fundle

security feature middleware to block/allow routes

.env.example

@@ -18,7 +18,6 @@ ENABLE_LOG_TO_FILE=true
 # https://loguru.readthedocs.io/en/stable/api/logger.html#file
 LOG_ROTATION="100 MB"
 LOG_RETENTION="3 months"
-    
 # for database cleanup commands
 # CLEANUP_WALLETS_DAYS=90
 
@@ -187,7 +186,6 @@ BOLTZ_CLIENT_ENDPOINT=127.0.0.1:9002
 BOLTZ_CLIENT_MACAROON="/home/bob/.boltz/macaroons/admin.macaroon"
 # HEXSTRING instead of path also possible
 BOLTZ_CLIENT_CERT="/home/bob/.boltz/tls.cert"
-BOLTZ_CLIENT_WALLET="lnbits"
 
 # StrikeWallet
 STRIKE_API_ENDPOINT=https://api.strike.me/v1
@@ -333,4 +331,3 @@ LNBITS_RESERVE_FEE_PERCENT=1.0
 ######################################
 ###### Logging and Development #######
 ######################################
-

.github/workflows/ci.yml

@@ -75,7 +75,14 @@ jobs:
     strategy:
       matrix:
         python-version: ["3.10"]
-        backend-wallet-class: ["LndRestWallet", "LndWallet", "CoreLightningWallet", "CoreLightningRestWallet", "LNbitsWallet", "EclairWallet"]
+        backend-wallet-class:
+          - BoltzWallet
+          - LndRestWallet
+          - LndWallet
+          - CoreLightningWallet
+          - CoreLightningRestWallet
+          - LNbitsWallet
+          - EclairWallet
     with:
       custom-pytest: "uv run pytest tests/regtest"
       python-version: ${{ matrix.python-version }}

.github/workflows/docker.yml

@@ -62,3 +62,4 @@ jobs:
             platforms: linux/amd64,linux/arm64
             cache-from: type=local,src=/tmp/.buildx-cache
             cache-to: type=local,dest=/tmp/.buildx-cache
+            build-args: LNBITS_TAG=${{ inputs.tag }}

.github/workflows/regtest.yml

@@ -40,8 +40,8 @@ jobs:
         run: |
           git clone https://github.com/lnbits/legend-regtest-enviroment.git docker
           cd docker
-          chmod +x ./tests
-          ./tests
+          chmod +x ./start-regtest
+          ./start-regtest
           sudo chmod -R a+rwx .
 
       - name: Run pytest
@@ -63,6 +63,8 @@ jobs:
           LNBITS_ENDPOINT: http://localhost:5001
           LNBITS_KEY: "d08a3313322a4514af75d488bcc27eee"
           ECLAIR_URL: http://127.0.0.1:8082
+          BOLTZ_CLIENT_ENDPOINT: 127.0.0.1:9002
+          BOLTZ_MNEMONIC: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
           LNBITS_MAX_OUTGOING_PAYMENT_AMOUNT_SATS: 1000000000
           LNBITS_MAX_INCOMING_PAYMENT_AMOUNT_SATS: 1000000000
           ECLAIR_PASS: lnbits

.github/workflows/release-rc.yml

@@ -44,15 +44,19 @@ jobs:
     if: github.repository == 'lnbits/lnbits'
     runs-on: ubuntu-24.04
     steps:
-      - name: Install dependencies for building secp256k1
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential automake libtool libffi-dev libgmp-dev
       - uses: actions/checkout@v4
-      - name: Build and publish to pypi
-        uses: JRubics/poetry-publish@v1.15
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
         with:
-          pypi_token: ${{ secrets.PYPI_API_KEY }}
+          python-version: "3.10"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+      - name: Build the project
+        run: uv build
+      - name: Publish to pypi
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_KEY }}
+        run: uv publish
 
   appimage:
     needs: [ release ]

.github/workflows/release.yml

@@ -56,15 +56,19 @@ jobs:
     if: github.repository == 'lnbits/lnbits'
     runs-on: ubuntu-24.04
     steps:
-      - name: Install dependencies for building secp256k1
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential automake libtool libffi-dev libgmp-dev
       - uses: actions/checkout@v4
-      - name: Build and publish to pypi
-        uses: JRubics/poetry-publish@v1.15
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
         with:
-          pypi_token: ${{ secrets.PYPI_API_KEY }}
+          python-version: "3.10"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+      - name: Build the project
+        run: uv build
+      - name: Publish to pypi
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_KEY }}
+        run: uv publish
 
   appimage:
     needs: [ release ]

Dockerfile.boltz

@@ -1,6 +1,7 @@
-FROM boltz/boltz-client:latest AS boltz
+ARG LNBITS_TAG=latest
 
-FROM lnbits/lnbits:latest
+FROM boltz/boltz-client:latest AS boltz
+FROM lnbits/lnbits:${LNBITS_TAG}
 
 COPY --from=boltz /bin/boltzd /bin/boltzcli /usr/local/bin/
 RUN ls -l /usr/local/bin/boltzd

lnbits/app.py

@@ -66,6 +66,7 @@ from .middleware import (
     add_first_install_middleware,
     add_ip_block_middleware,
     add_ratelimit_middleware,
+    add_route_access_middleware,
 )
 from .tasks import internal_invoice_listener, invoice_listener, run_interval
 
@@ -192,6 +193,7 @@ def create_app() -> FastAPI:
 
     # adds security middleware
     add_ip_block_middleware(app)
+    add_route_access_middleware(app)
     add_ratelimit_middleware(app)
 
     register_exception_handlers(app)

lnbits/core/crud/payments.py

@@ -1,3 +1,4 @@
+from datetime import datetime, timezone
 from time import time
 from typing import Any
 
@@ -304,8 +305,16 @@ async def update_payment_checking_id(
     checking_id: str, new_checking_id: str, conn: Connection | None = None
 ) -> None:
     await (conn or db).execute(
-        "UPDATE apipayments SET checking_id = :new_id WHERE checking_id = :old_id",
-        {"new_id": new_checking_id, "old_id": checking_id},
+        f"""
+            UPDATE apipayments
+            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder('now')}
+            WHERE checking_id = :old_id
+        """,  # noqa: S608
+        {
+            "new_id": new_checking_id,
+            "old_id": checking_id,
+            "now": int(time()),
+        },
     )
 
 
@@ -314,6 +323,7 @@ async def update_payment(
     new_checking_id: str | None = None,
     conn: Connection | None = None,
 ) -> None:
+    payment.updated_at = datetime.now(timezone.utc)
     await (conn or db).update(
         "apipayments", payment, "WHERE checking_id = :checking_id"
     )

lnbits/core/crud/users.py

@@ -204,6 +204,7 @@ async def get_user_from_account(
         super_user=account.is_super_user,
         fiat_providers=account.fiat_providers,
         has_password=account.password_hash is not None,
+        ui_customization=account.ui_customization or {},
     )
 
 

lnbits/core/crud/wallets.py

@@ -45,17 +45,13 @@ async def update_wallet(
 
 
 async def delete_wallet(
-    *,
     user_id: str,
     wallet_id: str,
     deleted: bool = True,
     conn: Connection | None = None,
 ) -> None:
+    _clear_wallet_cache(wallet_id)
     now = int(time())
-    cached_wallet: BaseWallet | None = cache.pop(f"auth:wallet:{wallet_id}")
-    if cached_wallet:
-        cache.pop(f"auth:x-api-key:{cached_wallet.adminkey}")
-        cache.pop(f"auth:x-api-key:{cached_wallet.inkey}")
 
     await (conn or db).execute(
         # Timestamp placeholder is safe from SQL injection (not user input)
@@ -69,6 +65,7 @@ async def delete_wallet(
 
 
 async def force_delete_wallet(wallet_id: str, conn: Connection | None = None) -> None:
+    _clear_wallet_cache(wallet_id)
     await (conn or db).execute(
         "DELETE FROM wallets WHERE id = :wallet",
         {"wallet": wallet_id},
@@ -78,6 +75,7 @@ async def force_delete_wallet(wallet_id: str, conn: Connection | None = None) ->
 async def delete_wallet_by_id(
     wallet_id: str, conn: Connection | None = None
 ) -> int | None:
+    _clear_wallet_cache(wallet_id)
     now = int(time())
     result = await (conn or db).execute(
         # Timestamp placeholder is safe from SQL injection (not user input)
@@ -294,3 +292,10 @@ async def get_total_balance(conn: Connection | None = None):
     result = await (conn or db).execute("SELECT SUM(balance) as balance FROM balances")
     row = result.mappings().first()
     return row.get("balance", 0) or 0
+
+
+def _clear_wallet_cache(wallet_id):
+    cached_wallet: BaseWallet | None = cache.pop(f"auth:wallet:{wallet_id}")
+    if cached_wallet:
+        cache.pop(f"auth:x-api-key:{cached_wallet.adminkey}")
+        cache.pop(f"auth:x-api-key:{cached_wallet.inkey}")

lnbits/core/migrations.py

@@ -848,3 +848,11 @@ async def m042_index_accounts(db: Connection):
             CREATE INDEX IF NOT EXISTS idx_accounts_{index} ON accounts ("{index}");
             """
         )
+
+
+async def m043_add_ui_customization_to_accounts(db: Connection):
+    """
+    Adds ui_customization column to accounts.
+    Used for server side persistence of UI customization settings.
+    """
+    await db.execute("ALTER TABLE accounts ADD COLUMN ui_customization TEXT")

lnbits/core/models/extensions.py

@@ -12,7 +12,7 @@ from typing import Any
 
 import httpx
 from loguru import logger
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 from lnbits.helpers import (
     download_url,
@@ -269,10 +269,30 @@ class ExtensionRelease(BaseModel):
     async def get_github_releases(cls, org: str, repo: str) -> list[ExtensionRelease]:
         try:
             github_releases = await cls.fetch_github_releases(org, repo)
-            return [
+            extension_releases = [
                 ExtensionRelease.from_github_release(f"{org}/{repo}", r)
                 for r in github_releases
             ]
+            for release in extension_releases:
+                if not release.details_link:
+                    continue
+                try:
+                    config = await ExtensionConfig.fetch_github_release_config(
+                        org, repo, release.version
+                    )
+                except Exception as e:
+                    logger.warning(e)
+                    config = None
+                if not config:
+                    continue
+
+                release.min_lnbits_version = config.min_lnbits_version
+                release.max_lnbits_version = config.max_lnbits_version
+                release.is_version_compatible = config.is_version_compatible()
+
+                release.icon = icon_to_github_url(f"{org}/{repo}", config.tile)
+
+            return extension_releases
         except Exception as e:
             logger.warning(e)
             return []
@@ -777,6 +797,32 @@ class ExtensionDetailsRequest(BaseModel):
     version: str
 
 
+class ExtensionReviewsStatus(BaseModel):
+    tag: str
+    avg_rating: float
+    review_count: int
+
+
+class CreateExtensionReview(BaseModel):
+    tag: str
+    name: str | None = Field(None)
+    rating: int = Field(..., ge=0, le=1000)
+    comment: str | None = Field(None)
+
+
+class ExtensionReviewPaymentRequest(BaseModel):
+    payment_hash: str
+    payment_request: str
+
+
+class ExtensionReview(BaseModel):
+    id: str
+    name: str | None = Field(default=None)
+    tag: str | None = Field(default=None)
+    rating: int = Field(default=0, ge=0, le=1000)
+    comment: str | None = Field(default=None)
+
+
 async def github_api_get(url: str, error_msg: str | None) -> Any:
     headers = {"User-Agent": settings.user_agent}
     if settings.lnbits_ext_github_token:

lnbits/core/models/extensions_builder.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import json
+import random
+import uuid
 from datetime import datetime, timedelta, timezone
 from typing import Any, Literal
 
@@ -55,6 +57,29 @@ class DataField(BaseModel):
             field_type += ' = "sat"'
         return f"{field_name}: {field_type}"
 
+    def field_to_random_value(self) -> str:
+        field_name = camel_to_snake(self.name)
+        field_value: Any = f'"{self.type}"'
+        if self.type == "json":
+            field_value = '"{}"'
+        elif self.type == "wallet":
+            field_value = f'"{uuid.uuid4()}"'
+        elif self.type == "currency":
+            field_value = '"sat"'
+        elif self.type in ["str", "text"]:
+            field_value = f'"{field_name}_{urlsafe_short_hash()}"'
+        elif self.type == "int":
+            field_value = random.randint(1, 100)  # noqa: S311
+        elif self.type == "float":
+            field_value = random.uniform(1.0, 100.0)  # noqa: S311
+        elif self.type == "bool":
+            field_value = random.choice([True, False])  # noqa: S311
+        elif self.type == "datetime":
+            random_days = random.randint(-30, 30)  # noqa: S311
+            random_date = datetime.now(timezone.utc) - timedelta(days=random_days)
+            field_value = f"""datetime.fromisoformat("{random_date.isoformat()}")"""
+        return f"{field_name} = {field_value},"
+
     def field_to_js(self) -> str:
         field_name = camel_to_snake(self.name)
         default_value = "null"

lnbits/core/models/users.py

@@ -187,6 +187,7 @@ class Account(AccountId):
     pubkey: str | None = None
     email: str | None = None
     extra: UserExtra = UserExtra()
+    ui_customization: dict = Field(default_factory=dict)
 
     created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
     updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
@@ -288,6 +289,7 @@ class User(BaseModel):
     fiat_providers: list[str] = []
     has_password: bool = False
     extra: UserExtra = UserExtra()
+    ui_customization: dict = Field(default_factory=dict)
 
     @property
     def wallet_ids(self) -> list[str]:

lnbits/core/services/assets.py

@@ -3,6 +3,7 @@ import io
 from uuid import uuid4
 
 from fastapi import UploadFile
+from loguru import logger
 from PIL import Image
 
 from lnbits.core.crud.assets import create_asset, get_user_assets_count
@@ -16,7 +17,7 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
     if file.content_type.lower() not in settings.lnbits_assets_allowed_mime_types:
         raise ValueError(f"File type '{file.content_type}' not allowed.")
 
