Merge branch 'dev' into trans_exts

feat: add visibility toggle to inputs (#3940 )
Co-authored-by: Arc <ben@arc.wales>
2026-05-22 14:15:17 +01:00 · 2026-05-22 14:14:19 +01:00 · 2026-05-22 14:04:46 +01:00 · 2026-05-22 13:56:06 +03:00 · 2026-05-22 12:37:51 +03:00 · 2026-05-21 12:44:23 +02:00
85 changed files with 11457 additions and 26825 deletions
@@ -7,14 +7,20 @@
 # They are NOT managed by the Admin UI and are not stored in the database.

 # === First Install Token ===
-# if set the user is required to enter this token on the /first_install page
+# If set the user is required to enter this token on the /first_install page
 # FIRST_INSTALL_TOKEN="myaccesstoken"

+# === Security ===
+# When enabled (recommended), auth cookies require HTTPS and SSO will reject insecure HTTP.
+AUTH_HTTPS_ONLY=true
+
 # === Logging and Development ===

 DEBUG=False
 DEBUG_DATABASE=False
 BUNDLE_ASSETS=True
+# add `?profiler=true` to the url to enable the profiler for that request
+PROFILER=False

 # logging into LNBITS_DATA_FOLDER/logs/
 ENABLE_LOG_TO_FILE=true
@@ -113,6 +119,8 @@ LNBITS_SITE_TAGLINE="Open Source Lightning Payments Platform"
 LNBITS_SITE_DESCRIPTION="The world's most powerful suite of bitcoin tools. Run for yourself, for others, or as part of a stack."
 # Choose from bitcoin, mint, flamingo, freedom, salvador, autumn, monochrome, classic, cyber
 LNBITS_THEME_OPTIONS="classic, bitcoin, flamingo, freedom, mint, autumn, monochrome, salvador, cyber"
+# Toggle the background styling on burger menus / drawers
+# LNBITS_DEFAULT_BURGER_MENU_BACKGROUND=true
 # LNBITS_CUSTOM_LOGO="https://lnbits.com/assets/images/logo/logo.svg"

 ######################################
@@ -0,0 +1 @@
+min-release-age=7
@@ -0,0 +1,60 @@
+# AGENTS.md - AI Coding Agent Guide for LNbits
+
+This file guides AI coding agents working on LNbits. Keep changes small, verified, and aligned with existing project patterns.
+
+## Core Behavior
+
+- Think before coding. State material assumptions. Ask when ambiguity affects correctness, security, payments, wallets, or data migrations.
+- Prefer the simplest implementation that solves the request.
+- Make surgical changes. Every changed line should trace back to the task.
+- Do not refactor, reformat, rename, or clean adjacent code unless required.
+- Remove only dead code or imports created by your own changes.
+- Define success criteria for non-trivial work and verify them before reporting done.
+
+## LNbits Architecture
+
+- Keep core lean. Prefer/assess extensions for non-core features.
+- Preserve compatibility with existing extensions and wallet backends.
+- Follow existing patterns in `lnbits/core`, `lnbits/wallets`, `lnbits/extensions`, and frontend code.
+- Use existing CRUD, services, settings, and migration patterns.
+- Do not edit generated files, bundled vendor files, or unrelated extension code.
+
+## Security-Sensitive Areas
+
+Be extra cautious with payments, wallet balances, admin routes, keys, LNURL, Bolt11, funding sources, migrations, and authentication.
+
+Do not expose raw stack traces or sensitive values. Do not add synchronous blocking work in hot async paths without justification.
+
+## Commands and Verification
+
+Read `Makefile` before running project commands.
+
+Use Makefile targets instead of hand-written commands when available:
+
+- `make check` for full checks.
+- `make test-unit` for unit tests.
+- `make test-api` for API tests.
+- `make test-wallets` for wallet tests.
+- `make checkbundle` when bundled frontend assets may be affected.
+- `make format` only when formatting is intended.
+
+Do not run `make test` by default. Use the targeted tests available in the Makefile that are related to the work done, unless the user explicitly asks for broader test coverage.
+
+## Dependencies
+
+Do not add dependencies without approval. If approved, update the correct project files and explain why the dependency is necessary.
+
+## Maintenance
+
+LNbits maintainers own this file. They should update it when the development workflow, architecture, or verification commands materially change.
+
+Do not edit, commit, push, or include changes to this file in a PR as part of normal feature work unless the user explicitly asks for `AGENTS.md` changes.
+
+## Reporting
+
+When finished, report:
+
+- Summary of what changed.
+- Files touched.
+- Makefile targets or checks run.
+- Anything not verified and why.
@@ -1,12 +1,12 @@
 <a href="https://lnbits.com" target="_blank" rel="noopener noreferrer">
  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://i.imgur.com/QE6SIrs.png">
-    <img src="https://i.imgur.com/fyKPgVT.png" alt="LNbits" style="width:300px">
+    <source media="(prefers-color-scheme: dark)" srcset="docs/logos/lnbits-full-inverse.svg">
+    <img src="docs/logos/lnbits-full.svg" alt="LNbits" style="width:300px">
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) [<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)  
-<img width="2000" height="203" alt="lnbits_head" src="https://github.com/user-attachments/assets/77669718-ac10-43c7-ae95-6ce236c77401" />  
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)  
+<img alt="lnbits_head" src="docs/assets/header.jpg" />  
 [![tip-hero](https://img.shields.io/badge/TipJar-LNBits%20Hero-9b5cff?labelColor=6b7280&logo=lightning&logoColor=white)](https://demo.lnbits.com/tipjar/DwaUiE4kBX6mUW6pj3X5Kg)

