.3.6"
+jsonschema-specifications = ">=2023.03.6"
 referencing = ">=0.28.4"
 rpds-py = ">=0.25.0"
 
@@ -2295,7 +2308,7 @@ colorama = {version = ">=0.3.4", markers = "sys_platform == \"win32\""}
 win32-setctime = {version = ">=1.0.0", markers = "sys_platform == \"win32\""}
 
 [package.extras]
-dev = ["Sphinx (==8.1.3) ; python_version >= \"3.11\"", "build (==1.2.2) ; python_version >= \"3.11\"", "colorama (==0.4.5) ; python_version < \"3.8\"", "colorama (==0.4.6) ; python_version >= \"3.8\"", "exceptiongroup (==1.1.3) ; python_version >= \"3.7\" and python_version < \"3.11\"", "freezegun (==1.1.0) ; python_version < \"3.8\"", "freezegun (==1.5.0) ; python_version >= \"3.8\"", "mypy (==0.910) ; python_version < \"3.6\"", "mypy (==0.971) ; python_version == \"3.6\"", "mypy (==1.13.0) ; python_version >= \"3.8\"", "mypy (==1.4.1) ; python_version == \"3.7\"", "myst-parser (==4.0.0) ; python_version >= \"3.11\"", "pre-commit (==4.0.1) ; python_version >= \"3.9\"", "pytest (==6.1.2) ; python_version < \"3.8\"", "pytest (==8.3.2) ; python_version >= \"3.8\"", "pytest-cov (==2.12.1) ; python_version < \"3.8\"", "pytest-cov (==5.0.0) ; python_version == \"3.8\"", "pytest-cov (==6.0.0) ; python_version >= \"3.9\"", "pytest-mypy-plugins (==1.9.3) ; python_version >= \"3.6\" and python_version < \"3.8\"", "pytest-mypy-plugins (==3.1.0) ; python_version >= \"3.8\"", "sphinx-rtd-theme (==3.0.2) ; python_version >= \"3.11\"", "tox (==3.27.1) ; python_version < \"3.8\"", "tox (==4.23.2) ; python_version >= \"3.8\"", "twine (==6.0.1) ; python_version >= \"3.11\""]
+dev = ["Sphinx (==8.1.3) ; python_version >= \"3.11\"", "build (==1.2.2) ; python_version >= \"3.11\"", "colorama (==0.4.5) ; python_version < \"3.8\"", "colorama (==0.4.6) ; python_version >= \"3.8\"", "exceptiongroup (==1.1.3) ; python_version >= \"3.7\" and python_version < \"3.11\"", "freezegun (==1.1.0) ; python_version < \"3.8\"", "freezegun (==1.5.0) ; python_version >= \"3.8\"", "mypy (==v0.910) ; python_version < \"3.6\"", "mypy (==v0.971) ; python_version == \"3.6\"", "mypy (==v1.13.0) ; python_version >= \"3.8\"", "mypy (==v1.4.1) ; python_version == \"3.7\"", "myst-parser (==4.0.0) ; python_version >= \"3.11\"", "pre-commit (==4.0.1) ; python_version >= \"3.9\"", "pytest (==6.1.2) ; python_version < \"3.8\"", "pytest (==8.3.2) ; python_version >= \"3.8\"", "pytest-cov (==2.12.1) ; python_version < \"3.8\"", "pytest-cov (==5.0.0) ; python_version == \"3.8\"", "pytest-cov (==6.0.0) ; python_version >= \"3.9\"", "pytest-mypy-plugins (==1.9.3) ; python_version >= \"3.6\" and python_version < \"3.8\"", "pytest-mypy-plugins (==3.1.0) ; python_version >= \"3.8\"", "sphinx-rtd-theme (==3.0.2) ; python_version >= \"3.11\"", "tox (==3.27.1) ; python_version < \"3.8\"", "tox (==4.23.2) ; python_version >= \"3.8\"", "twine (==6.0.1) ; python_version >= \"3.11\""]
 
 [[package]]
 name = "markdown-it-py"
@@ -5104,10 +5117,10 @@ propcache = ">=0.2.1"
 
 [extras]
 breez = ["breez-sdk", "breez-sdk-liquid"]
-liquid = ["wallycore"]
+liquid = ["boltz-client", "wallycore"]
 migration = ["psycopg2-binary"]
 
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10,<3.13"
-content-hash = "4050934800e6dfcc5242d1847d3db69eb6e91d634c09368a28255ad3c908b568"
+content-hash = "7c70bdad0089089d383cf8f54c37c4473180cea175689b91322beaed1ab42e94"

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lnbits"
-version = "1.5.4"
+version = "1.5.6"
 requires-python = ">=3.10,<3.13"
 description = "LNbits, free and open-source Lightning wallet and accounts system."
 authors = [{ name = "Alan Bits", email = "alan@lnbits.com" }]
@@ -61,7 +61,7 @@ lnbits-cli = "lnbits.commands:main"
 
 [project.optional-dependencies]
 breez = ["breez-sdk~=0.8.0", "breez-sdk-liquid~=0.11.11"]
-liquid = ["wallycore~=1.5.1"]
+liquid = ["wallycore~=1.5.1", "boltz-client==0.4.0"]
 migration = ["psycopg2-binary~=2.9.11"]
 
 [dependency-groups]

tests/api/test_admin_api.py

@@ -3,6 +3,7 @@ from pathlib import Path
 import pytest
 from httpx import AsyncClient
 
+from lnbits.core.crud.settings import get_settings_field, set_settings_field
 from lnbits.server import server_restart
 from lnbits.settings import Settings
 
@@ -81,7 +82,8 @@ async def test_admin_audit_monitor_and_test_email(
         headers={"Authorization": f"Bearer {superuser_token}"},
     )
     assert monitor.status_code == 200
-    assert "invoice_listeners" in monitor.json()
+    task_names = [t["name"] for t in monitor.json()]
+    assert any("invoice_listener" in name for name in task_names)
 
     test_email = await client.get(
         "/admin/api/v1/testemail",
@@ -150,6 +152,15 @@ async def test_admin_partial_reset_restart_and_backup(
 async def test_admin_delete_settings_requires_superuser(
     client: AsyncClient, superuser_token: str
 ):
+    await set_settings_field("lnbits_site_title", "Reset me")
+    await set_settings_field("lnbits_backend_wallet_class", "BoltzWallet")
+    await set_settings_field("boltz_mnemonic", "keep boltz seed")
+    await set_settings_field("boltz_mnemonic_backup_confirmed", True)
+    await set_settings_field("phoenixd_mnemonic", "keep phoenixd seed")
+    await set_settings_field("phoenixd_mnemonic_backup_confirmed", True)
+    await set_settings_field("spark_l2_mnemonic", "keep spark seed")
+    await set_settings_field("spark_l2_mnemonic_backup_confirmed", True)
+
     server_restart.clear()
     response = await client.delete(
         "/admin/api/v1/settings",
@@ -157,4 +168,21 @@ async def test_admin_delete_settings_requires_superuser(
     )
     assert response.status_code == 200
     assert server_restart.is_set() is True
+    assert await get_settings_field("lnbits_site_title") is None
+
+    backend_wallet = await get_settings_field("lnbits_backend_wallet_class")
+    boltz_seed = await get_settings_field("boltz_mnemonic")
+    boltz_confirmed = await get_settings_field("boltz_mnemonic_backup_confirmed")
+    phoenixd_seed = await get_settings_field("phoenixd_mnemonic")
+    phoenixd_confirmed = await get_settings_field("phoenixd_mnemonic_backup_confirmed")
+    spark_l2_seed = await get_settings_field("spark_l2_mnemonic")
+    spark_l2_confirmed = await get_settings_field("spark_l2_mnemonic_backup_confirmed")
+    assert backend_wallet and backend_wallet.value == "BoltzWallet"
+    assert boltz_seed and boltz_seed.value == "keep boltz seed"
+    assert boltz_confirmed and boltz_confirmed.value is True
+    assert phoenixd_seed and phoenixd_seed.value == "keep phoenixd seed"
+    assert phoenixd_confirmed and phoenixd_confirmed.value is True
+    assert spark_l2_seed and spark_l2_seed.value == "keep spark seed"
+    assert spark_l2_confirmed and spark_l2_confirmed.value is True
+
     server_restart.clear()