-    if user_id not in settings.lnbits_assets_no_limit_users:
+    if not settings.is_unlimited_assets_user(user_id):
         user_assets_count = await get_user_assets_count(user_id)
         if user_assets_count >= settings.lnbits_max_assets_per_user:
             raise ValueError(
@@ -29,17 +30,7 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
             f"File limit of {settings.lnbits_max_asset_size_mb}MB exceeded."
         )
 
-    image = Image.open(io.BytesIO(contents))
-
-    thumbnail_width = min(256, settings.lnbits_asset_thumbnail_width)
-    thumbnail_height = min(256, settings.lnbits_asset_thumbnail_height)
-    image.thumbnail((thumbnail_width, thumbnail_height))
-
-    # Save thumbnail to an in-memory buffer
-    thumb_buffer = io.BytesIO()
-    thumbnail_format = settings.lnbits_asset_thumbnail_format or "PNG"
-    image.save(thumb_buffer, format=thumbnail_format)
-    thumb_buffer.seek(0)
+    thumb_buffer = thumbnail_from_bytes(contents)
 
     asset = Asset(
         id=uuid4().hex,
@@ -48,9 +39,32 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
         is_public=is_public,
         name=file.filename or "unnamed",
         size_bytes=len(contents),
-        thumbnail_base64=base64.b64encode(thumb_buffer.getvalue()).decode("utf-8"),
+        thumbnail_base64=(
+            base64.b64encode(thumb_buffer.getvalue()).decode("utf-8")
+            if thumb_buffer
+            else None
+        ),
         data=contents,
     )
 
     await create_asset(asset)
     return asset
+
+
+def thumbnail_from_bytes(contents: bytes) -> io.BytesIO | None:
+    try:
+        image = Image.open(io.BytesIO(contents))
+
+        thumbnail_width = min(256, settings.lnbits_asset_thumbnail_width)
+        thumbnail_height = min(256, settings.lnbits_asset_thumbnail_height)
+        image.thumbnail((thumbnail_width, thumbnail_height))
+
+        # Save thumbnail to an in-memory buffer
+        thumb_buffer = io.BytesIO()
+        thumbnail_format = settings.lnbits_asset_thumbnail_format or "PNG"
+        image.save(thumb_buffer, format=thumbnail_format)
+        thumb_buffer.seek(0)
+        return thumb_buffer
+    except Exception as exc:
+        logger.warning(f"Failed to create thumbnail: {exc}")
+        return None

lnbits/core/services/extensions_builder.py

@@ -20,6 +20,7 @@ from lnbits.helpers import (
     camel_to_words,
     download_url,
     lowercase_first_letter,
+    snake_to_camel,
 )
 from lnbits.settings import settings
 
@@ -195,13 +196,29 @@ def _copy_ext_stub_to_build_dir(
     ext_build_dir = Path(working_dir, new_ext_id, working_dir_name, new_ext_id)
     shutil.rmtree(ext_build_dir, True)
 
-    shutil.copytree(ext_stub_cache_dir, ext_build_dir)
+    shutil.copytree(
+        ext_stub_cache_dir,
+        ext_build_dir,
+        ignore=shutil.ignore_patterns(
+            "__pycache__",
+            ".git",
+            ".env",
+            ".venv",
+            "*.env",
+            "*.log",
+            "node_modules",
+            ".mypy_cache",
+            ".pytest_cache",
+            ".ruff_cache",
+        ),
+    )
     return ext_build_dir
 
 
 def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None:
     parsed_data = _parse_extension_data(data)
-    for py_file in py_files:
+    test_files = [f"tests/{p.name}" for p in Path(ext_stub_dir, "tests").glob("*.py")]
+    for py_file in py_files + test_files:
         template_path = Path(ext_stub_dir, py_file).as_posix()
         rederer = _render_file(template_path, parsed_data)
         with open(template_path, "w", encoding="utf-8") as f:
@@ -209,7 +226,7 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
 
         _remove_lines_with_string(template_path, remove_line_marker)
 
-    template_path = Path(ext_stub_dir, "static", "js", "index.js").as_posix()
+    template_path = Path(ext_stub_dir, "static", "index.js").as_posix()
     rederer = _render_file(
         template_path, {"preview": data.preview_action, **parsed_data}
     )
@@ -234,9 +251,7 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
         "settingsFormDialog.data",
         ext_stub_dir,
     )
-    template_path = Path(
-        ext_stub_dir, "templates", "extension_builder_stub", "index.html"
-    ).as_posix()
+    template_path = Path(ext_stub_dir, "static", "index.vue").as_posix()
     rederer = _render_file(
         template_path,
         {
@@ -263,12 +278,12 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
         "publicClientData",
         ext_stub_dir,
     )
-    public_template_path = Path(
-        ext_stub_dir, "templates", "extension_builder_stub", "public_page.html"
-    )
+    public_template_path = Path(ext_stub_dir, "static", "public_page.vue")
+    public_component_path = Path(ext_stub_dir, "static", "public_page.js")
     template_path = public_template_path.as_posix()
     if not data.public_page.has_public_page:
         public_template_path.unlink(missing_ok=True)
+        public_component_path.unlink(missing_ok=True)
     else:
         rederer = _render_file(
             template_path,
@@ -308,8 +323,10 @@ def zip_directory(source_dir, zip_path):
 
 def _rename_extension_builder_stub(data: ExtensionData, extension_dir: Path) -> None:
     extension_dir_path = extension_dir.as_posix()
+    # the order of fields is important, do not chage
     rename_values = {
         "extension_builder_stub_name": data.name,
+        "extension_builder_stub_camel_name": snake_to_camel(data.id, True),
         "extension_builder_stub_short_description": data.short_description or "",
         "extension_builder_stub": data.id,
         "OwnerData": data.owner_data.name,
@@ -328,7 +345,7 @@ def _rename_extension_builder_stub(data: ExtensionData, extension_dir: Path) ->
             directory=extension_dir_path,
             old_text=old_text,
             new_text=new_text,
-            file_extensions=[".py", ".js", ".html", ".md", ".json", ".toml"],
+            file_extensions=[".py", ".js", ".vue", ".html", ".md", ".json", ".toml"],
         )
 
     _rename_files_and_dirs_in_directory(
@@ -406,6 +423,7 @@ def _parse_extension_data(data: ExtensionData) -> dict:
         "owner_data": {
             "name": data.owner_data.name,
             "editable": data.owner_data.editable,
+            "fields": [field.name for field in data.owner_data.fields],
             "js_fields": [
                 field.field_to_js()
                 for field in data.owner_data.fields
@@ -432,6 +450,18 @@ def _parse_extension_data(data: ExtensionData) -> dict:
             ],
             "db_fields": [field.field_to_db() for field in data.owner_data.fields],
             "all_fields": [field.field_to_py() for field in data.owner_data.fields],
+            "random_fields_values": [
+                field.field_to_random_value() for field in data.owner_data.fields
+            ],
+            "public_fields": [
+                field.field_to_py()
+                for field in data.owner_data.fields
+                if field.name
+                in [
+                    data.public_page.owner_data_fields.name,
+                    data.public_page.owner_data_fields.description,
+                ]
+            ],
         },
         "client_data": {
             "name": data.client_data.name,
@@ -457,6 +487,9 @@ def _parse_extension_data(data: ExtensionData) -> dict:
             ],
             "db_fields": [field.field_to_db() for field in data.client_data.fields],
             "all_fields": [field.field_to_py() for field in data.client_data.fields],
+            "random_fields_values": [
+                field.field_to_random_value() for field in data.client_data.fields
+            ],
         },
         "settings_data": {
             "enabled": data.settings_data.enabled,
@@ -536,7 +569,7 @@ def _rename_files_and_dirs_in_directory(directory, old_text, new_text):
                     logger.warning(f"Failed to rename directory {old_dir_path}: {e}")
 
 
-def _is_excluded_dir(path):
+def _is_excluded_dir(path: str) -> bool:
     for excluded_dir in excluded_dirs:
         if path.startswith(excluded_dir):
             return True

lnbits/core/views/asset_api.py

@@ -57,11 +57,11 @@ async def api_get_asset(
 
 
 @asset_router.get(
-    "/{asset_id}/binary",
-    name="Get user asset binary",
-    summary="Get user asset binary data by ID",
+    "/{asset_id}/data",
+    name="Get user asset data",
+    summary="Get user asset data data by ID",
 )
-async def api_get_asset_binary(
+async def api_get_asset_data(
     asset_id: str,
     user_id: str | None = Depends(optional_user_id),
 ) -> Response:

lnbits/core/views/auth_api.py

@@ -4,9 +4,10 @@ import json
 from collections.abc import Callable
 from http import HTTPStatus
 from time import time
+from typing import Annotated
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi import APIRouter, Cookie, Depends, HTTPException, Request
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi_sso.sso.base import OpenID, SSOBase
 from loguru import logger
@@ -29,6 +30,7 @@ from lnbits.core.services.users import update_user_account
 from lnbits.decorators import (
     access_token_payload,
     check_account_exists,
+    check_admin,
     check_user_exists,
 )
 from lnbits.helpers import (
@@ -120,6 +122,63 @@ async def login_usr(data: LoginUsr) -> JSONResponse:
     return _auth_success_response(account.username, account.id, account.email)
 
 
+@auth_router.post("/impersonate", description="Login via the User ID of another user")
+async def impersonate_user(
+    data: LoginUsr,
+    user: User = Depends(check_admin),
+    cookie_access_token: Annotated[str | None, Cookie()] = None,
+) -> JSONResponse:
+    if not cookie_access_token:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED, "Only cookie based impersonation is allowed."
+        )
+    if data.usr == user.id:
+        raise HTTPException(HTTPStatus.FORBIDDEN, "You cannot impersonate yourself.")
+    if settings.is_admin_user(data.usr):
+        # this check includes the superuser
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN, "You cannot impersonate another admin user."
+        )
+
+    account = await get_account(data.usr)
+    if not account:
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User ID does not exist.")
+
+    response = _auth_success_response(account.username, account.id, account.email)
+
+    max_age = settings.auth_token_expire_minutes * 60
+    response.set_cookie(
+        "admin_access_token", cookie_access_token, httponly=True, max_age=max_age
+    )
+    response.set_cookie("is_lnbits_user_impersonated", "true", max_age=max_age)
+    return response
+
+
+@auth_router.delete(
+    "/impersonate", description="Stop impersonation and go back to admin"
+)
+async def stop_impersonate_user(
+    user: User = Depends(check_user_exists),
+    admin_access_token: Annotated[str | None, Cookie()] = None,
+) -> JSONResponse:
+    if not admin_access_token:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED,
+            "No admin access token found to stop impersonation.",
+        )
+    response = JSONResponse(
+        {"access_token": admin_access_token, "token_type": "bearer"}
+    )
+    max_age = settings.auth_token_expire_minutes * 60
+    response.set_cookie(
+        "cookie_access_token", admin_access_token, httponly=True, max_age=max_age
+    )
+    response.delete_cookie("admin_access_token")
+    response.delete_cookie("is_access_token_expired")
+    response.delete_cookie("is_lnbits_user_impersonated")
+    return response
+
+
 @auth_router.get("/acl")
 async def api_get_user_acls(
     request: Request,
@@ -408,7 +467,7 @@ async def reset_password(data: ResetUserPassword) -> JSONResponse:
     return _auth_success_response(account.username, user_id, account.email)
 
 
-@auth_router.put("/update")
+@auth_router.patch("")
 async def update(
     data: UpdateUser, account: Account = Depends(check_account_exists)
 ) -> User | None:
@@ -424,6 +483,22 @@ async def update(
     return await get_user_from_account(account)
 
 
+@auth_router.patch("/ui")
+async def update_ui_customization(
+    req: Request, account: Account = Depends(check_account_exists)
+) -> Account:
+    ui_customization = await req.json()
+    account.ui_customization = {**(account.ui_customization or {}), **ui_customization}
+
+    if len(account.ui_customization or {}) > 1000 * 1024:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST, "UI customization too large. Drop some fields."
+        )
+
+    await update_user_account(account)
+    return account
+
+
 @auth_router.put("/first_install")
 async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
     if not settings.first_install:

lnbits/core/views/extension_api.py

@@ -2,8 +2,10 @@ import sys
 import traceback
 from http import HTTPStatus
 
+import httpx
 from bolt11 import decode as bolt11_decode
 from fastapi import APIRouter, Depends, HTTPException
+from fastapi.requests import Request
 from loguru import logger
 
 from lnbits.core.crud.extensions import get_user_extensions
@@ -14,10 +16,14 @@ from lnbits.core.models import (
 )
 from lnbits.core.models.extensions import (
     CreateExtension,
+    CreateExtensionReview,
     Extension,
     ExtensionConfig,
     ExtensionMeta,
     ExtensionRelease,
+    ExtensionReview,
+    ExtensionReviewPaymentRequest,
+    ExtensionReviewsStatus,
     InstallableExtension,
     PayToEnableInfo,
     ReleasePaymentInfo,
@@ -34,6 +40,7 @@ from lnbits.core.services.extensions import (
     install_extension,
     uninstall_extension,
 )
+from lnbits.db import Page
 from lnbits.decorators import (
     check_account_exists,
     check_account_id_exists,
@@ -589,3 +596,49 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
         for ext in installable_exts
     ]
     return extension_data
+
+
+@extension_router.get(
+    "/reviews/tags",
+    dependencies=[Depends(check_account_exists)],
+)
+async def get_extension_reviews_tags() -> list[ExtensionReviewsStatus]:
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(settings.lnbits_extensions_reviews_url + "/tags")
+        resp.raise_for_status()
+        data = resp.json()
+        return [ExtensionReviewsStatus(**item) for item in data]
+
+
+@extension_router.get(
+    "/reviews/{ext_id}",
+    dependencies=[Depends(check_account_exists)],
+)
+async def get_extension_reviews(ext_id: str, request: Request) -> Page[ExtensionReview]:
+    async with httpx.AsyncClient() as client:
+        query_string = str(request.query_params)
+        resp = await client.get(
+            settings.lnbits_extensions_reviews_url + f"/reviews/{ext_id}?{query_string}"
+        )
+        resp.raise_for_status()
+        reviews = resp.json()
+        return Page(
+            data=[ExtensionReview(**item) for item in reviews["data"]],
+            total=reviews["total"],
+        )
+
+
+@extension_router.put(
+    "/reviews",
+    dependencies=[Depends(check_account_exists)],
+)
+async def create_extension_review(
+    data: CreateExtensionReview,
+) -> ExtensionReviewPaymentRequest:
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            settings.lnbits_extensions_reviews_url + "/reviews", json=data.dict()
+        )
+        resp.raise_for_status()
+        payment_request = resp.json()
+        return ExtensionReviewPaymentRequest(**payment_request)

lnbits/core/views/generic.py

@@ -42,54 +42,38 @@ async def robots():
 
 
 @generic_router.get(
-    "/extensions/builder/preview/{ext_id}",
+    "/extensions/builder/preview/{ext_id}/{resource}",
     name="extensions builder",
     dependencies=[Depends(check_extension_builder)],
 )
 async def extensions_builder_preview(
-    request: Request,
     ext_id: str,
+    resource: str | None = None,
     page_name: str | None = None,
     user: User = Depends(check_user_exists),
-) -> HTMLResponse:
+) -> FileResponse:
     working_dir_name = "preview_" + sha256(user.id.encode("utf-8")).hexdigest()
-    html_file_name = "index.html"
-    if page_name == "public_page":
-        html_file_name = "public_page.html"
 