 # LNbits — The most powerful Bitcoin & Lightning toolkit
@@ -46,7 +46,7 @@ Get yourself familiar and test on our demo server [demo.lnbits.com](https://demo

 LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending, export to csv. Each wallet also comes with its own API keys, to help partition the exposure of your funding source.

-<img src="https://i.imgur.com/w8jdGpF.png" style="width:800px">
+<img alt="lnbits_wallet" src="docs/assets/wallet.jpg" />

 ## LNbits extension universe

@@ -54,25 +54,25 @@ Extend YOUR LNbits to meet YOUR needs.

 All non-core features are installed as extensions, reducing your code base and making your LNbits unique to you. Extend your LNbits install in any direction, and even create and share your own extensions.

-<img src="https://i.imgur.com/aEBpwJF.png" style="width:800px">
+<img alt="lnbits_extensions" src="docs/assets/extensions.jpg" />

 ## LNbits API

 LNbits has a powerful API, many projects use LNbits to do the heavy lifting for their bitcoin/lightning services.

-<img src="https://i.imgur.com/V742sb9.png" style="width:800px">
+<img alt="lnbits_api" src="docs/assets/api.jpg" />

 ## LNbits node manager

 LNbits comes packaged with a light node management UI, to make running your node that much easier.

-<img src="https://i.imgur.com/TYqIK60.png" style="width:800px">
+<img alt="lnbits_api" src="docs/assets/lightning_node.jpg" />

-## LNbits across all your devices
+## LNbits merchant tools

-As well as working great in a browser, LNbits has native IoS and Android apps as well as a chrome extension. So you can enjoy the same UI across ALL your devices.
+The LNbits stack can process both bitcoin and fiat payments, making it a turnkey, all-in-one solution for merchants. With orders and inventory shared across extensions, and built-in notifications for Nostr, Telegram, and email, LNbits keeps everything in sync, freeing merchants to focus on their business.

-<img src="https://i.imgur.com/J96EbRf.png" style="width:800px">
+<img alt="lnbits_merchants" src="docs/assets/merchants_small.webp" />

 ## Powered by LNbits

@@ -14,7 +14,6 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
-[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNBits Admin UI

@@ -14,7 +14,6 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
-[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend Wallet Comparison Table

@@ -11,7 +11,7 @@ nav_order: 1
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) <img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)

 # Basic installation

@@ -14,7 +14,6 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
-[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Super User (SU)

@@ -14,7 +14,6 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
-[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Roles: A Quick Overview

@@ -14,7 +14,6 @@ nav_order: 3
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
-[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend wallets

@@ -65,6 +65,7 @@ from .middleware import (
    InstalledExtensionMiddleware,
    add_first_install_middleware,
    add_ip_block_middleware,
+    add_profiler_middleware,
    add_ratelimit_middleware,
 )
 from .tasks import internal_invoice_listener, invoice_listener, run_interval
@@ -196,6 +197,9 @@ def create_app() -> FastAPI:

    register_exception_handlers(app)

+    if settings.profiler:
+        add_profiler_middleware(app)
+
    return app