tests/api/test_auth_api.py

@@ -72,9 +72,43 @@ async def test_auth_api_sso_login_and_callback(http_client: AsyncClient, mocker)
     login_sso = _FakeSSO()
     mocker.patch("lnbits.core.views.auth_api._new_sso", return_value=login_sso)
 
-    response = await http_client.get(
+    unauthenticated = await http_client.get(
         f"/api/v1/auth/{provider}", params={"user_id": user.id}
     )
+    assert unauthenticated.status_code == 403
+    assert unauthenticated.json()["detail"] == "User ID mismatch."
+
+    other_user = await create_user_account(
+        Account(
+            id=uuid4().hex,
+            username=f"user_{uuid4().hex[:8]}",
+            email=f"user_{uuid4().hex[:8]}@lnbits.com",
+        )
+    )
+    other_login = await http_client.post(
+        "/api/v1/auth/usr", json={"usr": other_user.id}
+    )
+    http_client.cookies.clear()
+    assert other_login.status_code == 200
+    other_headers = {
+        "Authorization": f"Bearer {other_login.json()['access_token']}",
+    }
+    wrong_user = await http_client.get(
+        f"/api/v1/auth/{provider}",
+        params={"user_id": user.id},
+        headers=other_headers,
+    )
+    assert wrong_user.status_code == 403
+    assert wrong_user.json()["detail"] == "User ID mismatch."
+
+    login = await http_client.post("/api/v1/auth/usr", json={"usr": user.id})
+    http_client.cookies.clear()
+    assert login.status_code == 200
+    headers = {"Authorization": f"Bearer {login.json()['access_token']}"}
+
+    response = await http_client.get(
+        f"/api/v1/auth/{provider}", params={"user_id": user.id}, headers=headers
+    )
     assert response.status_code == 307
     assert response.headers["location"] == "https://example.com/sso/login"
     assert login_sso.redirect_uri == f"{http_client.base_url}/api/v1/auth/github/token"

tests/api/test_callback_api.py

@@ -194,7 +194,7 @@ async def test_callback_api_handles_revolut_subscription_event(
     settings.revolut_api_secret_key = "revolut-secret"
     settings.revolut_api_version = "2026-04-20"
     revolut_provider = RevolutWallet()
-    mocker.patch.object(
+    get_subscription_mock = mocker.patch.object(
         revolut_provider,
         "get_subscription",
         return_value={
@@ -253,23 +253,10 @@ async def test_callback_api_handles_revolut_subscription_event(
         }
     )
 
-    assert create_wallet_invoice_mock.await_count == 1
-    called_wallet_id, invoice = create_wallet_invoice_mock.await_args.args
-    assert called_wallet_id == "wallet_1"
-    assert invoice.amount == 9.25
-    assert invoice.memo == "Revolut Members"
-    assert invoice.external_id == "SUBSCRIPTION_1"
-    assert invoice.internal is True
-    assert invoice.extra["fiat_method"] == "subscription"
-    assert invoice.extra["subscription"]["checking_id"] == "order_ORDER_SUB_1"
-    assert payment.fiat_provider == "revolut"
-    assert payment.fee == -2
-    assert payment.extra["fiat_checking_id"] == "order_ORDER_SUB_1"
-    assert payment.checking_id == "fiat_revolut_order_ORDER_SUB_1"
-    update_payment_mock.assert_awaited_once_with(
-        payment, "fiat_revolut_order_ORDER_SUB_1"
-    )
-    fiat_status_mock.assert_awaited_once_with(payment)
+    get_subscription_mock.assert_not_awaited()
+    create_wallet_invoice_mock.assert_not_awaited()
+    update_payment_mock.assert_not_awaited()
+    fiat_status_mock.assert_not_awaited()
 
 
 @pytest.mark.anyio
@@ -353,10 +340,9 @@ async def test_callback_api_handles_revolut_subscription_order_event(
 
     assert get_payment_mock.await_count == 2
     get_payment_mock.assert_any_await("fiat_revolut_order_ORDER_SUB_1")
-    assert get_order_mock.await_count == 2
+    assert get_order_mock.await_count == 1
     assert [call.args for call in get_subscription_mock.await_args_list] == [
         ("SUBSCRIPTION_1",),
-        ("SUBSCRIPTION_1",),
     ]
     assert create_wallet_invoice_mock.await_count == 1
     called_wallet_id, invoice = create_wallet_invoice_mock.await_args.args

tests/api/test_lnurl_api.py

@@ -1,3 +1,4 @@
+from typing import cast
 from uuid import uuid4
 
 import pytest
@@ -106,7 +107,7 @@ async def test_lnurl_api_auth_and_pay_flow(mocker):
         await api_perform_lnurlauth(auth_response, wallet_info)
 
     action_response = LnurlPayActionResponse(
-        pr=LightningInvoice(TEST_BOLT11),
+        pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11)),
         disposable=False,
         successAction=parse_obj_as(MessageAction, {"message": "paid"}),
     )

tests/api/test_payment_api.py

@@ -6,7 +6,7 @@ import pytest
 from fastapi import HTTPException
 from pydantic import ValidationError
 
-from lnbits.core.crud.payments import create_payment, get_payments
+from lnbits.core.crud.payments import create_payment, get_payment, get_payments
 from lnbits.core.models import Account, CreateInvoice, PaymentFilters, PaymentState
 from lnbits.core.models.payments import CancelInvoice, CreatePayment, SettleInvoice
 from lnbits.core.models.users import AccountId
@@ -161,7 +161,7 @@ async def test_payment_api_fee_reserve_and_hold_invoice_actions(mocker):
         wallet.id, CreateInvoice(out=False, amount=42, memo="reserve")
     )
     reserve = await api_payments_fee_reserve(invoice.bolt11)
-    assert json.loads(reserve.body)["fee_reserve"] >= 0
+    assert json.loads(bytes(reserve.body))["fee_reserve"] >= 0
 
     with pytest.raises(HTTPException, match="Invoice has no amount."):
         await api_payments_fee_reserve(ZERO_AMOUNT_INVOICE)
@@ -218,6 +218,164 @@ async def test_payment_api_fee_reserve_and_hold_invoice_actions(mocker):
     cancel_mock.assert_awaited_once()
 