-    html_file_path = Path(
+    file_name = "index"
+    if page_name == "public_page":
+        file_name = "public_page"
+
+    resource_path = Path(
+        settings.extension_builder_working_dir_path,
         "extension_builder_stub",
         ext_id,
         working_dir_name,
         ext_id,
-        "templates",
-        ext_id,
-        html_file_name,
+        "static",
     )
 
-    html_file_full_path = Path(
-        settings.extension_builder_working_dir_path, html_file_path
-    )
+    file_ext = ".vue" if resource == "template" else ".js"
+    file_full_path = Path(resource_path, file_name + file_ext)
 
-    if not html_file_full_path.is_file():
-        return template_renderer().TemplateResponse(
-            request,
-            "error.html",
-            {
-                "status_code": 404,
-                "message": f"Extension {ext_id} not found, refresh Preview.",
-            },
-            status_code=HTTPStatus.NOT_FOUND,
-        )
-
-    response = template_renderer().TemplateResponse(
-        request,
-        html_file_path.as_posix(),
-        {
-            "user": user.json(),
-        },
-    )
+    if not file_full_path.is_file():
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND)
 
+    response = FileResponse(file_full_path.absolute().as_posix())
     response.headers["Content-Security-Policy"] = (
         "default-src 'self'; "
         "style-src 'self' 'unsafe-inline'; "
@@ -208,6 +192,9 @@ admin_ui_checks = [Depends(check_admin), Depends(check_admin_ui)]
 @generic_router.get(
     "/extensions/builder", dependencies=[Depends(check_extension_builder)]
 )
+@generic_router.get(
+    "/extensions/builder/preview", dependencies=[Depends(check_extension_builder)]
+)
 async def index(
     request: Request, user: User = Depends(check_user_exists)
 ) -> HTMLResponse:

lnbits/core/views/payment_api.py

@@ -337,7 +337,7 @@ async def api_payment(payment_hash, x_api_key: str | None = Header(None)):
         return {"paid": False, "status": "failed"}
 
     try:
-        status = await payment.check_status()
+        payment = await update_pending_payment(payment)
     except Exception:
         if wallet and wallet.id == payment.wallet_id:
             return {"paid": False, "details": payment}
@@ -346,7 +346,7 @@ async def api_payment(payment_hash, x_api_key: str | None = Header(None)):
     if wallet and wallet.id == payment.wallet_id:
         return {
             "paid": payment.success,
-            "status": f"{status!s}",
+            "status": f"{payment.status!s}",
             "preimage": payment.preimage,
             "details": payment,
         }

lnbits/core/views/user_api.py

@@ -20,6 +20,7 @@ from lnbits.core.crud import (
     update_admin_settings,
     update_wallet,
 )
+from lnbits.core.crud.wallets import delete_wallet_by_id
 from lnbits.core.models import (
     AccountFilters,
     AccountOverview,
@@ -157,11 +158,8 @@ async def api_users_delete_user(
     user_id: str, account: Account = Depends(check_admin)
 ) -> SimpleStatus:
     wallets = await get_wallets(user_id, deleted=False)
-    if len(wallets) > 0:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="Cannot delete user with wallets.",
-        )
+    for wallet in wallets:
+        await delete_wallet_by_id(wallet.id)
 
     if user_id == settings.super_user:
         raise HTTPException(
@@ -224,7 +222,7 @@ async def api_users_toggle_admin(user_id: str) -> SimpleStatus:
 
 @users_router.get("/user/{user_id}/wallet", name="Get wallets for user")
 async def api_users_get_user_wallet(user_id: str) -> list[Wallet]:
-    return await get_wallets(user_id)
+    return await get_wallets(user_id, deleted=None)
 
 
 @users_router.post("/user/{user_id}/wallet", name="Create a new wallet for user")
@@ -247,7 +245,7 @@ async def api_users_create_user_wallet(
     "/user/{user_id}/wallet/{wallet}/undelete", name="Reactivate deleted wallet"
 )
 async def api_users_undelete_user_wallet(user_id: str, wallet: str) -> SimpleStatus:
-    wal = await get_wallet(wallet)
+    wal = await get_wallet(wallet, deleted=True)
     if not wal:
         raise HTTPException(
             status_code=HTTPStatus.NOT_FOUND,

lnbits/db.py

@@ -337,7 +337,8 @@ class Database(Compat):
                     f = "%Y-%m-%d %H:%M:%S.%f"
                     if "." not in value:
                         f = "%Y-%m-%d %H:%M:%S"
-                    return datetime.strptime(value, f)
+                    # Parse and add UTC timezone info
+                    return datetime.strptime(value, f).replace(tzinfo=timezone.utc)
 
                 dbapi_connection.run_async(
                     lambda connection: connection.set_type_codec(
@@ -756,7 +757,11 @@ def dict_to_model(_row: dict, model: type[TModel]) -> TModel:  # noqa: C901
             if DB_TYPE == SQLITE:
                 _dict[key] = datetime.fromtimestamp(value, timezone.utc)
             else:
-                _dict[key] = value
+                # Ensure PostgreSQL datetime values have timezone info
+                if isinstance(value, datetime) and value.tzinfo is None:
+                    _dict[key] = value.replace(tzinfo=timezone.utc)
+                else:
+                    _dict[key] = value
             continue
         if issubclass(type_, BaseModel):
             _dict[key] = dict_to_submodel(type_, value)

lnbits/decorators.py

@@ -249,7 +249,7 @@ async def check_account_id_exists(
             account_id = cache.get(cache_key)
             if account_id:
                 r.scope["user_id"] = account_id.id
-                await _check_user_access(r, account_id, conn=conn)
+                await _check_user_access(r, account_id.id, conn=conn)
                 return account_id
 
         account = await _check_account_exists(r, access_token, usr, conn=conn)

lnbits/exceptions.py

@@ -109,7 +109,7 @@ def register_exception_handlers(app: FastAPI):  # noqa: C901
         logger.error(f"RequestValidationError: {exc!s}")
         return render_html_error(request, exc) or JSONResponse(
             status_code=HTTPStatus.BAD_REQUEST,
-            content={"detail": str(exc)},
+            content={"detail": [dict(e) for e in exc.errors()]},
         )
 
     @app.exception_handler(HTTPException)

lnbits/fiat/stripe.py

@@ -35,6 +35,7 @@ class StripeTerminalOptions(BaseModel):
 
     capture_method: Literal["automatic", "manual"] = "automatic"
     metadata: dict[str, str] = Field(default_factory=dict)
+    reader_id: str | None = None
 
 
 class StripeCheckoutOptions(BaseModel):
@@ -295,6 +296,15 @@ class StripeWallet(FiatProvider):
         r.raise_for_status()
         return r.json()
 
+    async def _process_terminal_payment_intent(
+        self, reader_id: str, payment_intent_id: str
+    ) -> None:
+        data = {"payment_intent": payment_intent_id}
+        r = await self.client.post(
+            f"/v1/terminal/readers/{reader_id}/process_payment_intent", data=data
+        )
+        r.raise_for_status()
+
     async def _create_checkout_invoice(
         self,
         amount_cents: int,
@@ -378,6 +388,17 @@ class StripeWallet(FiatProvider):
                     ok=False,
                     error_message="Error: missing PaymentIntent or client_secret",
                 )
+            if term.reader_id:
+                try:
+                    await self._process_terminal_payment_intent(term.reader_id, pi_id)
+                except Exception as exc:
+                    logger.warning(exc)
+                    return FiatInvoiceResponse(
+                        ok=False,
+                        error_message=(
+                            "Error: unable to process PaymentIntent on reader"
+                        ),
+                    )
             return FiatInvoiceResponse(
                 ok=True, checking_id=pi_id, payment_request=client_secret
             )

lnbits/helpers.py

@@ -98,6 +98,9 @@ def template_renderer(additional_folders: list | None = None) -> Jinja2Templates
         "LNBITS_SERVICE_FEE_WALLET": settings.lnbits_service_fee_wallet,
         "LNBITS_SHOW_HOME_PAGE_ELEMENTS": settings.lnbits_show_home_page_elements,
         "LNBITS_THEME_OPTIONS": settings.lnbits_theme_options,
+        "WALLET_FEATURED_BUTTON_LABEL": settings.lnbits_wallet_featured_button_label,
+        "WALLET_FEATURED_BUTTON_URL": settings.lnbits_wallet_featured_button_url,
+        "WALLET_FEATURED_BUTTON_ICON": settings.lnbits_wallet_featured_button_icon,
         "LNBITS_VERSION": settings.version,
         "USE_CUSTOM_LOGO": settings.lnbits_custom_logo,
         "LNBITS_DEFAULT_REACTION": settings.lnbits_default_reaction,
@@ -107,6 +110,7 @@ def template_renderer(additional_folders: list | None = None) -> Jinja2Templates
         "LNBITS_DEFAULT_BGIMAGE": settings.lnbits_default_bgimage,
         "VOIDWALLET": settings.lnbits_backend_wallet_class == "VoidWallet",
         "WEBPUSH_PUBKEY": settings.lnbits_webpush_pubkey,
+        "LNBITS_EXTENSIONS_REVIEWS_URL": settings.lnbits_extensions_reviews_url,
         "LNBITS_DENOMINATION": settings.lnbits_denomination,
         "has_holdinvoice": settings.has_holdinvoice,
         "LNBITS_NOSTR_CONFIGURED": settings.is_nostr_notifications_configured(),
@@ -390,6 +394,14 @@ def camel_to_snake(name: str) -> str:
     return name.lower()
 
 
+def snake_to_camel(name: str, capitalize_first: bool | None = False) -> str:
+    components = name.split("_")
+    camel = components[0] + "".join(x.capitalize() for x in components[1:])
+    if capitalize_first:
+        camel = camel[0].upper() + camel[1:]
+    return camel
+
+
 def is_camel_case(v: str) -> bool:
     return re.match(r"^[A-Z][a-z0-9]+([A-Z][a-z0-9]+)*$", v) is not None
 

lnbits/middleware.py

@@ -1,5 +1,6 @@
 import asyncio
 import json
+import re
 from datetime import datetime, timezone
 from http import HTTPStatus
 from typing import Any
@@ -18,6 +19,53 @@ from lnbits.core.models import AuditEntry
 from lnbits.helpers import normalize_path, template_renderer
 from lnbits.settings import settings
 
+_LOCALHOST_IPS = {"127.0.0.1", "::1"}
+_PUBLIC_ASSET_PATHS = {
+    "/favicon.ico",
+    "/service-worker.js",
+}
+
+
+def _normalize_match_path(path: str) -> str:
+    if not path:
+        return "/"
+    if path != "/" and path.endswith("/"):
+        return path.rstrip("/")
+    return path
+
+
+def _route_pattern_matches(pattern: str, path: str) -> bool:
+    if not pattern:
+        return False
+    if not pattern.startswith("/"):
+        pattern = f"/{pattern}"
+    pattern = _normalize_match_path(pattern)
+    path = _normalize_match_path(path)
+    if pattern.endswith("*"):
+        prefix = pattern.rstrip("*")
+        return path.startswith(prefix)
+    if pattern == path:
+        return True
+    escaped = re.escape(pattern)
+    escaped = re.sub(r"\\\{[^/]+\\\}", r"[^/]+", escaped)
+    return re.fullmatch(escaped, path) is not None
+
+
+def _response_by_accepted_type(request: Request, msg: str, status_code: HTTPStatus):
+    accept_header = request.headers.get("accept", "")
+    if "text/html" in accept_header.split(","):
+        return HTMLResponse(
+            status_code=status_code,
+            content=template_renderer()
+            .TemplateResponse(
+                request,
+                "error.html",
+                {"err": msg, "status_code": status_code, "message": msg},
+            )
+            .body,
+        )
+    return JSONResponse(status_code=status_code, content={"detail": msg})
+
 
 class InstalledExtensionMiddleware:
     # This middleware class intercepts calls made to the extensions API and:
@@ -235,6 +283,42 @@ def add_ip_block_middleware(app: FastAPI):
         return await call_next(request)
 
 
+def add_route_access_middleware(app: FastAPI):
+    @app.middleware("http")
+    async def route_access_middleware(request: Request, call_next):
+        if not settings.lnbits_route_access_control_enabled:
+            return await call_next(request)
+        if not request.client:
+            return JSONResponse(
+                status_code=HTTPStatus.FORBIDDEN,
+                content={"detail": "No request client"},
+            )
+        if request.client.host in _LOCALHOST_IPS:
+            return await call_next(request)
+
+        path = request.url.path or "/"
+        if "/static/" in path or path in _PUBLIC_ASSET_PATHS:
+            return await call_next(request)
+        whitelist = settings.lnbits_route_access_whitelist
+        blacklist = settings.lnbits_route_access_blacklist
+
+        if whitelist:
+            if any(_route_pattern_matches(route, path) for route in whitelist):
+                return await call_next(request)
+            return _response_by_accepted_type(
+                request, f"Route not whitelisted: {path}", HTTPStatus.FORBIDDEN
+            )
+
+        if blacklist and any(
+            _route_pattern_matches(route, path) for route in blacklist
+        ):
+            return _response_by_accepted_type(
+                request, f"Route is blacklisted: {path}", HTTPStatus.FORBIDDEN
+            )
+
+        return await call_next(request)
+
+
 def add_first_install_middleware(app: FastAPI):
     @app.middleware("http")
     async def first_install_middleware(request: Request, call_next):

lnbits/settings.py

@@ -52,6 +52,13 @@ class ExtensionsSettings(LNbitsSettings):
     lnbits_user_default_extensions: list[str] = Field(default=[])
     lnbits_extensions_deactivate_all: bool = Field(default=False)
     lnbits_extensions_builder_activate_non_admins: bool = Field(default=False)
+    lnbits_extensions_reviews_url: str = Field(
+        default="https://demo.lnbits.com/paidreviews/api/v1/AdFzLjzuKFLsdk4Bcnff6r",
+        description="""
+            URL for the paid reviews.
+            Regular users can view this URL (not secret).
+            """,
+    )
     lnbits_extensions_manifests: list[str] = Field(
         default=[
             "https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json"
@@ -245,6 +252,11 @@ class ThemesSettings(LNbitsSettings):
     )
     lnbits_show_home_page_elements: bool = Field(default=True)
     lnbits_default_wallet_name: str = Field(default="LNbits wallet")
+
+    lnbits_wallet_featured_button_label: str | None = Field(default=None)
+    lnbits_wallet_featured_button_url: str | None = Field(default=None)
+    lnbits_wallet_featured_button_icon: str | None = Field(default=None)
+
     lnbits_custom_badge: str | None = Field(default=None)
     lnbits_custom_badge_color: str = Field(default="warning")
     lnbits_theme_options: list[str] = Field(
@@ -299,6 +311,10 @@ class AssetSettings(LNbitsSettings):
             "heic",
             "heif",
             "heics",
+            "text/plain",
+            "text/json" "text/xml",
+            "application/json",
+            "application/pdf",
         ]
     )
     lnbits_asset_thumbnail_width: int = Field(default=128, ge=0)
@@ -308,6 +324,12 @@ class AssetSettings(LNbitsSettings):
     lnbits_max_assets_per_user: int = Field(default=1, ge=0)
     lnbits_assets_no_limit_users: list[str] = Field(default=[])
 