@@ -292,6 +292,7 @@ async def create_payment(
        tag=extra.get("tag", None),
        extra=extra,
        labels=data.labels or [],
+        external_id=data.external_id,
    )

    await (conn or db).insert("apipayments", payment)
@@ -802,3 +802,16 @@ async def m044_add_activated_to_accounts(db: Connection):
    Used for account activation status.
    """
    await db.execute("ALTER TABLE accounts ADD COLUMN activated BOOLEAN DEFAULT true")
+
+
+async def m045_add_external_id_to_payments(db: Connection):
+    """
+    Adds external_id column to apipayments.
+    Used for external payment references.
+    """
+    await db.execute("ALTER TABLE apipayments ADD COLUMN external_id TEXT")
+    logger.debug("Creating index idx_payments_external_id...")
+    await db.execute("""
+        CREATE INDEX IF NOT EXISTS idx_payments_external_id
+        ON apipayments (external_id);
+        """)
@@ -13,6 +13,7 @@ from lnbits.db import FilterModel
 from lnbits.fiat.base import (
    FiatPaymentStatus,
 )
+from lnbits.helpers import is_valid_external_id
 from lnbits.utils.exchange_rates import allowed_currencies
 from lnbits.wallets.base import (
    PaymentStatus,
@@ -53,6 +54,11 @@ class CreatePayment(BaseModel):
    webhook: str | None = None
    fee: int = 0
    labels: list[str] | None = None
+    external_id: str | None = None
+
+    @validator("external_id")
+    def validate_external_id(cls, external_id):
+        return _validate_external_id(external_id)


 class Payment(BaseModel):
@@ -77,6 +83,11 @@ class Payment(BaseModel):
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    labels: list[str] = []
    extra: dict = {}
+    external_id: str | None = None
+
+    @validator("external_id")
+    def validate_external_id(cls, external_id):
+        return _validate_external_id(external_id)

    def __init__(self, **data):
        super().__init__(**data)
@@ -151,6 +162,7 @@ class PaymentFilters(FilterModel):
        "status",
        "time",
        "labels",
+        "external_id",
    ]

    __sort_fields__ = [
@@ -161,11 +173,13 @@ class PaymentFilters(FilterModel):
        "memo",
        "time",
        "tag",
+        "external_id",
    ]

    status: str | None
    tag: str | None
    checking_id: str | None
+    external_id: str | None
    amount: int
    fee: int
    memo: str | None
@@ -249,6 +263,7 @@ class CreateInvoice(BaseModel):
    lnurl_withdraw: LnurlWithdrawResponse | None = None
    fiat_provider: str | None = None
    labels: list[str] = []
+    external_id: str | None = Query(default=None, max_length=256)

    @validator("payment_hash")
    def check_hex(cls, v):
@@ -263,6 +278,10 @@ class CreateInvoice(BaseModel):
            raise ValueError("The provided unit is not supported")
        return v

+    @validator("external_id")
+    def validate_external_id(cls, external_id):
+        return _validate_external_id(external_id)
+

 class PaymentsStatusCount(BaseModel):
    incoming: int = 0
@@ -301,3 +320,12 @@ class CancelInvoice(BaseModel):

 class UpdatePaymentLabels(BaseModel):
    labels: list[str] = []
+
+
+def _validate_external_id(external_id: str | None) -> str | None:
+    if external_id and not is_valid_external_id(external_id):
+        raise ValueError(
+            "Invalid external id. Max length is 256 characters. "
+            "Space and newlines are not allowed."
+        )
+    return external_id
@@ -1,7 +1,9 @@
 import base64
 import io
+from urllib.parse import quote
 from uuid import uuid4

+import filetype
 from fastapi import UploadFile
 from loguru import logger
 from PIL import Image
@@ -10,11 +12,48 @@ from lnbits.core.crud.assets import create_asset, get_user_assets_count
 from lnbits.core.models.assets import Asset
 from lnbits.settings import settings