 
+@pytest.mark.anyio
+async def test_payment_extra_update_appends_new_keys(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    checking_id = await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+        tag="splitpayments",
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={
+            "payment_hash": payment_hash,
+            "extra": {"child": "daughter", "compliance_note": "reviewed"},
+        },
+    )
+
+    assert response.status_code == 200
+    extra = response.json()["extra"]
+    assert extra["tag"] == "splitpayments"
+    assert extra["child"] == "daughter"
+    assert extra["compliance_note"] == "reviewed"
+
+    payment = await get_payment(checking_id)
+    assert payment.extra == extra
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_creates_extra_when_missing(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    checking_id = await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "reviewed"}},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["extra"] == {"note": "reviewed"}
+
+    payment = await get_payment(checking_id)
+    assert payment.extra == {"note": "reviewed"}
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_rejects_existing_keys(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    checking_id = await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+        tag="original",
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"tag": "overwritten"}},
+    )
+
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Extra keys already exist: tag."
+
+    payment = await get_payment(checking_id)
+    assert payment.extra == {"tag": "original"}
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_requires_admin_key(
+    client,
+    to_wallet,
+    inkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=inkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "invoice key"}},
+    )
+
+    assert response.status_code == 403
+    assert response.json()["detail"] == "Invalid adminkey."
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_is_wallet_scoped(
+    client,
+    from_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    await _create_payment(
+        from_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "wrong wallet"}},
+    )
+
+    assert response.status_code == 404
+    assert response.json()["detail"] == "Payment does not exist."
+
+
+@pytest.mark.anyio
+async def test_payment_extra_update_requires_successful_payment(
+    client,
+    to_wallet,
+    adminkey_headers_to,
+):
+    payment_hash = uuid4().hex
+    await _create_payment(
+        to_wallet.id,
+        amount_msat=1_000,
+        payment_hash=payment_hash,
+        status=PaymentState.PENDING,
+    )
+
+    response = await client.patch(
+        "/api/v1/payments/extra",
+        headers=adminkey_headers_to,
+        json={"payment_hash": payment_hash, "extra": {"note": "too early"}},
+    )
+
+    assert response.status_code == 400
+    assert (
+        response.json()["detail"] == "Payment extra can only be updated after success."
+    )
+
+
 async def _create_payment(
     wallet_id: str,
     *,

tests/regtest/helpers.py

@@ -26,8 +26,6 @@ docker_bitcoin_cli = [
     "exec",
     "lnbits-bitcoind-1",
     "bitcoin-cli",
-    "-rpcuser=lnbits",
-    "-rpcpassword=lnbits",
     "-regtest",
 ]
 

tests/regtest/test_electrum.py

@@ -0,0 +1,184 @@
+"""
+Electrum client integration tests against the regtest electrs container.
+Requires the regtest docker-compose stack (docker/regtest/docker-compose.yml).
+electrs is exposed on localhost:19001 (plain TCP) and localhost:3002 (HTTP).
+"""
+
+import asyncio
+
+import httpx
+import pytest
+from loguru import logger
+
+from lnbits.utils.electrum import ElectrumClient, scripthash_from_scriptpubkey
+
+from .helpers import docker_bitcoin_cli, run_cmd, run_cmd_json
+
+ELECTRS_HOST = "localhost"
+ELECTRS_PORT = 19001
+ELECTRS_HTTP = "http://localhost:3002"
+
+
+def bitcoin_height() -> int:
+    return run_cmd_json([*docker_bitcoin_cli, "getblockchaininfo"])["blocks"]
+
+
+def mine_blocks(n: int = 1) -> int:
+    """Mine n blocks and return the new chain height."""
+    run_cmd([*docker_bitcoin_cli, "-generate", str(n)])
+    return bitcoin_height()
+
+
+def new_address() -> str:
+    return run_cmd([*docker_bitcoin_cli, "getnewaddress", "bech32"])
+
+
+def get_scriptpubkey(address: str) -> bytes:
+    info = run_cmd_json([*docker_bitcoin_cli, "getaddressinfo", address])
+    return bytes.fromhex(info["scriptPubKey"])
+
+
+def send_to_address(address: str, sats: int) -> str:
+    btc = f"{sats * 1e-8:.8f}"
+    return run_cmd([*docker_bitcoin_cli, "sendtoaddress", address, btc])
+
+
+async def wait_for_electrs(height: int, timeout: float = 15.0) -> None:
+    """Poll electrs HTTP until it has indexed up to `height`."""
+    loop = asyncio.get_running_loop()
+    deadline = loop.time() + timeout
+    async with httpx.AsyncClient() as http:
+        while loop.time() < deadline:
+            try:
+                r = await http.get(f"{ELECTRS_HTTP}/blocks/tip/height", timeout=2)
+                if int(r.text) >= height:
+                    return
+            except Exception:
+                logger.debug("electrs not ready yet")
+            await asyncio.sleep(0.25)
+    raise TimeoutError(f"electrs did not reach height {height} within {timeout}s")
+
+
+@pytest.fixture(scope="module", autouse=True)
+async def wait_after_electrum_tests():
+    yield
+    await asyncio.sleep(1)
+
+
+@pytest.mark.anyio
+async def test_connect_and_height():
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        before = await client.get_height()
+
+    target = mine_blocks(3)
+    await wait_for_electrs(target)
+
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        after = await client.get_height()
+
+    assert isinstance(before, int) and before >= 0
+    assert after == before + 3
+
+
+@pytest.mark.anyio
+async def test_get_tip():
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        tip = await client.get_tip()
+        assert isinstance(tip.height, int)
+        assert isinstance(tip.hex, str)
+        assert len(tip.hex) == 160  # 80-byte serialised header
+
+
+@pytest.mark.anyio
+async def test_server_banner():
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        banner = await client.server_banner()
+        assert isinstance(banner, str)
+
+
+@pytest.mark.anyio
+async def test_balance_after_payment():
+    address = new_address()
+    scripthash = scripthash_from_scriptpubkey(get_scriptpubkey(address))
+
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        empty = await client.get_balance(scripthash)
+        assert empty.confirmed == 0
+        assert empty.unconfirmed == 0
+
+    send_to_address(address, 500_000)
+    target = mine_blocks(1)
+    await wait_for_electrs(target)
+
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        confirmed = await client.get_balance(scripthash)
+        assert confirmed.confirmed == 500_000
+        assert confirmed.unconfirmed == 0
+
+
+@pytest.mark.anyio
+async def test_history_and_utxos():
+    address = new_address()
+    scripthash = scripthash_from_scriptpubkey(get_scriptpubkey(address))
+
+    send_to_address(address, 250_000)
+    target = mine_blocks(1)
+    await wait_for_electrs(target)
+
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        history = await client.get_history(scripthash)
+        assert len(history) >= 1
+        assert history[0].tx_hash
+        assert history[0].height > 0
+
+        utxos = await client.listunspent(scripthash)
+        assert len(utxos) == 1
+        assert utxos[0].value == 250_000
+
+        raw_tx = await client.get_transaction(utxos[0].tx_hash)
+        assert isinstance(raw_tx, str) and len(raw_tx) > 0
+
+
+@pytest.mark.anyio
+async def test_subscribe_scripthash_payment():
+    address = new_address()
+    scripthash = scripthash_from_scriptpubkey(get_scriptpubkey(address))
+
+    received: list = []
+    event = asyncio.Event()
+
+    def on_change(params: list) -> None:
+        received.append(params)
+        event.set()
+
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        initial_status = await client.subscribe_scripthash(
+            scripthash, callback=on_change
+        )
+        assert initial_status is None  # fresh address has no history
+
+        send_to_address(address, 777_000)
+        target = mine_blocks(1)
+        await wait_for_electrs(target)
+
+        await asyncio.wait_for(event.wait(), timeout=10)
+
+        assert len(received) == 1
+        assert received[0][0] == scripthash  # first param is the scripthash
+        assert received[0][1] is not None  # second param is the new status hash
+
+        balance = await client.get_balance(scripthash)
+        assert balance.confirmed == 777_000
+
+
+@pytest.mark.anyio
+async def test_subscribe_headers():
+    async with ElectrumClient(f"tcp://{ELECTRS_HOST}:{ELECTRS_PORT}") as client:
+        notifications: list = []
+        tip = await client.subscribe_headers(callback=lambda p: notifications.append(p))
+        height_before = tip.height
+
+        target = mine_blocks(1)
+        await wait_for_electrs(target)
+
+        assert await client.get_height() == height_before + 1