+    def is_unlimited_assets_user(self, user_id: str) -> bool:
+        return (
+            settings.is_admin_user(user_id)
+            or user_id in self.lnbits_assets_no_limit_users
+        )
+
 
 class FeeSettings(LNbitsSettings):
     lnbits_reserve_fee_min: int = Field(default=2000, ge=0)
@@ -399,6 +421,9 @@ class SecuritySettings(LNbitsSettings):
     lnbits_rate_limit_unit: str = Field(default="minute")
     lnbits_allowed_ips: list[str] = Field(default=[])
     lnbits_blocked_ips: list[str] = Field(default=[])
+    lnbits_route_access_control_enabled: bool = Field(default=False)
+    lnbits_route_access_whitelist: list[str] = Field(default=[])
+    lnbits_route_access_blacklist: list[str] = Field(default=[])
     lnbits_callback_url_rules: list[str] = Field(
         default=["https?://([a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})(:\\d+)?"]
     )

lnbits/static/i18n/en.js

@@ -187,6 +187,25 @@ window.localisation.en = {
     'Only admin accounts can create extensions',
   admin_only: 'Admin Only',
   new_version: 'New Version',
+  reviews_url: 'Reviews URL',
+  reviews_url_label: 'Reviews server URL',
+  reviews_url_hint:
+    'Full PaidReviews URL including the settings id (e.g. https://example.com/paidreviews/SETTINGS_ID)',
+  reviews_open: 'View reviews',
+  reviews_leave: 'Leave a review',
+  reviews_name: 'Your name',
+  reviews_comment: 'Your review',
+  reviews_rating: 'Rating',
+  reviews_submit: 'Submit review',
+  reviews_loading: 'Loading reviews...',
+  reviews_refresh: 'Refresh reviews',
+  reviews_error_load: 'Could not load reviews',
+  reviews_url_not_configured: 'Reviews URL not configured',
+  reviews_pay_invoice: 'Pay invoice',
+  reviews_invoice_paid: 'Invoice paid',
+  reviews_invoice_title: 'Pay this invoice to submit your review',
+  reviews_count: 'Reviews',
+  no_reviews: 'No reviews yet',
   extension_has_free_release: 'Has free releases',
   extension_has_paid_release: 'Has paid releases',
   extension_depends_on: 'Depends on:',
@@ -344,6 +363,18 @@ window.localisation.en = {
   watchdog: 'Watchdog',
   server_logs: 'Server Logs',
   ip_blocker: 'IP Blocker',
+  route_access_control: 'Route Access Control',
+  route_access_control_enable: 'Enable route access control',
+  route_access_control_hint:
+    'When enabled, non-local requests are restricted. Requests from 127.0.0.1 (and ::1) are always allowed.',
+  route_access_whitelist_label: 'Route Whitelist',
+  route_access_whitelist_hint:
+    'Only allow non-local access to these routes (leave empty to disable whitelist mode).',
+  route_access_blacklist_label: 'Route Blacklist',
+  route_access_blacklist_hint:
+    'Block non-local access to these routes (ignored when a whitelist is set).',
+  route_access_save_confirm:
+    'Are you sure you want to save? This can impact access to LNbits if you are not accessing locally.',
   security: 'Security',
   security_tools: 'Security tools',
   block_access_hint: 'Block access by IP',
@@ -639,6 +670,15 @@ window.localisation.en = {
   ui_site_description_hint: 'Use plain text, Markdown, or raw HTML',
   ui_default_wallet_name: 'Default Wallet Name',
   ui_default_theme: 'Default Theme',
+  wallet_featured_button_label: 'Wallet Featured Button Label',
+  wallet_featured_button_label_hint:
+    'Show featured button on the wallet homepage',
+  wallet_featured_button_url: 'Featured Button URL',
+  wallet_featured_button_url_hint:
+    'On click the button will open this URL. Leave empty to hide the button.',
+  wallet_featured_button_icon: 'Featured Button Icon',
+  wallet_featured_button_icon_hint:
+    'Icon shown on the featured button (check quasar icons)',
   lnbits_wallet: 'LNbits wallet',
   denomination: 'Denomination',
   denomination_hint: 'The name for the FakeWallet token',
@@ -676,6 +716,8 @@ window.localisation.en = {
   allow_creation_user: 'Allow creation of new users',
   allow_creation_user_desc: 'Allow creation of new users on the index page',
   new_user_not_allowed: 'Registration is disabled.',
+  start_user_impersonation: 'Impersonate this user',
+  stop_user_impersonation: 'Stop User Impersonation',
   components: 'Components',
   long_running_endpoints: 'Top 5 Long Running Endpoints',
   http_request_methods: 'HTTP Request Methods',

lnbits/static/js/api.js

@@ -123,6 +123,19 @@ window._lnbitsApi = {
       url: '/api/v1/auth/logout'
     })
   },
+  impersonateUser(usr) {
+    return axios({
+      method: 'POST',
+      url: '/api/v1/auth/impersonate',
+      data: {usr}
+    })
+  },
+  stopImpersonation() {
+    return axios({
+      method: 'DELETE',
+      url: '/api/v1/auth/impersonate'
+    })
+  },
   getAuthenticatedUser() {
     return this.request('get', '/api/v1/auth')
   },
@@ -141,6 +154,9 @@ window._lnbitsApi = {
       name: name
     })
   },
+  updateUiCustomization(data = {}) {
+    return this.request('patch', '/api/v1/auth/ui', null, data)
+  },
   resetWalletKeys(wallet) {
     return this.request('put', `/api/v1/wallet/reset/${wallet.id}`).then(
       res => {

lnbits/static/js/base.js

@@ -13,7 +13,9 @@ window.LNbits = {
         wallets: data.wallets,
         fiat_providers: data.fiat_providers || [],
         super_user: data.super_user,
-        extra: data.extra ?? {}
+        extra: data.extra ?? {},
+        hasPassword: data.has_password ?? false,
+        uiCustomization: data.ui_customization || {}
       }
       const mapWallet = this.wallet
       obj.wallets = obj.wallets.map(mapWallet).sort((a, b) => {

lnbits/static/js/components.js

@@ -3,26 +3,37 @@ window.app.component(QrcodeVue)
 window.app.component('lnbits-extension-rating', {
   template: '#lnbits-extension-rating',
   name: 'lnbits-extension-rating',
-  props: ['rating']
-})
-
-window.app.component('lnbits-fsat', {
-  template: '<span>{{ fsat }}</span>',
   props: {
-    amount: {
+    rating: {
       type: Number,
       default: 0
+    },
+    count: {
+      type: Number,
+      default: null
+    },
+    clickable: {
+      type: Boolean,
+      default: false
     }
   },
   computed: {
-    fsat() {
-      return LNbits.utils.formatSat(this.amount)
+    displayRating() {
+      return Math.round((this.rating || 0) * 2) / 2
+    },
+    hasData() {
+      return this.count !== null && this.count !== undefined
+    }
+  },
+  methods: {
+    handleClick() {
+      if (!this.clickable) return
+      this.$emit('click')
     }
   }
 })
 
 window.app.component('lnbits-manage', {
-  mixins: [window.windowMixin],
   template: '#lnbits-manage',
   computed: {
     showAdmin() {
@@ -54,10 +65,8 @@ window.app.component('lnbits-manage', {
 })
 
 window.app.component('lnbits-payment-details', {
-  mixins: [window.windowMixin],
   template: '#lnbits-payment-details',
   props: ['payment'],
-  mixins: [window.windowMixin],
   computed: {
     hasPreimage() {
       return (
@@ -101,7 +110,6 @@ window.app.component('lnbits-payment-details', {
 })
 
 window.app.component('lnbits-lnurlpay-success-action', {
-  mixins: [window.windowMixin],
   template: '#lnbits-lnurlpay-success-action',
   props: ['payment', 'success_action'],
   data() {
@@ -121,7 +129,6 @@ window.app.component('lnbits-lnurlpay-success-action', {
 
 window.app.component('lnbits-notifications-btn', {
   template: '#lnbits-notifications-btn',
-  mixins: [window.windowMixin],
   props: ['pubkey'],
   data() {
     return {
@@ -292,7 +299,6 @@ window.app.component('lnbits-notifications-btn', {
 
 window.app.component('lnbits-dynamic-fields', {
   template: '#lnbits-dynamic-fields',
-  mixins: [window.windowMixin],
   props: ['options', 'modelValue'],
   data() {
     return {
@@ -325,7 +331,6 @@ window.app.component('lnbits-dynamic-fields', {
 
 window.app.component('lnbits-dynamic-chips', {
   template: '#lnbits-dynamic-chips',
-  mixins: [window.windowMixin],
   props: ['modelValue'],
   data() {
     return {
@@ -356,7 +361,6 @@ window.app.component('lnbits-dynamic-chips', {
 
 window.app.component('lnbits-update-balance', {
   template: '#lnbits-update-balance',
-  mixins: [window.windowMixin],
   props: ['wallet_id', 'small_btn'],
   computed: {
     admin() {
@@ -395,7 +399,6 @@ window.app.component('lnbits-update-balance', {
 
 window.app.component('user-id-only', {
   template: '#user-id-only',
-  mixins: [window.windowMixin],
   props: {
     allowed_new_users: Boolean,
     authAction: String,
@@ -439,7 +442,6 @@ window.app.component('user-id-only', {
 
 window.app.component('username-password', {
   template: '#username-password',
-  mixins: [window.windowMixin],
   props: {
     allowed_new_users: Boolean,
     authMethods: Array,
@@ -677,7 +679,6 @@ window.app.component('lnbits-stat', {
 
 window.app.component('lnbits-node-qrcode', {
   props: ['info'],
-  mixins: [window.windowMixin],
   template: `
     <q-card class="my-card">
       <q-card-section>
@@ -756,7 +757,6 @@ window.app.component('lnbits-node-info', {
       showDialog: false
     }
   },
-  mixins: [window.windowMixin],
   methods: {
     shortenNodeId(nodeId) {
       return nodeId

lnbits/static/js/components/admin/lnbits-admin-assets-config.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-assets-config', {
   props: ['form-data'],
   template: '#lnbits-admin-assets-config',
-  mixins: [window.windowMixin],
   data() {
     return {
       newAllowedAssetMimeType: '',
@@ -17,6 +16,7 @@ window.app.component('lnbits-admin-assets-config', {
           this.newAllowedAssetMimeType
         )
         this.newAllowedAssetMimeType = ''
+        this.formData.touch = null
       }
     },
     removeAllowedAssetMimeType(type) {
@@ -24,18 +24,21 @@ window.app.component('lnbits-admin-assets-config', {
       if (index !== -1) {
         this.formData.lnbits_assets_allowed_mime_types.splice(index, 1)
       }
+      this.formData.touch = null
     },
     addNewNoLimitUser() {
       if (this.newNoLimitUser) {
         this.removeNoLimitUser(this.newNoLimitUser)
         this.formData.lnbits_assets_no_limit_users.push(this.newNoLimitUser)
         this.newNoLimitUser = ''
+        this.formData.touch = null
       }
     },
     removeNoLimitUser(user) {
       if (user) {
         this.formData.lnbits_assets_no_limit_users =
           this.formData.lnbits_assets_no_limit_users.filter(u => u !== user)
+        this.formData.touch = null
       }
     }
   }

lnbits/static/js/components/admin/lnbits-admin-audit.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-audit', {
   props: ['form-data'],
   template: '#lnbits-admin-audit',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddIncludePath: '',

lnbits/static/js/components/admin/lnbits-admin-exchange-providers.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-exchange-providers', {
   props: ['form-data'],
   template: '#lnbits-admin-exchange-providers',
-  mixins: [window.windowMixin],
   data() {
     return {
       exchangeData: {

lnbits/static/js/components/admin/lnbits-admin-extensions.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-extensions', {
   props: ['form-data'],
   template: '#lnbits-admin-extensions',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddExtensionsManifest: ''

lnbits/static/js/components/admin/lnbits-admin-fiat-providers.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-fiat-providers', {
   props: ['form-data'],
   template: '#lnbits-admin-fiat-providers',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddStripeUser: '',

lnbits/static/js/components/admin/lnbits-admin-funding-sources.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-admin-funding-sources', {
   template: '#lnbits-admin-funding-sources',
-  mixins: [window.windowMixin],
   props: ['form-data', 'allowed-funding-sources'],
   methods: {
     getFundingSourceLabel(item) {
@@ -89,8 +88,14 @@ window.app.component('lnbits-admin-funding-sources', {
             lnd_rest_cert: 'Certificate',
             lnd_rest_macaroon: 'Macaroon',
             lnd_rest_macaroon_encrypted: 'Encrypted Macaroon',
-            lnd_rest_route_hints: 'Enable Route Hints',
-            lnd_rest_allow_self_payment: 'Allow Self Payment'
+            lnd_rest_route_hints: {
+              advanced: true,
+              label: 'Enable Route Hints'
+            },
+            lnd_rest_allow_self_payment: {
+              advanced: true,
+              label: 'Allow Self Payment'
+            }
           }
         ],
         [
@@ -160,14 +165,27 @@ window.app.component('lnbits-admin-funding-sources', {
           'BoltzWallet',
           'Boltz',
           {
-            boltz_client_endpoint: 'Endpoint',
-            boltz_client_macaroon: 'Admin Macaroon path or hex',
-            boltz_client_cert: 'Certificate path or hex',
-            boltz_client_password: 'Wallet Password (can be empty)',
+            boltz_client_endpoint: {
+              label: 'Boltz client endpoint',
+              value: '127.0.0.1:9002'
+            },
+            boltz_client_macaroon: {
+              label: 'Admin Macaroon path or hex',
+              value: '/home/ubuntu/.boltz/macaroons/admin.macaroon'
+            },
+            boltz_client_cert: {
+              label: 'Certificate path or hex',
+              value: '/home/ubuntu/.boltz/tls.cert'
+            },
             boltz_mnemonic: {
-              label: 'Liquid mnemonic (copy into greenwallet)',
+              label: 'Liquid seed phrase',
+              hint: 'Boltz will fetch once connected, but you can change later (can be opened in a liquid wallet) ',
               copy: true,
               qrcode: true
+            },
+            boltz_client_password: {
+              label: 'Wallet Password (optional)',
+              advanced: true
             }
           }
         ],

lnbits/static/js/components/admin/lnbits-admin-funding.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-funding', {
   props: ['is-super-user', 'form-data', 'settings'],
   template: '#lnbits-admin-funding',
-  mixins: [window.windowMixin],
   data() {
     return {
       auditData: []