+IMAGE_MIME_TYPE_ALIASES = {
+    "heic": "image/heic",
+    "heics": "image/heics",
+    "heif": "image/heif",
+    "image/jpg": "image/jpeg",
+    "jpeg": "image/jpeg",
+    "jpg": "image/jpeg",
+    "png": "image/png",
+}
+PIL_IMAGE_FORMAT_MIME_TYPES = {
+    "JPEG": "image/jpeg",
+    "PNG": "image/png",
+}
+INLINE_ASSET_MIME_TYPES = {
+    "image/heic",
+    "image/heics",
+    "image/heif",
+    "image/jpeg",
+    "image/png",
+}
+ASSET_SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "Content-Security-Policy": (
+        "sandbox; default-src 'none'; script-src 'none'; "
+        "object-src 'none'; base-uri 'none'"
+    ),
+}
+THUMBNAIL_FORMAT_MIME_TYPES = {
+    "jpg": "image/jpeg",
+    "jpeg": "image/jpeg",
+    "png": "image/png",
+}
+

 async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) -> Asset:
    if not file.content_type:
        raise ValueError("File must have a content type.")
-    if file.content_type.lower() not in settings.lnbits_assets_allowed_mime_types:
+
+    content_type = normalize_asset_mime_type(file.content_type)
+    filename = file.filename or "unnamed"
+
+    if content_type not in allowed_asset_mime_types():
        raise ValueError(f"File type '{file.content_type}' not allowed.")

    if not settings.is_unlimited_assets_user(user_id):
@@ -30,14 +69,26 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
            f"File limit of {settings.lnbits_max_asset_size_mb}MB exceeded."
        )

+    stored_mime_type = detect_image_mime_type(contents)
+    if stored_mime_type != content_type:
+        logger.warning(
+            "Image MIME type mismatch: declared={}, detected={}",
+            content_type,
+            stored_mime_type,
+        )
+        raise ValueError(
+            "Image file content does not match declared file type. "
+            f"Declared: '{content_type}', detected: '{stored_mime_type}'."
+        )
+
    thumb_buffer = thumbnail_from_bytes(contents)

    asset = Asset(
        id=uuid4().hex,
        user_id=user_id,
-        mime_type=file.content_type,
+        mime_type=stored_mime_type,
        is_public=is_public,
-        name=file.filename or "unnamed",
+        name=filename,
        size_bytes=len(contents),
        thumbnail_base64=(
            base64.b64encode(thumb_buffer.getvalue()).decode("utf-8")
@@ -51,6 +102,79 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
    return asset


+def normalize_asset_mime_type(content_type: str) -> str:
+    content_type = content_type.split(";", 1)[0].strip().lower()
+    return IMAGE_MIME_TYPE_ALIASES.get(content_type, content_type)
+
+
+def normalize_media_type(media_type: str) -> str:
+    return media_type.split(";", 1)[0].strip().lower() or "application/octet-stream"
+
+
+def thumbnail_media_type() -> str:
+    thumbnail_format = (settings.lnbits_asset_thumbnail_format or "png").strip().lower()
+    return THUMBNAIL_FORMAT_MIME_TYPES.get(thumbnail_format, "application/octet-stream")
+
+
+def content_disposition(disposition: str, filename: str) -> str:
+    safe_filename = filename or "unnamed"
+    quoted_filename = quote(safe_filename, safe="")
+    if quoted_filename == safe_filename:
+        return f'{disposition}; filename="{safe_filename}"'
+    return f"{disposition}; filename*=utf-8''{quoted_filename}"
+
+
+def allowed_asset_mime_types() -> set[str]:
+    return {
+        mime_type
+        for mime_type in (
+            normalize_asset_mime_type(mime_type)
+            for mime_type in settings.lnbits_assets_allowed_mime_types
+        )
+        if mime_type.startswith("image/")
+    }
+
+
+def detect_image_mime_type(contents: bytes) -> str:
+    kind = filetype.guess(contents)
+    mime_type = normalize_asset_mime_type(kind.mime) if kind else None
+
+    if mime_type and mime_type in PIL_IMAGE_FORMAT_MIME_TYPES.values():
+        verify_pil_image(contents, mime_type)
+        return mime_type
+
+    if mime_type and mime_type.startswith("image/"):
+        return mime_type
+
+    try:
+        with Image.open(io.BytesIO(contents)) as image:
+            image.verify()
+            mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
+    except Exception as exc:
+        raise ValueError(
+            "Image file content does not match declared file type."
+        ) from exc
+
+    if not mime_type:
+        raise ValueError("Image file content does not match declared file type.")
+
+    return mime_type
+
+
+def verify_pil_image(contents: bytes, mime_type: str) -> None:
+    try:
+        with Image.open(io.BytesIO(contents)) as image:
+            image.verify()
+            detected_mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
+    except Exception as exc:
+        raise ValueError(
+            "Image file content does not match declared file type."
+        ) from exc
+
+    if detected_mime_type != mime_type:
+        raise ValueError("Image file content does not match declared file type.")
+
+
 def thumbnail_from_bytes(contents: bytes) -> io.BytesIO | None:
    try:
        image = Image.open(io.BytesIO(contents))
@@ -2,6 +2,7 @@ import hashlib
 import hmac
 import json
 import time
+from base64 import b64encode

 import httpx
 from loguru import logger
@@ -169,6 +170,82 @@ async def verify_paypal_webhook(headers, payload: bytes):
        raise ValueError("PayPal webhook cannot be verified.") from exc