tests/regtest/test_real_invoice.py

@@ -13,10 +13,13 @@ from lnbits.core.services import (
     fee_reserve_total,
     get_balance_delta,
 )
-from lnbits.core.services.payments import pay_invoice, update_wallet_balance
+from lnbits.core.services.payments import (
+    pay_invoice,
+    update_wallet_balance,
+)
 from lnbits.core.services.users import create_user_account
 from lnbits.exceptions import PaymentError
-from lnbits.tasks import create_task, wait_for_paid_invoices
+from lnbits.task_manager import task_manager
 from lnbits.wallets import get_funding_source
 
 from ..helpers import is_fake, is_regtest
@@ -160,12 +163,11 @@ async def test_create_real_invoice(
     assert not payment_status["paid"]
 
     on_paid_mock = mocker.AsyncMock()
-    create_task(wait_for_paid_invoices("test_create_invoice", on_paid_mock)())
+    task_manager.register_invoice_listener(on_paid_mock, "test_create_invoice")
 
     pay_real_invoice(invoice["bolt11"])
 
     await asyncio.sleep(1)
-
     assert on_paid_mock.call_count == 1
     payment = on_paid_mock.call_args_list[0][0][0]
 
@@ -393,12 +395,11 @@ async def test_receive_real_invoice_set_pending_and_check_state(
     assert not payment_status["paid"]
 
     on_paid_mock = mocker.AsyncMock()
-    create_task(wait_for_paid_invoices("test_create_invoice", on_paid_mock)())
+    task_manager.register_invoice_listener(on_paid_mock, "test_create_invoice")
 
     pay_real_invoice(invoice["bolt11"])
 
     await asyncio.sleep(1)
-
     assert on_paid_mock.call_count == 1
     payment = on_paid_mock.call_args_list[0][0][0]
 
@@ -412,6 +413,8 @@ async def test_receive_real_invoice_set_pending_and_check_state(
     payment_status = response.json()
     assert payment_status["paid"]
 
+    assert payment
+
     # set the incoming invoice to pending
     payment.status = PaymentState.PENDING
     await update_payment(payment)

tests/unit/test_cache.py

@@ -5,6 +5,7 @@ import pytest
 from pytest_mock.plugin import MockerFixture
 
 from lnbits.settings import Settings
+from lnbits.task_manager import task_manager
 from lnbits.utils.cache import Cache, Cached
 
 key = "foo"
@@ -13,11 +14,10 @@ value = "bar"
 
 @pytest.fixture
 async def cache():
-    cache = Cache(interval=0.1)
-
-    task = asyncio.create_task(cache.invalidate_forever())
+    cache = Cache()
+    task = task_manager.create_permanent_task(cache.invalidate_cache, interval=1)
     yield cache
-    task.cancel()
+    task_manager.cancel_task(task)
 
 
 @pytest.mark.anyio
@@ -31,13 +31,13 @@ async def test_cache_get_set(cache):
 @pytest.mark.anyio
 async def test_cache_expiry(cache):
     # gets expired by `get` call
-    cache.set(key, value, expiry=0.01)
-    await asyncio.sleep(0.02)
+    cache.set(key, value, expiry=1)
+    await asyncio.sleep(2)
     assert not cache.get(key)
 
     # gets expired by invalidation task
-    cache.set(key, value, expiry=0.1)
-    await asyncio.sleep(0.2)
+    cache.set(key, value, expiry=1)
+    await asyncio.sleep(2)
     assert key not in cache._values
     assert not cache.get(key)
 
@@ -94,23 +94,33 @@ async def test_cache_pop_expired_returns_default(cache):
 async def test_invalidate_forever_logs_and_recovers_from_errors(
     settings: Settings, mocker: MockerFixture
 ):
-    test_cache = Cache(interval=0)
-    logger_error = mocker.patch("lnbits.utils.cache.logger.error")
+    test_cache = Cache()
     original_running = settings.lnbits_running
     calls = 0
 
-    async def fake_sleep(_interval):
+    original_invalidate = test_cache.invalidate_cache
+
+    async def fake_invalidate():
         nonlocal calls
         calls += 1
         if calls == 1:
             raise RuntimeError("boom")
         settings.lnbits_running = False
+        await original_invalidate()
 
+    mocker.patch.object(test_cache, "invalidate_cache", side_effect=fake_invalidate)
+    mocker.patch("lnbits.task_manager.asyncio.sleep")
+    logger_error = mocker.patch("lnbits.task_manager.logger.error")
+
+    bg_task = None
     try:
         settings.lnbits_running = True
-        mocker.patch("lnbits.utils.cache.asyncio.sleep", side_effect=fake_sleep)
-        await test_cache.invalidate_forever()
+        bg_task = task_manager.create_permanent_task(test_cache.invalidate_cache)
+        await bg_task.task
     finally:
         settings.lnbits_running = original_running
+        if bg_task:
+            task_manager.cancel_task(bg_task)
 
-    logger_error.assert_called_once_with("Error invalidating cache")
+    assert logger_error.called
+    assert calls == 2

tests/unit/test_exchange_rates.py

@@ -275,6 +275,10 @@ async def test_btc_rates_skips_unsupported_and_failing_providers(
 
 @pytest.mark.anyio
 async def test_btc_price_handles_empty_single_and_multiple_rates(mocker: MockerFixture):
+    mocker.patch(
+        "lnbits.utils.exchange_rates.btc_price_from_aggregator",
+        AsyncMock(return_value=None),
+    )
     mocker.patch("lnbits.utils.exchange_rates.btc_rates", AsyncMock(return_value=[]))
     assert await btc_price("usd") == 0.0
 

tests/unit/test_fiat_providers.py

@@ -8,7 +8,7 @@ from unittest.mock import AsyncMock
 import pytest
 from pytest_mock.plugin import MockerFixture
 