lnbits/static/js/components/admin/lnbits-admin-notifications.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-notifications', {
   props: ['form-data'],
   template: '#lnbits-admin-notifications',
-  mixins: [window.windowMixin],
   data() {
     return {
       nostrNotificationIdentifier: '',

lnbits/static/js/components/admin/lnbits-admin-security.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-security', {
   props: ['form-data'],
   template: '#lnbits-admin-security',
-  mixins: [window.windowMixin],
   data() {
     return {
       logs: [],
@@ -9,11 +8,58 @@ window.app.component('lnbits-admin-security', {
       serverlogEnabled: false,
       nostrAcceptedUrl: '',
       formAllowedIPs: '',
-      formCallbackUrlRule: ''
+      formCallbackUrlRule: '',
+      routeOptions: [],
+      routeOptionsFiltered: [],
+      routeOptionsLoading: false
     }
   },
-  created() {},
+  created() {
+    this.loadOpenApiRoutes()
+  },
   methods: {
+    async loadOpenApiRoutes() {
+      this.routeOptionsLoading = true
+      try {
+        const response = await fetch('/openapi.json')
+        if (!response.ok) {
+          throw new Error('Failed to load OpenAPI spec')
+        }
+        const data = await response.json()
+        const paths = Object.keys(data.paths || {}).sort()
+        this.routeOptions = paths
+        this.routeOptionsFiltered = paths
+      } catch (error) {
+        console.warn(error)
+      } finally {
+        this.routeOptionsLoading = false
+      }
+    },
+    addRouteOption(value, done) {
+      const route = value.trim()
+      if (!route) {
+        done()
+        return
+      }
+      if (!this.routeOptions.includes(route)) {
+        this.routeOptions.push(route)
+        this.routeOptions.sort()
+      }
+      this.routeOptionsFiltered = this.routeOptions
+      done(route)
+    },
+    filterRouteOptions(val, update) {
+      update(() => {
+        if (!val) {
+          this.routeOptionsFiltered = this.routeOptions
+          return
+        }
+        const needle = val.toLowerCase()
+        this.routeOptionsFiltered = this.routeOptions.filter(route =>
+          route.toLowerCase().includes(needle)
+        )
+      })
+    },
     addAllowedIPs() {
       const allowedIPs = this.formAllowedIPs.trim()
       const allowed_ips = this.formData.lnbits_allowed_ips

lnbits/static/js/components/admin/lnbits-admin-server.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-admin-server', {
   props: ['form-data'],
-  template: '#lnbits-admin-server',
-  mixins: [window.windowMixin]
+  template: '#lnbits-admin-server'
 })

lnbits/static/js/components/admin/lnbits-admin-site-customisation.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-site-customisation', {
   props: ['form-data'],
   template: '#lnbits-admin-site-customisation',
-  mixins: [window.windowMixin],
   data() {
     return {
       lnbits_theme_options: [

lnbits/static/js/components/admin/lnbits-admin-users.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-users', {
   props: ['form-data'],
   template: '#lnbits-admin-users',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddUser: '',

lnbits/static/js/components/lnbits-disclaimer.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-disclaimer', {
   template: '#lnbits-disclaimer',
-  mixins: [window.windowMixin],
   computed: {
     showDisclaimer() {
       return !g.disclaimerShown && g.isUserAuthorized

lnbits/static/js/components/lnbits-drawer.js

@@ -1,4 +1,3 @@
 window.app.component('lnbits-drawer', {
-  template: '#lnbits-drawer',
-  mixins: [window.windowMixin]
+  template: '#lnbits-drawer'
 })

lnbits/static/js/components/lnbits-error.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-error', {
   template: '#lnbits-error',
-  mixins: [window.windowMixin],
   props: ['dynamic', 'code', 'message'],
   computed: {
     isExtension() {

lnbits/static/js/components/lnbits-footer.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-footer', {
   template: '#lnbits-footer',
-  mixins: [window.windowMixin],
   computed: {
     version() {
       return this.LNBITS_VERSION || 'unknown version'

lnbits/static/js/components/lnbits-header-wallets.js

@@ -1,4 +1,3 @@
 window.app.component('lnbits-header-wallets', {
-  template: '#lnbits-header-wallets',
-  mixins: [window.windowMixin]
+  template: '#lnbits-header-wallets'
 })

lnbits/static/js/components/lnbits-header.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-header', {
   template: '#lnbits-header',
-  mixins: [window.windowMixin],
   computed: {
     hasServiceFeeMax() {
       return (
@@ -61,5 +60,28 @@ window.app.component('lnbits-header', {
         return 'User'
       }
     }
+  },
+  methods: {
+    async stopImpersonation() {
+      try {
+        await LNbits.api.stopImpersonation()
+        LNbits.utils.restoreLocalStorage('impersonation')
+        window.location = '/users'
+      } catch (e) {
+        console.warn(e)
+      }
+    },
+    async handleLanguageChanged(lang) {
+      try {
+        await LNbits.api.updateUiCustomization({locale: lang.locale})
+        this.$q.notify({
+          type: 'positive',
+          message: 'Language Updated',
+          caption: lang.locale
+        })
+      } catch (e) {
+        LNbits.utils.notifyApiError(e)
+      }
+    }
   }
 })

lnbits/static/js/components/lnbits-home-logos.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-home-logos', {
   template: '#lnbits-home-logos',
-  mixins: [window.windowMixin],
   data() {
     return {
       logos: [

lnbits/static/js/components/lnbits-label-selector.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-label-selector', {
   template: '#lnbits-label-selector',
   props: ['labels'],
-  mixins: [window.windowMixin],
   data() {
     return {
       labelFilter: '',

lnbits/static/js/components/lnbits-language-dropdown.js

@@ -1,6 +1,16 @@
 window.app.component('lnbits-language-dropdown', {
   template: '#lnbits-language-dropdown',
-  mixins: [window.windowMixin],
+  computed: {
+    currentLanguage() {
+      return (
+        this.langs.find(lang => lang.value === window.i18n.global.locale) || {
+          value: 'en',
+          label: 'English',
+          display: '🇬🇧 EN'
+        }
+      )
+    }
+  },
   methods: {
     activeLanguage(lang) {
       return window.i18n.global.locale === lang
@@ -9,6 +19,7 @@ window.app.component('lnbits-language-dropdown', {
       this.g.locale = newValue
       window.i18n.global.locale = newValue
       this.$q.localStorage.set('lnbits.lang', newValue)
+      this.$emit('language-changed', newValue)
     }
   },
   data() {

lnbits/static/js/components/lnbits-manage-extension-list.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-manage-extension-list', {
-  mixins: [window.windowMixin],
   template: '#lnbits-manage-extension-list',
   data() {
     return {

lnbits/static/js/components/lnbits-manage-wallet-list.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-manage-wallet-list', {
   template: '#lnbits-manage-wallet-list',
-  mixins: [window.windowMixin],
   data() {
     return {
       activeWalletId: null

lnbits/static/js/components/lnbits-payment-list.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-payment-list', {
   template: '#lnbits-payment-list',
   props: ['wallet', 'paymentFilter'],
-  mixins: [window.windowMixin],
   data() {
     return {
       payments: [],

lnbits/static/js/components/lnbits-qrcode-lnurl.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-qrcode-lnurl', {
   template: '#lnbits-qrcode-lnurl',
-  mixins: [window.windowMixin],
   props: {
     url: {
       required: true,

lnbits/static/js/components/lnbits-qrcode.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-qrcode', {
-  mixins: [window.windowMixin],
   template: '#lnbits-qrcode',
   components: {
     QrcodeVue: QrcodeVue.default

lnbits/static/js/components/lnbits-theme.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-theme', {
-  mixins: [window.windowMixin],
   watch: {
     'g.walletFlip'(val) {
       this.$q.localStorage.setItem('lnbits.walletFlip', val)
@@ -10,6 +9,10 @@ window.app.component('lnbits-theme', {
     'g.disclaimerShown'(val) {
       this.$q.localStorage.setItem('lnbits.disclaimerShown', val)
     },
+    'g.locale'(val) {
+      this.$q.localStorage.setItem('lnbits.lang', val)
+      window.i18n.global.locale = val
+    },
     'g.isFiatPriority'(val) {
       this.$q.localStorage.setItem('lnbits.isFiatPriority', val)
     },
@@ -124,6 +127,13 @@ window.app.component('lnbits-theme', {
     if (this.g.mobileSimple === true) {
       document.body.classList.add('mobile-simple')
     }
+    Object.entries(this.g.user.uiCustomization || {}).forEach(
+      ([key, value]) => {
+        if (key in this.g) {
+          this.g[key] = value
+        }
+      }
+    )
     this.checkUrlParams()
   }
 })

lnbits/static/js/components/lnbits-wallet-api-docs.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-api-docs', {
   template: '#lnbits-wallet-api-docs',
-  mixins: [window.windowMixin],
   methods: {
     resetKeys() {
       LNbits.utils

lnbits/static/js/components/lnbits-wallet-charts.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-charts', {
   template: '#lnbits-wallet-charts',
-  mixins: [window.windowMixin],
   props: ['paymentFilter', 'chartConfig'],
   data() {
     return {

lnbits/static/js/components/lnbits-wallet-extra.js

@@ -1,9 +1,10 @@
 window.app.component('lnbits-wallet-extra', {
   template: '#lnbits-wallet-extra',
-  mixins: [window.windowMixin],
   props: ['chartConfig'],
-  data() {
-    return {}
+  computed: {
+    exportUrl() {
+      return `${window.location.origin}/wallet?usr=${this.g.user.id}&wal=${this.g.wallet.id}`
+    }
   },
   methods: {
     handleSendLnurl(lnurl) {

lnbits/static/js/components/lnbits-wallet-icon.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-icon', {
   template: '#lnbits-wallet-icon',
-  mixins: [window.windowMixin],
   data() {
     return {
       icon: {

lnbits/static/js/components/lnbits-wallet-new.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-new', {
   template: '#lnbits-wallet-new',
-  mixins: [window.windowMixin],
   data() {
     return {
       walletTypes: [{label: 'Lightning Wallet', value: 'lightning'}],

lnbits/static/js/components/lnbits-wallet-paylinks.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-paylinks', {
   template: '#lnbits-wallet-paylinks',
-  mixins: [window.windowMixin],
   data() {
     return {
       storedPaylinks: []

lnbits/static/js/components/lnbits-wallet-share.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-share', {
   template: '#lnbits-wallet-share',
-  mixins: [window.windowMixin],
   computed: {
     walletApprovedShares() {
       return this.g.wallet.extra.shared_with.filter(

lnbits/static/js/globals.js

@@ -15,6 +15,7 @@ window.g = Vue.reactive({
   wallet: null,
   isPublicPage: true,
   isUserAuthorized: !!Quasar.Cookies.get('is_lnbits_user_authorized'),
+  isUserImpersonated: !!Quasar.Cookies.get('is_lnbits_user_impersonated'),
   offline: !navigator.onLine,
   hasCamera: false,
   visibleDrawer: false,

lnbits/static/js/init-app.js

@@ -106,6 +106,11 @@ const routes = [
     name: 'ExtensionsBuilder',
     component: PageExtensionBuilder
   },
+  {
+    path: '/extensions/builder/preview',
+    name: 'ExtensionsBuilderPreview',
+    component: PageExtensionBuilderPreview
+  },
   {
     path: '/extensions',
     name: 'Extensions',

lnbits/static/js/pages/account.js

@@ -1,6 +1,5 @@
 window.PageAccount = {
   template: '#page-account',
-  mixins: [window.windowMixin],
   data() {
     return {
       untouchedUser: null,
@@ -40,6 +39,15 @@ window.PageAccount = {
           color: 'pink-3'
         }
       ],
+      defaultSiteCustomisation: {
+        locale: 'en',
+        themeChoice: 'salvador',
+        bgimageChoice: '',
+        gradientChoice: true,
+        darkChoice: true,
+        borderChoice: 'hard-border',
+        reactionChoice: 'confettiBothSides'
+      },
       reactionOptions: [
         'None',
         'confettiBothSides',
@@ -214,26 +222,18 @@ window.PageAccount = {
     }
   },
   methods: {
-    activeLanguage(lang) {
-      return window.i18n.global.locale === lang
-    },
     changeLanguage(newValue) {
       window.i18n.global.locale = newValue
       this.$q.localStorage.set('lnbits.lang', newValue)
     },
     async updateAccount() {
       try {
-        const {data} = await LNbits.api.request(
-          'PUT',
-          '/api/v1/auth/update',
-          null,
-          {
-            user_id: this.g.user.id,
-            username: this.g.user.username,
-            email: this.g.user.email,
-            extra: this.g.user.extra
-          }
-        )
+        const {data} = await LNbits.api.request('PATCH', '/api/v1/auth', null, {
+          user_id: this.g.user.id,
+          username: this.g.user.username,
+          email: this.g.user.email,
+          extra: this.g.user.extra
+        })
         this.untouchedUser = JSON.parse(JSON.stringify(this.g.user))
         this.hasUsername = !!data.username
         Quasar.Notify.create({
@@ -610,7 +610,7 @@ window.PageAccount = {
       }
     },
     copyAssetLinkToClipboard(asset) {
-      const assetUrl = `${window.location.origin}/api/v1/assets/${asset.id}/binary`
+      const assetUrl = `${window.location.origin}/api/v1/assets/${asset.id}/data`
       this.utils.copyText(assetUrl)
     },
     addUserLabel() {
@@ -681,6 +681,23 @@ window.PageAccount = {
             l => l.name !== label.name
           )
         })
+    },
+
+    async siteCustomisationChanged(options = {}) {
+      try {
+        Object.entries(options || {}).forEach(([key, value]) => {
+          if (key in this.g) {
+            this.g[key] = value
+          }
+        })
+        await LNbits.api.updateUiCustomization(options)
+        this.$q.notify({
+          type: 'positive',
+          message: 'UI Customization updated.'
+        })
+      } catch (e) {
+        LNbits.utils.notifyApiError(e)
+      }
     }
   },
 

lnbits/static/js/pages/admin.js

@@ -1,6 +1,5 @@
 window.PageAdmin = {
   template: '#page-admin',
-  mixins: [windowMixin],
   data() {
     return {
       tab: 'funding',
@@ -9,7 +8,9 @@ window.PageAdmin = {
         lnbits_exchange_rate_providers: [],
         lnbits_audit_exclude_paths: [],
         lnbits_audit_include_paths: [],
-        lnbits_audit_http_response_codes: []
+        lnbits_audit_http_response_codes: [],
+        lnbits_route_access_whitelist: [],
+        lnbits_route_access_blacklist: []
       },
       isSuperUser: false,
       needsRestart: false
@@ -70,6 +71,25 @@ window.PageAdmin = {
         .catch(LNbits.utils.notifyApiError)
     },
     updateSettings() {
+      if (this.shouldConfirmRouteAccess()) {
+        LNbits.utils
+          .confirmDialog(this.$t('route_access_save_confirm'))
+          .onOk(() => this.persistSettings())
+        return
+      }
+      this.persistSettings()
+    },
+    shouldConfirmRouteAccess() {
+      const fields = [
+        'lnbits_route_access_control_enabled',
+        'lnbits_route_access_whitelist',
+        'lnbits_route_access_blacklist'
+      ]
+      return fields.some(
+        field => !_.isEqual(this.settings[field], this.formData[field])
+      )
+    },
+    persistSettings() {
       const data = _.omit(this.formData, [
         'is_super_user',
         'lnbits_allowed_funding_sources',

lnbits/static/js/pages/audit.js

@@ -1,6 +1,5 @@
 window.PageAudit = {
   template: '#page-audit',
-  mixins: [window.windowMixin],
   data() {
     return {
       chartsReady: false,

lnbits/static/js/pages/error.js

@@ -1,4 +1,3 @@
 window.PageError = {
-  template: '#page-error',
-  mixins: [window.windowMixin]
+  template: '#page-error'
 }

lnbits/static/js/pages/extensions.js

@@ -1,6 +1,5 @@
 window.PageExtensions = {
   template: '#page-extensions',
-  mixins: [window.windowMixin],
   data() {
     return {
       extbuilderEnabled: false,
@@ -26,7 +25,63 @@ window.PageExtensions = {
       selectedRelease: null,
       uninstallAndDropDb: false,
       maxStars: 5,
-      paylinkWebsocket: null
+      paylinkWebsocket: null,
+      searchToggle: false,
+      reviewsUrl: null,
+      reviewsDialog: {
+        show: false,
+        extension: null,
+        loading: false,
+        submitting: false,
+        form: {
+          name: '',
+          rating: 0,
+          comment: ''
+        },
+        error: null
+      },
+      reviews: [],
+      reviewsTable: {
+        loading: false,
+        columns: [
+          {
+            name: 'name',
+            align: 'left',
+            label: this.$t('Name'),
+            field: 'name',
+            sortable: true
+          },
+          {
+            name: 'comment',
+            align: 'left',
+            label: this.$t('Comment'),
+            field: 'comment'
+          },
+          {
+            name: 'created_at',
+            align: 'left',
+            label: this.$t('Date'),
+            field: 'created_at'
+          },
+          {
+            name: 'rating',
+            align: 'right',
+            label: 'Rating',
+            field: 'rating'
+          }
+        ],
+        pagination: {
+          rowsPerPage: 5,
+          sortBy: 'created_at',
+          descending: true,
+          page: 1
+        }
+      },
+      paymentDialog: {
+        show: false,
+        invoice: '',
+        hash: ''
+      }
     }
   },
   watch: {
@@ -71,7 +126,6 @@ window.PageExtensions = {
       // the install logic has been triggered one way or another
       this.unsubscribeFromPaylinkWs()
 
-      const extension = this.selectedExtension
       this.selectedExtension.inProgress = true
       this.showManageExtensionDialog = false
       release.payment_hash =
@@ -86,6 +140,7 @@ window.PageExtensions = {
           version: release.version
         })
         .then(response => {
+          this.selectedExtension.inProgress = false
           const extension = this.extensions.find(
             ext => ext.id === this.selectedExtension.id
           )
@@ -100,7 +155,7 @@ window.PageExtensions = {
         })
         .catch(err => {
           console.warn(err)
-          extension.inProgress = false
+          this.selectedExtension.inProgress = false
           LNbits.utils.notifyApiError(err)
         })
     },
@@ -284,8 +339,7 @@ window.PageExtensions = {
       try {
         const {data} = await LNbits.api.request(
           'GET',
-          `/api/v1/extension/${extension.id}/releases`,
-          this.g.user.wallets[0].adminkey
+          `/api/v1/extension/${extension.id}/releases`
         )
 
         this.selectedExtensionRepos = data.reduce((repos, release) => {
@@ -323,6 +377,9 @@ window.PageExtensions = {
       if (!detailsLink) {
         return
       }
+      // keep a reference to the extension so we can show rating stats
+      this.selectedExtension =
+        this.extensions.find(ext => ext.id === extId) || this.selectedExtension
       this.selectedExtensionDetails = null
       this.showExtensionDetailsDialog = true
       this.slide = 0
@@ -331,8 +388,7 @@ window.PageExtensions = {
       try {
         const {data} = await LNbits.api.request(
           'GET',
-          `/api/v1/extension/${extId}/details?details_link=${detailsLink}`,
-          this.g.user.wallets[0].inkey
+          `/api/v1/extension/${extId}/details?details_link=${detailsLink}`
         )
 
         this.selectedExtensionDetails = data
@@ -453,7 +509,7 @@ window.PageExtensions = {
       const {data} = await LNbits.api.request(
         'PUT',
         `/api/v1/extension/${extId}/invoice/install`,
-        this.g.user.wallets[0].adminkey,
+        null,
         {
           ext_id: extId,
           archive: release.archive,
@@ -469,7 +525,7 @@ window.PageExtensions = {
       const {data} = await LNbits.api.request(
         'PUT',
         `/api/v1/extension/${extId}/invoice/enable`,
-        this.g.user.wallets[0].adminkey,
+        null,
         {
           amount
         }
@@ -560,8 +616,7 @@ window.PageExtensions = {
       try {
         const {data} = await LNbits.api.request(
           'GET',
-          `/api/v1/extension/release/${org}/${repo}/${release.version}`,
-          this.g.user.wallets[0].adminkey
+          `/api/v1/extension/release/${org}/${repo}/${release.version}`
         )
         release.loaded = true
         release.is_version_compatible = data.is_version_compatible
@@ -586,18 +641,13 @@ window.PageExtensions = {
             continue
           }
           ext.inProgress = true
-          await LNbits.api.request(
-            'POST',
-            `/api/v1/extension`,
-            this.g.user.wallets[0].adminkey,
-            {
-              ext_id: ext.id,
-              archive: ext.latestRelease.archive,
-              source_repo: ext.latestRelease.source_repo,
-              payment_hash: ext.latestRelease.payment_hash,
-              version: ext.latestRelease.version
-            }
-          )
+          await LNbits.api.request('POST', `/api/v1/extension`, null, {
+            ext_id: ext.id,
+            archive: ext.latestRelease.archive,
+            source_repo: ext.latestRelease.source_repo,
+            payment_hash: ext.latestRelease.payment_hash,
+            version: ext.latestRelease.version
+          })
           count++
           ext.isAvailable = true
           ext.isInstalled = true
@@ -622,6 +672,163 @@ window.PageExtensions = {
       })
       this.showUpdateAllDialog = false
     },
+    formatAvg(raw) {
+      const val = Number(raw || 0)
+      return Math.round((val / 2 / 100) * 2) / 2
+    },
+
+    async loadReviewStats() {
+      if (!this.reviewsUrl) {
+        console.info('Extension reviews are not configured')
+        return
+      }
+      try {
+        const {data} = await LNbits.api.request(
+          'GET',
+          `/api/v1/extension/reviews/tags`
+        )
+        const map = {}
+        data.forEach(stat => {
+          map[stat.tag] = stat
+        })
+        this.extensions.forEach(ext => {
+          ext.reviewStats = map[ext.id] || null
+        })
+        this.filterExtensions(this.searchTerm, this.tab)
+      } catch (error) {
+        console.warn(error)
+      }
+    },
+    async openReviews(extension) {
+      const targetExtension =
+        extension ||
+        (this.selectedExtensionDetails
+          ? this.extensions.find(e => e.id === this.selectedExtensionDetails.id)
+          : null)
+      if (!targetExtension) {
+        return
+      }
+      if (!this.reviewsUrl) {
+        Quasar.Notify.create({
+          type: 'warning',
+          message: this.$t('reviews_url_not_configured')
+        })
+        return
+      }
+      this.reviewsDialog.extension = targetExtension
+      this.selectedExtension = extension
+      this.reviewsDialog.show = true
+      await this.getTagReviews()
+    },
+    async getTagReviews(props) {
+      if (!this.reviewsUrl) {
+        Quasar.Notify.create({
+          type: 'warning',
+          message: this.$t('reviews_url_not_configured')
+        })
+        return
+      }
+      try {
+        this.reviewsTable.loading = true
+        const params = LNbits.utils.prepareFilterQuery(this.reviewsTable, props)
+        const {data} = await LNbits.api.request(
+          'GET',
+          `/api/v1/extension/reviews/${this.selectedExtension.id}?${params}`
+        )
+        this.reviews = data.data
+        this.reviewsTable.pagination.rowsNumber = data.total
+      } catch (e) {
+        LNbits.utils.notifyApiError(e)
+      } finally {
+        this.reviewsTable.loading = false
+      }
+    },
+
+    formatReviewDate(val) {
+      if (!val) return ''
+      const numeric = Number(val)
+      if (!Number.isNaN(numeric)) {
+        return this.utils.formatTimestamp(numeric)
+      }
+      return this.utils.formatDate(val)
+    },
+    async submitReview() {
+      if (!this.reviewsDialog.extension || !this.reviewsUrl) {
+        return
+      }
+      this.reviewsDialog.submitting = true
+      try {
+        const payload = {
+          tag: this.reviewsDialog.extension.id,
+          name: this.reviewsDialog.form.name,
+          rating: this.reviewsDialog.form.rating * 100,
+          comment: this.reviewsDialog.form.comment
+        }
+        const {data} = await LNbits.api.request(
+          'PUT',
+          `/api/v1/extension/reviews`,
+          null,
+          payload
+        )
+        if (data.payment_request) {
+          this.openInvoiceDialog(data.payment_request, data.payment_hash)
+        } else {
+          Quasar.Notify.create({
+            type: 'positive',
+            message: 'Review submitted'
+          })
+          this.resetReviewForm()
+          await this.getTagReviews()
+          await this.loadReviewStats()
+        }
+      } catch (error) {
+        LNbits.utils.notifyApiError(error)
+      } finally {
+        this.reviewsDialog.submitting = false
+      }
+    },
+    openInvoiceDialog(invoice, hash) {
+      this.paymentDialog.invoice = invoice
+      this.paymentDialog.hash = hash
+      this.paymentDialog.show = true
+      this.listenForPayment(hash)
+    },
+    resetReviewForm() {
+      this.reviewsDialog.form = {
+        name: '',
+        rating: 0,
+        comment: ''
+      }
+      this.paymentDialog = {
+        show: false,
+        invoice: '',
+        hash: ''
+      }
+    },
+    listenForPayment(hash) {
+      try {
+        const base = new URL(this.reviewsUrl)
+        base.protocol = base.protocol === 'https:' ? 'wss:' : 'ws:'
+        base.pathname = `/api/v1/ws/${hash}`
+        const ws = new WebSocket(base)
+        ws.addEventListener('message', async () => {
+          Quasar.Notify.create({
+            type: 'positive',
+            message: this.$t('reviews_invoice_paid')
+          })
+          this.paymentDialog.show = false
+          this.resetReviewForm()
+          setTimeout(async () => {
+            await this.getTagReviews()
+          }, 1000)
+
+          await this.loadReviewStats()
+          ws.close()
+        })
+      } catch (error) {
+        console.warn(error)
+      }
+    },
     async fetchAllExtensions() {
       try {
         const {data} = await LNbits.api.request('GET', `/api/v1/extension/all`)
@@ -636,6 +843,7 @@ window.PageExtensions = {
   async created() {
     this.extensions = await this.fetchAllExtensions()
     this.extbuilderEnabled = this.g.user.admin || this.LNBITS_EXT_BUILDER
+    this.reviewsUrl = this.LNBITS_EXTENSIONS_REVIEWS_URL
 
     if (this.g.user.extensions.length === 0) {
       this.tab = 'all'
@@ -652,6 +860,8 @@ window.PageExtensions = {
       this.hasNewVersion(ext)
     )
 
+    await this.loadReviewStats()
+
     this.filterExtensions(this.searchTerm, this.tab)
   }
 }

lnbits/static/js/pages/extensions_builder.js

@@ -1,6 +1,5 @@
 window.PageExtensionBuilder = {
   template: '#page-extension-builder',
-  mixins: [windowMixin],
   data() {
     return {
       step: 1,
@@ -288,11 +287,10 @@ window.PageExtensionBuilder = {
           `/api/v1/extension/${stub_ext_id}/releases`
         )
 
-        this.extensionStubVersions = data.sort((a, b) =>
-          a.version < b.version ? 1 : -1
-        )
-        this.extensionData.stub_version = this.extensionStubVersions[0]
-          ? this.extensionStubVersions[0].version
+        this.extensionStubVersions = data
+        const validVersions = data.filter(v => v.is_version_compatible)
+        this.extensionData.stub_version = validVersions[0]
+          ? validVersions[0].version
           : ''
       } catch (error) {
         LNbits.utils.notifyApiError(error)
@@ -311,7 +309,20 @@ window.PageExtensionBuilder = {
         iframeDoc.body.style.transform = 'scale(0.8)'
         iframeDoc.body.style.transformOrigin = 'center top'
       }
-      iframe.src = `/extensions/builder/preview/${this.extensionData.id}?page_name=${previewPageName}`
+
+      let componentName =
+        'Page' +
+        this.extensionData.id
+          .toLowerCase()
+          .split('_')
+          .map(word => word.charAt(0).toUpperCase() + word.slice(1))
+          .join('')
+      if (previewPageName === 'public_page') componentName += 'Public'
+      iframe.src =
+        `/extensions/builder/preview?` +
+        `ext_id=${this.extensionData.id}` +
+        `&page=${previewPageName}` +
+        `&component=${componentName}`
     },
     initBasicData() {
       this.extensionData.owner_data.fields = [

lnbits/static/js/pages/extensions_builder_preview.js

@@ -0,0 +1,46 @@
+window.PageExtensionBuilderPreview = {
+  template: '#page-extension-builder-preview',
+  mixins: [windowMixin],
+  watch: {
+    name: 'reload'
+  },
+  data() {
+    return {
+      extId: '',
+      pageName: '',
+      componentName: null
+    }
+  },
+  methods: {
+    async reload() {
+      await LNbits.utils.loadTemplate(
+        `/extensions/builder/preview/${this.extId}/template?page_name=${this.pageName}`
+      )
+      await LNbits.utils.loadScript(
+        `/extensions/builder/preview/${this.extId}/component?page_name=${this.pageName}`
+      )
+
+      this._component = window[this.componentName]
+      console.log(
+        'LNbits preview reloaded componentName:',
+        this.componentName,
+        !!this._component
+      )
+      this.$forceUpdate()
+    }
+  },
+  async created() {
+    const urlParams = new URLSearchParams(window.location.search)
+    this.extId = urlParams.get('ext_id') || ''
+    this.pageName = urlParams.get('page') || ''
+    this.componentName = urlParams.get('component') || ''
+
+    await this.reload()
+  },
+  render() {
+    if (this._component) {
+      return Vue.h(this._component)
+    }
+    return Vue.h('div', 'Loading...')
+  }
+}