-from lnbits.core.crud.payments import get_payments
+from lnbits.core.crud.payments import get_payment, get_payments
 from lnbits.core.crud.users import get_user
 from lnbits.core.crud.wallets import create_wallet
 from lnbits.core.models.payments import CreateInvoice, Payment, PaymentState
@@ -919,8 +919,10 @@ async def test_revolut_wallet_create_subscription(settings: Settings):
         "PLAN_VARIATION_123", 1, payment_options
     )
 
+    subscription_request_id = payment_options.subscription_request_id
     assert response.ok is True
-    assert response.subscription_request_id is not None
+    assert response.subscription_request_id == "SUBSCRIPTION123"
+    assert subscription_request_id is not None
     assert (
         response.checkout_session_url
         == "https://checkout.revolut.com/payment-link/sub_123"
@@ -933,16 +935,14 @@ async def test_revolut_wallet_create_subscription(settings: Settings):
     assert payload["plan_variation_id"] == "PLAN_VARIATION_123"
     assert payload["customer_id"] == "CUSTOMER123"
     assert client.calls[1][1]["timeout"] == 30
-    assert client.calls[1][1]["headers"]["Idempotency-Key"] == (
-        response.subscription_request_id
-    )
+    assert client.calls[1][1]["headers"]["Idempotency-Key"] == (subscription_request_id)
     assert payload["setup_order_redirect_url"] == (
         "https://lnbits.example/subscription-success"
     )
     reference = json.loads(payload["external_reference"])
     assert reference["wallet_id"] == "wallet_1"
     assert reference["tag"] == "gold"
-    assert reference["subscription_request_id"] == response.subscription_request_id
+    assert reference["subscription_request_id"] == subscription_request_id
     assert reference["memo"] == "Monthly Gold"
     assert reference["extra"]["link"] == "link-1"
     assert client.calls[2][0] == "/api/orders/ORDER123"
@@ -1235,13 +1235,55 @@ async def test_revolut_wallet_cancel_subscription(settings: Settings):
     settings.revolut_api_version = "2026-04-20"
 
     wallet = RevolutWallet()
-    client = MockHTTPClient([MockHTTPResponse(json_data={})])
+    client = MockHTTPClient(
+        [
+            MockHTTPResponse(
+                json_data={
+                    "external_reference": json.dumps({"wallet_id": "wallet_1"}),
+                }
+            ),
+            MockHTTPResponse(json_data={}),
+        ]
+    )
     wallet.client = client  # type: ignore[assignment]
 
     response = await wallet.cancel_subscription("SUBSCRIPTION123", "wallet_1")
 
     assert response.ok is True
-    assert client.calls[0][0] == "/api/subscriptions/SUBSCRIPTION123/cancel"
+    assert client.calls[0][0] == "/api/subscriptions/SUBSCRIPTION123"
+    assert client.calls[1][0] == "/api/subscriptions/SUBSCRIPTION123/cancel"
+
+
+@pytest.mark.anyio
+async def test_revolut_wallet_cancel_subscription_checks_wallet_id(
+    settings: Settings,
+):
+    settings.revolut_api_endpoint = "https://sandbox-merchant.revolut.com"
+    settings.revolut_api_secret_key = "revolut-secret"
+    settings.revolut_api_version = "2026-04-20"
+
+    wallet = RevolutWallet()
+    client = MockHTTPClient(
+        [
+            MockHTTPResponse(
+                json_data={
+                    "external_reference": json.dumps({"wallet_id": "wallet_2"}),
+                }
+            ),
+        ]
+    )
+    wallet.client = client  # type: ignore[assignment]
+
+    response = await wallet.cancel_subscription("SUBSCRIPTION123", "wallet_1")
+
+    assert response.ok is False
+    assert response.error_message == "Subscription not found."
+    assert client.calls == [
+        (
+            "/api/subscriptions/SUBSCRIPTION123",
+            {"timeout": 30},
+        )
+    ]
 
 
 @pytest.mark.anyio
@@ -1675,7 +1717,9 @@ async def test_check_fiat_status_handles_internal_states(mocker: MockerFixture):
         "lnbits.core.services.fiat_providers.get_fiat_provider",
         AsyncMock(return_value=provider),
     )
-    queue_put = mocker.patch("lnbits.tasks.internal_invoice_queue.put", AsyncMock())
+    queue_put = mocker.patch(
+        "lnbits.task_manager.task_manager.internal_invoice_queue.put_nowait"
+    )
 
     success_status = await check_fiat_status(
         Payment(
@@ -1692,7 +1736,8 @@ async def test_check_fiat_status_handles_internal_states(mocker: MockerFixture):
     )
 
     assert success_status.success is True
-    queue_put.assert_awaited_once_with("fiat_pending")
+    queue_put.assert_called_once()
+    assert queue_put.call_args[0][0].checking_id == "fiat_pending"
 
     await check_fiat_status(
         Payment(
@@ -1702,13 +1747,59 @@ async def test_check_fiat_status_handles_internal_states(mocker: MockerFixture):
             amount=1000,
             fee=0,
             bolt11="bolt11",
-            status=PaymentState.PENDING,
+            status=PaymentState.SUCCESS,
             fiat_provider="stripe",
             extra={"fiat_checking_id": "stripe_checking_id"},
-        ),
-        skip_internal_payment_notifications=True,
+        )
     )
-    assert queue_put.await_count == 1
+    assert queue_put.call_count == 1
+
+
+@pytest.mark.anyio
+async def test_check_fiat_status_persists_successful_payment(
+    to_wallet: Wallet, settings: Settings, mocker: MockerFixture
+):
+    settings.stripe_enabled = True
+    settings.stripe_api_secret_key = "mock_sk_test_4eC39HqLyjWDarjtT1zdp7dc"
+    settings.stripe_limits.service_min_amount_sats = 0
+    settings.stripe_limits.service_max_amount_sats = 0
+    settings.stripe_limits.service_fee_wallet_id = None
+    settings.stripe_limits.service_faucet_wallet_id = None
+
+    invoice_data = CreateInvoice(
+        unit="USD", amount=1.0, memo="Test", fiat_provider="stripe"
+    )
+    fiat_mock_response = FiatInvoiceResponse(
+        ok=True,
+        checking_id=f"session_paid_{get_random_string(10)}",
+        payment_request="https://stripe.com/pay/session_paid",
+    )
+    mocker.patch(
+        "lnbits.fiat.StripeWallet.create_invoice",
+        AsyncMock(return_value=fiat_mock_response),
+    )
+    mocker.patch(
+        "lnbits.utils.exchange_rates.get_fiat_rate_satoshis",
+        AsyncMock(return_value=1000),
+    )
+    payment = await payments.create_fiat_invoice(to_wallet.id, invoice_data)
+    assert payment.status == PaymentState.PENDING
+
+    mocker.patch(
+        "lnbits.fiat.StripeWallet.get_invoice_status",
+        AsyncMock(return_value=FiatPaymentStatus(paid=True)),
+    )
+    queue_put = mocker.patch(
+        "lnbits.task_manager.task_manager.internal_invoice_queue.put_nowait"
+    )
+
+    status = await check_fiat_status(payment)
+
+    assert status.success is True
+    assert payment.status == PaymentState.SUCCESS
+    updated_payment = await get_payment(payment.checking_id)
+    assert updated_payment.status == PaymentState.SUCCESS
+    queue_put.assert_called_once_with(payment)
 
 
 @pytest.mark.anyio

tests/unit/test_helpers.py

@@ -259,9 +259,7 @@ def test_get_api_routes_extracts_v1_paths():
 
 def test_path_and_case_helpers():
     assert path_segments("/wallet/path") == ["wallet", "path"]
-    assert path_segments("/upgrades/ext/assets/app.js") == ["assets", "app.js"]
     assert normalize_path(None) == "/"
-    assert normalize_path("/upgrades/ext/assets/app.js") == "/assets/app.js"
     assert normalize_endpoint("example.com/") == "https://example.com"
     assert normalize_endpoint("ws://socket.example.com") == "ws://socket.example.com"
     assert (

tests/unit/test_pay_invoice.py

@@ -12,10 +12,12 @@ from lnbits.core.crud import create_wallet, get_standalone_payment, get_wallet
 from lnbits.core.crud.payments import get_payment, get_payments_paginated
 from lnbits.core.models import PaymentState, Wallet
 from lnbits.core.services import create_invoice, create_user_account, pay_invoice
-from lnbits.core.services.payments import update_wallet_balance
+from lnbits.core.services.payments import (
+    update_wallet_balance,
+)
 from lnbits.exceptions import InvoiceError, PaymentError
 from lnbits.settings import Settings
-from lnbits.tasks import create_task, wait_for_paid_invoices
+from lnbits.task_manager import task_manager
 from lnbits.wallets.base import PaymentResponse
 from lnbits.wallets.fake import FakeWallet
 
@@ -231,17 +233,31 @@ async def test_notification_for_internal_payment(
 ):
     test_name = "test_notification_for_internal_payment"
 
+    # Drain stale items left by session-scoped fixtures (e.g. update_wallet_balance)
+    while not task_manager.internal_invoice_queue.empty():
+        try:
+            task_manager.internal_invoice_queue.get_nowait()
+        except asyncio.QueueEmpty:
+            break
+
     on_paid_mock = mocker.AsyncMock()
-    create_task(wait_for_paid_invoices(test_name, on_paid_mock)())
+    # create_task(internal_invoice_listener())
+
+    task_manager.register_invoice_listener(on_paid_mock, test_name)
+
     payment = await create_invoice(
         wallet_id=to_wallet.id,
         amount=123,
         memo=test_name,
         webhook="http://test.404.lnbits.com",
     )
-    await pay_invoice(
+    paid_payment = await pay_invoice(
         wallet_id=to_wallet.id, payment_request=payment.bolt11, extra={"tag": "lnurlp"}
     )
+    assert paid_payment.status == PaymentState.SUCCESS.value
+    assert paid_payment.bolt11 == payment.bolt11
+    assert paid_payment.amount == -123_000
+
     await asyncio.sleep(1)
 
     assert on_paid_mock.call_count == 1
@@ -251,6 +267,8 @@ async def test_notification_for_internal_payment(
     assert _payment.status == PaymentState.SUCCESS.value
     assert _payment.bolt11 == payment.bolt11
     assert _payment.amount == 123_000
+    assert _payment.checking_id == payment.checking_id
+
     updated_payment = await get_payment(_payment.checking_id)
     assert (
         updated_payment.webhook_status is not None

tests/unit/test_services_extensions.py

@@ -62,6 +62,9 @@ async def test_install_extension_creates_new_extension_and_starts_background_wor
         "lnbits.core.services.extensions.start_extension_background_work",
         mocker.AsyncMock(return_value=True),
     )
+    mocker.patch(
+        "lnbits.core.services.extensions.core_app_extra.register_new_ext_routes"
+    )
     mocker.patch(
         "lnbits.core.services.extensions.get_db_version",
         mocker.AsyncMock(return_value=0),
@@ -76,6 +79,7 @@ async def test_install_extension_creates_new_extension_and_starts_background_wor
         settings.lnbits_extensions_path = str(tmp_path / "code")
 
         extension = await install_extension(ext_info)
+        await activate_extension(extension)  # starts background task
         stored = await get_installed_extension(ext_id)
     finally:
         await delete_installed_extension(ext_id=ext_id)
@@ -111,6 +115,9 @@ async def test_install_extension_updates_existing_upgrade_and_preserves_payments
         "lnbits.core.services.extensions.stop_extension_background_work",
         mocker.AsyncMock(return_value=True),
     )
+    mocker.patch(
+        "lnbits.core.services.extensions.core_app_extra.register_new_ext_routes"
+    )
     mocker.patch(
         "lnbits.core.services.extensions.get_db_version",
         mocker.AsyncMock(return_value=1),
@@ -124,9 +131,8 @@ async def test_install_extension_updates_existing_upgrade_and_preserves_payments
         settings.lnbits_data_folder = str(tmp_path / "data")
         settings.lnbits_extensions_path = str(tmp_path / "code")
         await create_installed_extension(existing_ext)
-        updated_ext.ext_upgrade_dir.mkdir(parents=True, exist_ok=True)
-
         extension = await install_extension(updated_ext, skip_download=True)
+        await activate_extension(extension)  # starts background task
         stored = await get_installed_extension(ext_id)
     finally:
         await delete_installed_extension(ext_id=ext_id)
@@ -134,7 +140,6 @@ async def test_install_extension_updates_existing_upgrade_and_preserves_payments
         settings.lnbits_extensions_path = original_extensions_path
 
     assert extension.code == ext_id
-    assert extension.is_upgrade_extension is True
     assert stored is not None
     assert stored.meta is not None
     assert stored.meta.payments == [existing_payment]

tests/unit/test_services_lnurl.py

@@ -1,3 +1,4 @@
+from typing import cast
 from uuid import uuid4
 
 import pytest
@@ -86,7 +87,9 @@ async def test_get_pr_from_lnurl_success_and_error(mocker: MockerFixture):
     mocker.patch(
         "lnbits.core.services.lnurl.execute_pay_request",
         mocker.AsyncMock(
-            return_value=LnurlPayActionResponse(pr=LightningInvoice(TEST_BOLT11))
+            return_value=LnurlPayActionResponse(
+                pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11))
+            )
         ),
     )
 