lnbits/static/js/pages/first-install.js

@@ -1,6 +1,5 @@
 window.PageFirstInstall = {
   template: '#page-first-install',
-  mixins: [window.windowMixin],
   data() {
     return {
       loginData: {

lnbits/static/js/pages/home.js

@@ -1,6 +1,5 @@
 window.PageHome = {
   template: '#page-home',
-  mixins: [window.windowMixin],
   data() {
     return {
       lnurl: '',

lnbits/static/js/pages/node-public.js

@@ -1,6 +1,5 @@
 window.PageNodePublic = {
   template: '#page-node-public',
-  mixins: [window.windowMixin],
   data() {
     return {
       enabled: false,

lnbits/static/js/pages/node.js

@@ -1,5 +1,4 @@
 window.PageNode = {
-  mixins: [window.windowMixin],
   template: '#page-node',
   config: {
     globalProperties: {

lnbits/static/js/pages/payments.js

@@ -1,6 +1,5 @@
 window.PagePayments = {
   template: '#page-payments',
-  mixins: [window.windowMixin],
   data() {
     return {
       payments: [],

lnbits/static/js/pages/users.js

@@ -1,6 +1,5 @@
 window.PageUsers = {
   template: '#page-users',
-  mixins: [window.windowMixin],
   data() {
     return {
       paymentsWallet: {},
@@ -439,6 +438,20 @@ window.PageUsers = {
         this.activeUser.show = false
       }
     },
+    async impersonateUser(user_id) {
+      try {
+        await LNbits.api.impersonateUser(user_id)
+        LNbits.utils.backupLocalStorage('impersonation', true)
+        this.$q.localStorage.setItem('lnbits.disclaimerShown', true)
+        window.location = '/wallet'
+      } catch (error) {
+        console.warn(error)
+        Quasar.Notify.create({
+          type: 'warning',
+          message: 'Failed to impersonate user!'
+        })
+      }
+    },
     async showWalletPayments(walletId) {
       this.activeUser.show = false
       await this.fetchWallets(this.users[0].id)

lnbits/static/js/pages/wallet.js

@@ -1,6 +1,5 @@
 window.PageWallet = {
   template: '#page-wallet',
-  mixins: [window.windowMixin],
   data() {
     return {
       parse: {

lnbits/static/js/pages/wallets.js

@@ -1,6 +1,5 @@
 window.PageWallets = {
   template: '#page-wallets',
-  mixins: [window.windowMixin],
   data() {
     return {
       user: null,

lnbits/static/js/utils.js

@@ -67,6 +67,29 @@ window._lnbitsUtils = {
         }
       })
   },
+  backupLocalStorage(backupKey, cleanup = false) {
+    const lnbitsEntries =
+      Object.entries(Quasar.LocalStorage.getAll()).filter(
+        ([k, v]) => k.startsWith('lnbits.') && k !== `lnbits.${backupKey}`
+      ) || []
+
+    Quasar.LocalStorage.setItem(`lnbits.${backupKey}`, lnbitsEntries)
+    if (cleanup) {
+      lnbitsEntries.forEach(([k, v]) => Quasar.LocalStorage.remove(k))
+    }
+  },
+  restoreLocalStorage(backupKey) {
+    Object.entries(Quasar.LocalStorage.getAll())
+      .filter(
+        ([k, v]) => k.startsWith('lnbits.') && k !== `lnbits.${backupKey}`
+      )
+      .forEach(([k, v]) => Quasar.LocalStorage.remove(k))
+
+    const lnbitsEntries =
+      Quasar.LocalStorage.getItem(`lnbits.${backupKey}`) || []
+    lnbitsEntries.forEach(([k, v]) => Quasar.LocalStorage.setItem(k, v))
+    Quasar.LocalStorage.remove(`lnbits.${backupKey}`)
+  },
   async digestMessage(message) {
     const msgUint8 = new TextEncoder().encode(message)
     const hashBuffer = await crypto.subtle.digest('SHA-256', msgUint8)
@@ -114,6 +137,13 @@ window._lnbitsUtils = {
   formatMsat(value) {
     return this.formatSat(value / 1000)
   },
+  parseJSONSafe(str) {
+    try {
+      return JSON.parse(str)
+    } catch (e) {
+      return null
+    }
+  },
   notifyApiError(error) {
     if (!error.response) {
       return console.error(error)
@@ -123,17 +153,28 @@ window._lnbitsUtils = {
       401: 'warning',
       500: 'negative'
     }
-    Quasar.Notify.create({
-      timeout: 5000,
-      type: types[error.response.status] || 'warning',
-      message:
-        error.response.data.message || error.response.data.detail || null,
-      caption:
-        [error.response.status, ' ', error.response.statusText]
-          .join('')
-          .toUpperCase() || null,
-      icon: null
-    })
+    let messages = error.response.data.detail
+    if (messages) {
+      messages = Array.isArray(messages)
+        ? messages.map(e => e.msg + ` (${e.loc?.join('/')})`)
+        : (messages = [messages])
+    } else {
+      messages = [error.response.data.message || error.response.data.detail]
+    }
+
+    messages.forEach(message =>
+      Quasar.Notify.create({
+        timeout: 5000,
+        type: types[error.response.status] || 'warning',
+        message,
+        caption:
+          [error.response.status, ' ', error.response.statusText]
+            .join('')
+            .toUpperCase() || null,
+        icon: null,
+        closeBtn: true
+      })
+    )
   },
   search(data, q, field, separator) {
     try {

lnbits/static/vendor.json

@@ -45,6 +45,8 @@
     "js/pages/error.js",
     "js/pages/home.js",
     "js/pages/extensions_builder.js",
+    "js/pages/extensions_builder.js",
+    "js/pages/extensions_builder_preview.js",
     "js/pages/extensions.js",
     "js/pages/first-install.js",
     "js/pages/payments.js",

lnbits/templates/components.vue

@@ -561,11 +561,32 @@ include('components/lnbits-error.vue') %}
 </template>
 
 <template id="lnbits-extension-rating">
-  <div style="margin-bottom: 3px">
-    <q-rating v-model="rating" size="1.5em" :max="5" color="primary"
-      ><q-tooltip>
-        <span v-text="$t('extension_rating_soon')"></span> </q-tooltip
-    ></q-rating>
+  <div class="row items-center q-gutter-xs" style="margin-bottom: 3px">
+    <q-rating
+      :model-value="displayRating"
+      size="1.4em"
+      :max="5"
+      color="primary"
+      icon="star_border"
+      icon-selected="star"
+      icon-half="star_half"
+      readonly
+      :class="clickable ? 'cursor-pointer' : ''"
+      @click="handleClick"
+    >
+      <q-tooltip v-if="!hasData">
+        <span v-text="$t('extension_rating_soon')"></span>
+      </q-tooltip>
+      <q-tooltip v-else-if="clickable">
+        <span v-text="$t('reviews_open')"></span>
+      </q-tooltip>
+    </q-rating>
+    <div
+      class="text-caption text-grey"
+      v-if="count !== null && count !== undefined"
+    >
+      <span v-text="`(${count})`"></span>
+    </div>
   </div>
 </template>
 

lnbits/templates/components/admin/extensions.vue

@@ -137,6 +137,19 @@
             :hint="$t('extension_builder_manifest_url_hint')"
           ></q-input>
         </div>
+        <div class="col-12 col-md-6">
+          <p>
+            <span v-text="$t('reviews_url')"></span>
+          </p>
+          <q-input
+            filled
+            v-model="formData.lnbits_extensions_reviews_url"
+            :label="$t('reviews_url_label')"
+            :hint="$t('reviews_url_hint')"
+            type="url"
+            autocomplete="off"
+          ></q-input>
+        </div>
       </div>
     </div>
   </q-card-section>

lnbits/templates/components/admin/funding_sources.vue

@@ -35,7 +35,9 @@
       >
         <div
           class="row"
-          v-for="([key, prop], i) in Object.entries(fundingSources.get(fund))"
+          v-for="([key, prop], i) in Object.entries(
+            fundingSources.get(fund)
+          ).filter(([, p]) => !p.advanced)"
           :key="i"
         >
           <div class="col-12">
@@ -46,7 +48,7 @@
               :type="hideInput ? 'password' : 'text'"
               :label="prop.label"
               :hint="prop.hint"
-              :readonly="prop.readonly || false"
+              :value="prop.value"
             >
               <q-btn
                 v-if="prop.copy"
@@ -69,6 +71,55 @@
             </q-input>
           </div>
         </div>
+        <q-expansion-item
+          v-if="
+            Object.entries(fundingSources.get(fund)).some(([, p]) => p.advanced)
+          "
+          dense
+          expand-separator
+          icon="tune"
+          label="Advanced"
+          class="q-mt-sm"
+        >
+          <div
+            class="row"
+            v-for="([key, prop], i) in Object.entries(
+              fundingSources.get(fund)
+            ).filter(([, p]) => p.advanced)"
+            :key="`adv-${i}`"
+          >
+            <div class="col-12">
+              <q-input
+                v-model="formData[key]"
+                filled
+                class="q-mt-sm"
+                :type="hideInput ? 'password' : 'text'"
+                :label="prop.label"
+                :hint="prop.hint"
+                :readonly="prop.readonly || false"
+              >
+                <q-btn
+                  v-if="prop.copy"
+                  @click="utils.copyText(formData[key])"
+                  icon="content_copy"
+                  class="cursor-pointer"
+                  color="grey"
+                  flat
+                  dense
+                ></q-btn>
+                <q-btn
+                  v-if="prop.qrcode"
+                  @click="showQRValue(formData[key])"
+                  icon="qr_code"
+                  class="cursor-pointer"
+                  color="grey"
+                  flat
+                  dense
+                ></q-btn>
+              </q-input>
+            </div>
+          </div>
+        </q-expansion-item>
       </div>
     </q-list>
     <q-dialog v-model="showQRDialog">

lnbits/templates/components/admin/security.vue

@@ -296,6 +296,56 @@
           </div>
         </div>
 
+        <div class="col-12 col-md-12">
+          <p v-text="$t('route_access_control')"></p>
+          <div class="row q-col-gutter-md">
+            <div class="col-12">
+              <q-toggle
+                v-model="formData.lnbits_route_access_control_enabled"
+                :label="$t('route_access_control_enable')"
+              ></q-toggle>
+              <div
+                class="text-caption text-grey-6 q-mt-xs"
+                v-text="$t('route_access_control_hint')"
+              ></div>
+            </div>
+            <div class="col-12 col-md-6">
+              <q-select
+                filled
+                multiple
+                use-chips
+                use-input
+                input-debounce="0"
+                new-value-mode="add-unique"
+                @new-value="addRouteOption"
+                :options="routeOptionsFiltered"
+                :loading="routeOptionsLoading"
+                @filter="filterRouteOptions"
+                v-model="formData.lnbits_route_access_whitelist"
+                :label="$t('route_access_whitelist_label')"
+                :hint="$t('route_access_whitelist_hint')"
+              ></q-select>
+            </div>
+            <div class="col-12 col-md-6">
+              <q-select
+                filled
+                multiple
+                use-chips
+                use-input
+                input-debounce="0"
+                new-value-mode="add-unique"
+                @new-value="addRouteOption"
+                :options="routeOptionsFiltered"
+                :loading="routeOptionsLoading"
+                @filter="filterRouteOptions"
+                v-model="formData.lnbits_route_access_blacklist"
+                :label="$t('route_access_blacklist_label')"
+                :hint="$t('route_access_blacklist_hint')"
+              ></q-select>
+            </div>
+          </div>
+        </div>
+
         <div class="col-12 col-md-12">
           <p v-text="$t('rate_limiter')"></p>
           <div class="row q-col-gutter-md">

lnbits/templates/components/admin/site_customisation.vue

@@ -86,6 +86,42 @@
           ></q-input>
         </div>
       </div>
+      <br />
+      <div class="row q-col-gutter-md">
+        <div class="col-12 col-md-4">
+          <p>
+            <span v-text="$t('wallet_featured_button_label')"></span>
+          </p>
+          <q-input
+            filled
+            type="text"
+            v-model="formData.lnbits_wallet_featured_button_label"
+            label="Loop to Onchain"
+            :hint="$t('wallet_featured_button_label_hint')"
+          ></q-input>
+        </div>
+        <div class="col-12 col-md-4">
+          <p><span v-text="$t('wallet_featured_button_url')"></span></p>
+          <q-input
+            filled
+            type="text"
+            v-model="formData.lnbits_wallet_featured_button_url"
+            label="/boltz"
+            :hint="$t('wallet_featured_button_url_hint')"
+          ></q-input>
+        </div>
+        <div class="col-12 col-md-4">
+          <p><span v-text="$t('wallet_featured_button_icon')"></span></p>
+          <q-input
+            filled
+            type="text"
+            v-model="formData.lnbits_wallet_featured_button_icon"
+            label="bolt"
+            :hint="$t('wallet_featured_button_icon_hint')"
+          ></q-input>
+        </div>
+      </div>
+
       <div class="row q-col-gutter-md q-mt-md">
         <div class="col-12 col-md-6">
           <p><span v-text="$t('ui_custom_badge')"></span></p>

lnbits/templates/components/lnbits-header.vue

@@ -71,9 +71,11 @@
         <span>OFFLINE</span>
       </q-badge>
 
-      <lnbits-language-dropdown></lnbits-language-dropdown>
+      <lnbits-language-dropdown
+        @language-changed="handleLanguageChanged({locale: $event})"
+      ></lnbits-language-dropdown>
 