@@ -106,7 +109,7 @@ async def test_fetch_lnurl_pay_request_converts_currency_and_stores_paylink(
 ):
     pay_response = make_lnurl_pay_response(min_sendable_msat=1, text="Test")
     action_response = LnurlPayActionResponse(
-        pr=LightningInvoice(TEST_BOLT11), disposable=False
+        pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11)), disposable=False
     )
     mocker.patch(
         "lnbits.core.services.lnurl.fiat_amount_as_satoshis",
@@ -143,7 +146,7 @@ async def test_store_paylink_appends_and_updates_existing():
     wallet = await _create_wallet()
     pay_response = make_lnurl_pay_response(min_sendable_msat=1, text="Test")
     action_response = LnurlPayActionResponse(
-        pr=LightningInvoice(TEST_BOLT11), disposable=False
+        pr=cast(LightningInvoice, LightningInvoice(TEST_BOLT11)), disposable=False
     )
 
     await store_paylink(

tests/unit/test_services_notifications.py

@@ -39,6 +39,7 @@ from lnbits.core.services.notifications import (
     send_nostr_notification,
     send_nostr_notifications,
     send_notification,
+    send_notification_in_background,
     send_payment_notification,
     send_payment_push_notification,
     send_push_notification,
@@ -117,7 +118,7 @@ async def test_send_admin_and_user_notification_use_expected_targets(
     settings: Settings, mocker: MockerFixture
 ):
     send_mock = mocker.patch(
-        "lnbits.core.services.notifications.send_notification",
+        "lnbits.core.services.notifications.send_notification_in_background",
         mocker.AsyncMock(),
     )
     original_chat_id = settings.lnbits_telegram_notifications_chat_id
@@ -159,6 +160,45 @@ async def test_send_admin_and_user_notification_use_expected_targets(
     )
 
 
+@pytest.mark.anyio
+async def test_send_notification_in_background_schedules_notification(
+    mocker: MockerFixture,
+):
+    scheduled = []
+
+    def create_task(coro):
+        scheduled.append(coro)
+        coro.close()
+        return mocker.Mock()
+
+    create_task_mock = mocker.patch(
+        "lnbits.core.services.notifications.create_task",
+        side_effect=create_task,
+    )
+    send_mock = mocker.patch(
+        "lnbits.core.services.notifications.send_notification",
+        mocker.AsyncMock(),
+    )
+
+    await send_notification_in_background(
+        "chat-id",
+        ["alice@example.com"],
+        ["admin@example.com"],
+        "hello",
+        "settings_update",
+    )
+
+    create_task_mock.assert_called_once()
+    send_mock.assert_called_once_with(
+        "chat-id",
+        ["alice@example.com"],
+        ["admin@example.com"],
+        "hello",
+        "settings_update",
+    )
+    assert len(scheduled) == 1
+
+
 @pytest.mark.anyio
 async def test_send_notification_uses_available_channels_and_swallows_exceptions(
     settings: Settings, mocker: MockerFixture

tests/unit/test_services_payments.py

@@ -197,8 +197,7 @@ async def test_update_wallet_balance_validates_credit_and_debit(
 
         settings.lnbits_wallet_limit_max_balance = 0
         queue_mock = mocker.patch(
-            "lnbits.tasks.internal_invoice_queue_put",
-            mocker.AsyncMock(),
+            "lnbits.task_manager.task_manager.internal_invoice_queue.put_nowait",
         )
 
         await update_wallet_balance(wallet, 5)
@@ -212,7 +211,8 @@ async def test_update_wallet_balance_validates_credit_and_debit(
     ]
     assert credit_payments
     assert credit_payments[0].status == PaymentState.SUCCESS
-    queue_mock.assert_awaited_once_with(credit_payments[0].checking_id)
+    queue_mock.assert_called_once()
+    assert queue_mock.call_args[0][0].checking_id == credit_payments[0].checking_id
 
 
 @pytest.mark.anyio

tests/unit/test_services_users.py

@@ -1,3 +1,4 @@
+from typing import Any
 from uuid import uuid4
 
 import pytest
@@ -66,7 +67,7 @@ async def test_create_user_account_no_check_rejects_duplicate_identity_fields(
     existing = _account(**existing_data)
     await create_account(existing)
 
-    resolved = {
+    resolved: dict[str, Any] = {
         key: (value(existing) if callable(value) else value)
         for key, value in new_data.items()
     }

tests/unit/test_settings.py

@@ -1,3 +1,5 @@
+from typing import Any
+
 import pytest
 from pytest_mock.plugin import MockerFixture
 
@@ -14,22 +16,22 @@ from lnbits.settings import (
     set_cli_settings,
 )
 
-lnurlp_redirect_path = {
+lnurlp_redirect_path: dict[str, Any] = {
     "from_path": "/.well-known/lnurlp",
     "redirect_to_path": "/api/v1/well-known",
 }
-lnurlp_redirect_path_with_headers = {
+lnurlp_redirect_path_with_headers: dict[str, Any] = {
     "from_path": "/.well-known/lnurlp",
     "redirect_to_path": "/api/v1/well-known",
     "header_filters": {"accept": "application/nostr+json"},
 }
 
-lnaddress_redirect_path = {
+lnaddress_redirect_path: dict[str, Any] = {
     "from_path": "/.well-known/lnurlp",
     "redirect_to_path": "/api/v1/well-known",
 }
 
-nostrrelay_redirect_path = {
+nostrrelay_redirect_path: dict[str, Any] = {
     "from_path": "/",
     "redirect_to_path": "/api/v1/relay-info",
     "header_filters": {"accept": "application/nostr+json"},
@@ -214,16 +216,11 @@ def test_installed_extensions_settings_activate_and_deactivate_paths():
         }
     ]
 
-    installed.activate_extension_paths(
-        "lnurlp",
-        upgrade_hash="hash123",
-        ext_redirects=redirects,
-    )
+    installed.activate_extension_paths("lnurlp", ext_redirects=redirects)
 
     redirect = installed.find_extension_redirect("/.well-known/lnurlp", [])
     assert redirect is not None
     assert redirect.ext_id == "lnurlp"
-    assert installed.lnbits_upgraded_extensions["lnurlp"] == "hash123"
     assert "lnurlp" in installed.lnbits_installed_extensions_ids
 
     installed.deactivate_extension_paths("lnurlp")

tests/wallets/fixtures/json/fixtures_rest.json

@@ -2073,7 +2073,7 @@
                 {
                   "response_type": "json",
                   "response": {
-                    "settled": true
+                    "state": "SETTLED"
                   }
                 }
               ]
@@ -2155,8 +2155,15 @@
               ]
             },
             "lndrest": {
-              "description": "lndrest.py doesn't handle the 'failed' status for `get_invoice_status`",
-              "get_invoice_status_endpoint": []
+              "get_invoice_status_endpoint": [
+                {
+                  "description": "error status",
+                  "response_type": "json",
+                  "response": {
+                    "state": "CANCELED"
+                  }
+                }
+              ]
             },
             "alby": {
               "description": "alby.py doesn't handle the 'failed' status for `get_invoice_status`",
@@ -2243,13 +2250,6 @@
                   "response_type": "json",
                   "response": {}
                 },
-                {
-                  "description": "error status",
-                  "response_type": "json",
-                  "response": {
-                    "seetled": false
-                  }
-                },
                 {
                   "description": "bad json",
                   "response_type": "data",

tests/wallets/test_blink.py

@@ -1,4 +1,5 @@
 import os
+from typing import cast
 
 import pytest
 from loguru import logger
@@ -29,7 +30,7 @@ logger.info(f"settings.blink_api_endpoint: {settings.blink_api_endpoint}")
 logger.info(f"settings.blink_token: {settings.blink_token}")
 
 set_funding_source()
-funding_source = get_funding_source()
+funding_source = cast(BlinkWallet, get_funding_source())
 assert isinstance(funding_source, BlinkWallet)
 
 

tests/wallets/test_nwc_wallets.py

@@ -1,3 +1,4 @@
+import asyncio
 import base64
 import hashlib
 import json
@@ -12,7 +13,7 @@ from Cryptodome.Util.Padding import pad, unpad
 from websockets import ServerConnection
 from websockets import serve as ws_serve
 
-from lnbits.wallets.nwc import NWCWallet
+from lnbits.wallets.nwc import NWCConnection, NWCWallet
 from tests.wallets.helpers import (
     WalletTest,
     build_test_id,
@@ -99,6 +100,8 @@ async def handle(  # noqa: C901
                     event,
                 )
                 await websocket.send(json.dumps(["EVENT", sub_id, event]))
+            elif 23195 in kinds:
+                assert sub_filter["authors"] == [mock_settings["service_public_key"]]
         elif msg[0] == "EVENT":
             event = msg[1]
             decrypted_content = decrypt_content(
@@ -177,6 +180,129 @@ async def run(data: WalletTest):
             await nwcwallet.cleanup()
 
 
+@pytest.mark.anyio
+async def test_nwc_rejects_event_from_unexpected_pubkey(mocker):
+    async def _noop(*args, **kwargs):
+        return None
+
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._connect_to_relay", new=_noop)
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._handle_timeouts", new=_noop)
+
+    service_private_key = PrivateKey()
+    service_public_key = service_private_key.public_key.format().hex()[2:]
+    attacker_private_key = PrivateKey()
+    attacker_public_key = attacker_private_key.public_key.format().hex()[2:]
+    account_private_key = PrivateKey()
+
+    conn = NWCConnection(
+        service_public_key,
+        account_private_key.secret.hex(),
+        "ws://127.0.0.1:8555",
+    )
+    try:
+        event = {
+            "kind": 23195,
+            "content": "{}",
+            "created_at": int(time.time()),
+            "tags": [["e", "request-event-id"]],
+        }
+        sign_event(attacker_public_key, attacker_private_key.secret.hex(), event)
+
+        with pytest.raises(Exception, match="Invalid event signature"):
+            await conn._on_event_message(["EVENT", "subid", event])
+    finally:
+        await conn.close()
+
+
+@pytest.mark.anyio
+async def test_nwc_marks_pending_invoice_settled_only_once():
+    wallet = NWCWallet.__new__(NWCWallet)
+    wallet.pending_invoice_details = {"checking-id": {"checking_id": "checking-id"}}
+    wallet.pending_invoices = ["checking-id"]
+    wallet.paid_invoices_queue = asyncio.Queue(0)
+
+    wallet._mark_invoice_settled("checking-id", source="notification")
+    wallet._mark_invoice_settled("checking-id", source="notification")
+
+    assert wallet.paid_invoices_queue.qsize() == 1
+    assert await wallet.paid_invoices_queue.get() == "checking-id"
+
+
+@pytest.mark.anyio
+async def test_nwc_registers_notification_subscriptions(mocker):
+    async def _noop(*args, **kwargs):
+        return None
+
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._connect_to_relay", new=_noop)
+    mocker.patch("lnbits.wallets.nwc.NWCConnection._handle_timeouts", new=_noop)
+
+    service_private_key = PrivateKey()
+    service_public_key = service_private_key.public_key.format().hex()[2:]
+    account_private_key = PrivateKey()
+
+    conn = NWCConnection(
+        service_public_key,
+        account_private_key.secret.hex(),
+        "ws://127.0.0.1:8555",
+    )
+    send_mock = mocker.patch.object(conn, "_send", mocker.AsyncMock())
+
+    try:
+        await conn._subscribe_to_notifications()
+
+        assert len(conn.notification_subscription_ids) == 2
+        assert len(conn.subscriptions) == 2
+        assert set(conn.subscriptions.keys()) == conn.notification_subscription_ids
+        assert all(
+            subscription["method"] == "notification_sub"
+            and subscription["event_id"] == subscription["sub_id"]
+            for subscription in conn.subscriptions.values()
+        )
+        assert send_mock.await_count == 2
+    finally:
+        await conn.close()
+
+
+@pytest.mark.anyio
+async def test_nwc_spreads_fallback_lookups_with_cooldown(mocker):
+    def _schedule_next_lookup(
+        invoice: dict[str, object], now: float | None = None
+    ) -> None:
+        assert now is not None
+        invoice["next_lookup_at"] = now + 1
+
+    wallet = NWCWallet.__new__(NWCWallet)
+    wallet.shutdown = False
+    wallet.pending_invoices = ["checking-1", "checking-2"]
+    wallet.pending_invoice_details = {
+        "checking-1": {
+            "checking_id": "checking-1",
+            "next_lookup_at": 0.0,
+            "lookup_attempts": 0,
+        },
+        "checking-2": {
+            "checking_id": "checking-2",
+            "next_lookup_at": 0.0,
+            "lookup_attempts": 0,
+        },
+    }
+    wallet.pending_invoices_lookup_cooldown = 1.0
+    wallet._is_shutting_down = lambda: False
+    wallet._payment_data_is_settled = lambda payment_data: False
+    wallet._cache_payment_data = lambda *args, **kwargs: None
+    wallet._schedule_next_lookup = _schedule_next_lookup
+    wallet.conn = mocker.Mock()
+    wallet.conn.get_info = mocker.AsyncMock()
+    wallet.conn.supports_method = mocker.Mock(return_value=True)
+    wallet.conn.call = mocker.AsyncMock(return_value={"settled_at": None})
+    sleep_mock = mocker.patch("lnbits.wallets.nwc.asyncio.sleep", mocker.AsyncMock())
+
+    await wallet._run_fallback_lookups(100.0)
+
+    assert wallet.conn.call.await_count == 2
+    sleep_mock.assert_awaited_once_with(1.0)
+
+
 @pytest.mark.anyio
 @pytest.mark.parametrize(
     "test_data",

tests/wallets/test_rpc_wallets.py

@@ -1,4 +1,5 @@
 import importlib
+from typing import Any
 from unittest.mock import AsyncMock, Mock
 
 import pytest
@@ -80,7 +81,9 @@ def _check_calls(expected_calls):
         for func_call in func_calls:
             req = func_call["request_data"]
             args = req["args"] if "args" in req else {}
-            kwargs = _eval_dict(req["kwargs"]) if "kwargs" in req else {}
+            kwargs: dict[str, Any] = (
+                _eval_dict(req["kwargs"]) or {} if "kwargs" in req else {}
+            )
 
             if "klass" in req:
                 *rest, cls = req["klass"].split(".")
@@ -166,7 +169,7 @@ def _mock_field(field):
     return response
 
 
-def _eval_dict(data: dict | None) -> dict | None:
+def _eval_dict(data: dict | None) -> dict[str, Any] | None:
     fn_prefix = "__eval__:"
     if not data:
         return data
@@ -215,9 +218,9 @@ def _data_mock(data: dict) -> Mock:
 def _raise(error: dict | None):
     if not error:
         return Exception()
-    data = error["data"] if "data" in error else None
+    data: dict[str, Any] = error["data"] if "data" in error else {}
     if "module" not in error or "class" not in error:
-        return Exception(data)
+        return Exception(data or None)
 
     error_module = importlib.import_module(error["module"])
     error_class = getattr(error_module, error["class"])