-      <q-btn-dropdown v-if="g.user" flat rounded size="sm" class="q-pl-sm">
+      <q-btn-dropdown v-if="g.user" flat rounded size="md" class="q-pl-sm">
         <template v-slot:label>
           <q-avatar
             v-if="g.user?.extra?.picture && g.user?.extra?.picture !== ''"
@@ -136,6 +138,20 @@
           </q-item>
         </q-list>
       </q-btn-dropdown>
+      <q-btn
+        v-if="g.isUserImpersonated"
+        @click="stopImpersonation"
+        rounded
+        size="sm"
+        class="q-pl-sm"
+        color="negative"
+        icon="face_retouching_off"
+        label="Stop"
+      >
+        <q-tooltip
+          ><span v-text="$t('stop_user_impersonation')"></span
+        ></q-tooltip>
+      </q-btn>
     </q-toolbar>
   </q-header>
 </template>

lnbits/templates/components/lnbits-language-dropdown.vue

@@ -1,5 +1,11 @@
 <template id="lnbits-language-dropdown">
-  <q-btn-dropdown dense flat rounded size="sm" icon="language" class="q-pl-md">
+  <q-btn-dropdown dense flat rounded size="md" class="q-pl-md">
+    <template v-slot:label>
+      <q-item-section>
+        <q-item-label v-text="currentLanguage.display"></q-item-label>
+        <q-tooltip><span v-text="currentLanguage.label"></span></q-tooltip>
+      </q-item-section>
+    </template>
     <q-list v-for="(lang, index) in langs" :key="index">
       <q-item
         clickable

lnbits/templates/components/lnbits-wallet-extra.vue

@@ -83,9 +83,7 @@
                       class="text-center"
                       v-text="$t('export_to_phone_desc')"
                     ></p>
-                    <lnbits-qrcode
-                      :value="`${baseUrl}wallet?usr=${g.user.id}&wal=${g.wallet.id}`"
-                    ></lnbits-qrcode>
+                    <lnbits-qrcode :value="exportUrl"></lnbits-qrcode>
                   </q-card-section>
                 </q-card>
               </q-expansion-item>

lnbits/templates/pages/account.vue

@@ -120,7 +120,7 @@
                         class="q-mb-md"
                       ></q-input>
                       <q-input
-                        v-if="g.user.has_password"
+                        v-if="g.user.hasPassword"
                         v-model="credentialsData.oldPassword"
                         type="password"
                         autocomplete="off"
@@ -333,6 +333,16 @@
                         class="q-mb-md"
                       >
                       </q-input>
+
+                      <q-input
+                        v-model="g.user.extra.visible_wallet_count"
+                        :label="$t('visible_wallet_count')"
+                        filled
+                        dense
+                        type="number"
+                        class="q-mb-md"
+                      ></q-input>
+
                       <q-input
                         v-model="g.user.external_id"
                         :label="$t('external_id')"
@@ -380,22 +390,11 @@
                       <span v-text="$t('language')"></span>
                     </div>
                     <div class="col-8">
-                      <lnbits-language-dropdown />
-                    </div>
-                  </div>
-                  <div class="row q-mb-md">
-                    <div class="col-4">
-                      <span v-text="$t('visible_wallet_count')"></span>
-                    </div>
-                    <div class="col-8">
-                      <q-input
-                        v-model="g.user.extra.visible_wallet_count"
-                        :label="$t('visible_wallet_count')"
-                        filled
-                        dense
-                        type="number"
-                        class="q-mb-md"
-                      ></q-input>
+                      <lnbits-language-dropdown
+                        @language-changed="
+                          siteCustomisationChanged({locale: $event})
+                        "
+                      />
                     </div>
                   </div>
 
@@ -407,7 +406,9 @@
                       <q-btn
                         v-for="theme in themeOptions"
                         :key="theme.name"
-                        @click="g.themeChoice = theme.name"
+                        @click="
+                          siteCustomisationChanged({themeChoice: theme.name})
+                        "
                         :color="theme.color"
                         dense
                         flat
@@ -427,6 +428,9 @@
                       <q-input
                         v-model="g.bgimageChoice"
                         :label="$t('background_image')"
+                        @update:model-value="
+                          siteCustomisationChanged({bgimageChoice: $event})
+                        "
                       >
                         <q-tooltip
                           ><span v-text="$t('background_image')"></span
@@ -445,6 +449,9 @@
                         round
                         icon="gradient"
                         v-model="g.gradientChoice"
+                        @update:model-value="
+                          siteCustomisationChanged({gradientChoice: $event})
+                        "
                       >
                         <q-tooltip
                           ><span v-text="$t('toggle_gradient')"></span
@@ -463,6 +470,9 @@
                         flat
                         round
                         v-model="g.darkChoice"
+                        @update:model-value="
+                          siteCustomisationChanged({darkChoice: $event})
+                        "
                         :icon="$q.dark.isActive ? 'brightness_3' : 'wb_sunny'"
                         size="sm"
                       >
@@ -481,6 +491,9 @@
                         v-model="g.borderChoice"
                         :options="borderOptions"
                         label="Borders"
+                        @update:model-value="
+                          siteCustomisationChanged({borderChoice: $event})
+                        "
                       >
                         <q-tooltip
                           ><span v-text="$t('border_choices')"></span
@@ -508,6 +521,9 @@
                         v-model="g.reactionChoice"
                         :options="reactionOptions"
                         label="Reactions"
+                        @update:model-value="
+                          siteCustomisationChanged({reactionChoice: $event})
+                        "
                       >
                         <q-tooltip
                           ><span v-text="$t('payment_reactions')"></span
@@ -515,6 +531,17 @@
                       </q-select>
                     </div>
                   </div>
+                  <q-card-section>
+                    <q-btn
+                      @click="
+                        siteCustomisationChanged(defaultSiteCustomisation)
+                      "
+                      :label="$t('reset_defaults')"
+                      filled
+                      color="primary"
+                      class="float-right q-mb-md"
+                    ></q-btn>
+                  </q-card-section>
                 </q-tab-panel>
                 <q-tab-panel name="notifications">
                   <q-card-section>
@@ -941,7 +968,7 @@
                                 v-if="props.row.thumbnail_base64"
                                 target="_blank"
                                 style="color: inherit"
-                                :href="`/api/v1/assets/${props.row.id}/binary`"
+                                :href="`/api/v1/assets/${props.row.id}/data`"
                               >
                                 <q-img
                                   :src="

lnbits/templates/pages/extensions.vue

@@ -15,6 +15,7 @@
               <q-space></q-space>
 
               <q-input
+                v-if="$q.screen.gt.sm"
                 :label="$t('search_extensions')"
                 :dense="dense"
                 class="float-right q-pr-xl"
@@ -33,6 +34,14 @@
                   </q-icon>
                 </template>
               </q-input>
+              <q-btn
+                v-else
+                flat
+                icon="search"
+                @click="searchToggle = !searchToggle"
+                class="q-mr-md"
+              >
+              </q-btn>
               <q-badge
                 v-if="g.user.admin && updatableExtensions?.length"
                 @click="showUpdateAllDialog = true"
@@ -68,6 +77,25 @@
                 ><q-tooltip v-text="$t('admin_settings')"></q-tooltip
               ></q-btn>
             </q-tabs>
+            <div v-if="$q.screen.lt.sm && searchToggle" class="q-pa-sm">
+              <q-input
+                :label="$t('search_extensions')"
+                dense
+                class=""
+                v-model="searchTerm"
+                autofocus
+              >
+                <template v-slot:append>
+                  <q-icon
+                    v-if="searchTerm !== ''"
+                    name="close"
+                    @click="searchTerm = ''"
+                    class="cursor-pointer"
+                  >
+                  </q-icon>
+                </template>
+              </q-input>
+            </div>
           </div>
         </div>
       </q-card>
@@ -135,7 +163,22 @@
                 v-text="extension.name"
               ></div>
               <div style="justify-content: space-between; display: flex">
-                <lnbits-extension-rating :rating="0" />
+                <lnbits-extension-rating
+                  :rating="
+                    formatAvg(
+                      extension.reviewStats
+                        ? extension.reviewStats.avg_rating
+                        : 0
+                    )
+                  "
+                  :count="
+                    extension.reviewStats
+                      ? extension.reviewStats.review_count
+                      : null
+                  "
+                  :clickable="!!reviewsUrl"
+                  @click="openReviews(extension)"
+                />
                 <q-btn-group size="xs" style="margin: 5px 0">
                   <q-btn
                     v-if="extension.hasFreeRelease"
@@ -970,8 +1013,20 @@
           </div>
           <div class="col-sm-12 col-md-4 q-pl-sm">
             <lnbits-extension-rating
-              :rating="0"
-              size="2.5em"
+              :rating="
+                formatAvg(
+                  selectedExtension && selectedExtension.reviewStats
+                    ? selectedExtension.reviewStats.avg_rating
+                    : 0
+                )
+              "
+              :count="
+                selectedExtension && selectedExtension.reviewStats
+                  ? selectedExtension.reviewStats.review_count
+                  : null
+              "
+              :clickable="!!reviewsUrl"
+              @click="openReviews(selectedExtension)"
             ></lnbits-extension-rating>
             <div class="q-mt-md">
               <b>
@@ -1029,6 +1084,182 @@
       </q-card-section>
     </q-card>
   </q-dialog>
+  <q-dialog v-model="reviewsDialog.show" position="top">
+    <q-card
+      class="q-pa-md lnbits__dialog-card"
+      style="width: 900px; max-width: 95vw"
+    >
+      <q-card-section class="q-gutter-y-sm">
+        <div class="row items-center">
+          <div class="col">
+            <div
+              class="text-h6"
+              v-text="
+                (reviewsDialog.extension && reviewsDialog.extension.name) ||
+                (reviewsDialog.extension && reviewsDialog.extension.id)
+              "
+            ></div>
+            <div
+              class="text-caption text-grey"
+              v-text="reviewsDialog.extension && reviewsDialog.extension.id"
+            ></div>
+          </div>
+          <div class="col-auto">
+            <lnbits-extension-rating
+              :rating="
+                formatAvg(
+                  reviewsDialog.extension && reviewsDialog.extension.reviewStats
+                    ? reviewsDialog.extension.reviewStats.avg_rating
+                    : 0
+                )
+              "
+              :count="
+                reviewsDialog.extension && reviewsDialog.extension.reviewStats
+                  ? reviewsDialog.extension.reviewStats.review_count
+                  : null
+              "
+            ></lnbits-extension-rating>
+          </div>
+        </div>
+      </q-card-section>
+      <q-separator></q-separator>
+      <q-card-section v-if="!reviewsUrl">
+        <div
+          class="text-negative"
+          v-text="$t('reviews_url_not_configured')"
+        ></div>
+      </q-card-section>
+      <q-card-section v-else>
+        <div v-if="reviewsDialog.loading" class="row justify-center q-pa-lg">
+          <q-spinner-bars color="primary" size="2.55em"></q-spinner-bars>
+        </div>
+        <div v-else>
+          <div v-if="reviewsDialog.error" class="text-negative q-mb-md">
+            <span v-text="reviewsDialog.error"></span>
+          </div>
+
+          <q-form @submit="submitReview" class="q-gutter-md">
+            <div class="row q-col-gutter-lg">
+              <div class="col-12 col-md-6">
+                <q-input
+                  dense
+                  filled
+                  v-model="reviewsDialog.form.name"
+                  :label="$t('reviews_name')"
+                ></q-input>
+              </div>
+              <div class="col-12 col-md-6">
+                <q-rating
+                  v-model="reviewsDialog.form.rating"
+                  max="10"
+                  icon="star_border"
+                  icon-selected="star"
+                  icon-half="star_half"
+                  color="primary"
+                  class="float-right"
+                ></q-rating>
+              </div>
+              <div class="col-12 col-md-6">
+                <q-input
+                  dense
+                  filled
+                  type="textarea"
+                  autogrow
+                  v-model="reviewsDialog.form.comment"
+                  :label="$t('reviews_comment')"
+                ></q-input>
+              </div>
+
+              <div class="col-12 col-md-6">
+                <q-btn
+                  type="submit"
+                  color="primary"
+                  class="float-right"
+                  unelevated
+                  :loading="reviewsDialog.submitting"
+                  :disable="!reviewsDialog.form.rating"
+                  :label="$t('reviews_submit')"
+                ></q-btn>
+              </div>
+            </div>
+          </q-form>
+          <q-separator class="q-my-md"></q-separator>
+          <div class="row q-col-gutter-lg">
+            <div class="col-12">
+              <div v-if="reviews.length === 0" class="text-grey q-mb-md">
+                <span v-text="$t('no_reviews')"></span>
+              </div>
+              <div v-else>
+                <q-table
+                  :rows="reviews"
+                  :columns="reviewsTable.columns"
+                  v-model:pagination="reviewsTable.pagination"
+                  @request="getTagReviews"
+                  :loading="reviewsTable.loading"
+                  row-key="name"
+                  :filter="reviewsTable.search"
+                >
+                  <template v-slot:body="props">
+                    <q-tr :props="props">
+                      <q-td key="name" :props="props">
+                        <span v-text="props.row.name"></span>
+                      </q-td>
+                      <q-td key="comment" :props="props">
+                        <span v-text="props.row.comment"></span>
+                      </q-td>
+                      <q-td key="created_at" :props="props">
+                        <span
+                          v-text="formatReviewDate(props.row.created_at)"
+                        ></span>
+                      </q-td>
+                      <q-td key="rating" :props="props">
+                        <q-rating
+                          class="float-right q-pt-xs"
+                          readonly
+                          icon="star_border"
+                          icon-selected="star"
+                          icon-half="star_half"
+                          :model-value="formatAvg(props.row.rating)"
+                          size="sm"
+                          color="secondary"
+                        ></q-rating>
+                      </q-td>
+                    </q-tr>
+                  </template>
+                </q-table>
+              </div>
+            </div>
+          </div>
+        </div>
+      </q-card-section>
+      <q-separator v-if="reviews.length"></q-separator>
+      <q-card-section>
+        <q-btn
+          @click="reviewsDialog.show = false"
+          color="grey"
+          outline
+          class="float-right"
+          :label="$t('close')"
+        ></q-btn>
+      </q-card-section>
+    </q-card>
+  </q-dialog>
+  <q-dialog v-model="paymentDialog.show" position="top">
+    <q-card class="q-pa-md lnbits__dialog-card">
+      <q-card-section>
+        <q-responsive :ratio="1" class="q-mx-xl q-mb-xl">
+          <lnbits-qrcode
+            :value="paymentDialog.invoice"
+            :options="{width: 800}"
+            class="rounded-borders"
+          ></lnbits-qrcode>
+        </q-responsive>
+      </q-card-section>
+      <q-card-actions align="between">
+        <q-btn v-close-popup flat color="grey" :label="$t('close')"></q-btn>
+      </q-card-actions>
+    </q-card>
+  </q-dialog>
   <q-dialog v-model="showUpdateAllDialog" position="top">
     <q-card class="q-pa-md q-pt-md lnbits__dialog-card">
       <div class="row">

lnbits/templates/pages/users.vue

@@ -656,7 +656,20 @@
                   </q-btn>
                   <span v-text="shortify(props.row.id)"></span>
                 </q-td>
-                <q-td v-text="props.row.username"></q-td>
+                <q-td>
+                  <q-btn
+                    icon="face"
+                    size="sm"
+                    flat
+                    class="cursor-pointer q-mr-xs"
+                    @click="impersonateUser(props.row.id)"
+                  >
+                    <q-tooltip
+                      ><span v-text="$t('start_user_impersonation')"></span
+                    ></q-tooltip>
+                  </q-btn>
+                  <span v-text="props.row.username"></span>
+                </q-td>
 
                 <q-td v-text="props.row.email"></q-td>