+def check_square_signature(
+    payload: bytes,
+    sig_header: str | None,
+    secret: str | None,
+    notification_url: str | None,
+):
+    if not sig_header:
+        logger.warning("Square signature header is missing.")
+        raise ValueError("Square signature header is missing.")
+
+    if not secret:
+        logger.warning("Square webhook signature key is not set.")
+        raise ValueError("Square webhook cannot be verified.")
+
+    if not notification_url:
+        logger.warning("Square webhook notification URL is not set.")
+        raise ValueError("Square webhook cannot be verified.")
+
+    signed_payload = notification_url.encode() + payload
+    computed_signature = b64encode(
+        hmac.new(
+            key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
+        ).digest()
+    ).decode()
+
+    if hmac.compare_digest(computed_signature, sig_header) is not True:
+        logger.warning("Square signature verification failed.")
+        raise ValueError("Square signature verification failed.")
+
+
+def check_revolut_signature(
+    payload: bytes,
+    sig_header: str | None,
+    timestamp_header: str | None,
+    secret: str | None,
+    tolerance_seconds=300,
+):
+    if not sig_header:
+        logger.warning("Revolut signature header is missing.")
+        raise ValueError("Revolut signature header is missing.")
+
+    if not timestamp_header:
+        logger.warning("Revolut timestamp header is missing.")
+        raise ValueError("Revolut timestamp header is missing.")
+
+    if not secret:
+        logger.warning("Revolut webhook signing secret is not set.")
+        raise ValueError("Revolut webhook cannot be verified.")
+
+    try:
+        timestamp = int(timestamp_header)
+    except ValueError as exc:
+        logger.warning("Invalid Revolut timestamp.")
+        raise ValueError("Invalid Revolut timestamp.") from exc
+
+    timestamp_seconds = timestamp / 1000 if timestamp > 9999999999 else timestamp
+
+    if abs(time.time() - timestamp_seconds) > tolerance_seconds:
+        logger.warning("Timestamp outside tolerance.")
+        raise ValueError("Timestamp outside tolerance." f"Timestamp: {timestamp}")
+
+    signed_payload = b"v1." + timestamp_header.encode() + b"." + payload
+    digest = hmac.new(
+        key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
+    ).hexdigest()
+    expected_signature = f"v1={digest}"
+
+    provided_signatures = [sig.strip() for sig in sig_header.split(",") if sig.strip()]
+    if not any(
+        hmac.compare_digest(expected_signature, provided)
+        for provided in provided_signatures
+    ):
+        logger.warning("Revolut signature verification failed.")
+        raise ValueError("Revolut signature verification failed.")
+
+
 async def test_connection(provider: str) -> SimpleStatus:
    """
    Test the connection to Stripe by checking if the API key is valid.
@@ -64,6 +64,7 @@ async def pay_invoice(
    description: str = "",
    tag: str = "",
    labels: list[str] | None = None,
+    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if settings.lnbits_only_allow_incoming_payments:
@@ -97,6 +98,7 @@ async def pay_invoice(
            memo=description or invoice.description or "",
            extra=extra,
            labels=labels,
+            external_id=external_id,
        )

    async with db.reuse_conn(conn) if conn else db.connect() as new_conn:
@@ -217,6 +219,7 @@ async def create_wallet_invoice(wallet_id: str, data: CreateInvoice) -> Payment:
            internal=data.internal,
            payment_hash=data.payment_hash,
            labels=data.labels,
+            external_id=data.external_id,
            conn=conn,
        )

@@ -258,6 +261,7 @@ async def create_invoice(
    internal: bool | None = False,
    payment_hash: str | None = None,
    labels: list[str] | None = None,
+    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if not amount > 0:
@@ -342,6 +346,7 @@ async def create_invoice(
        webhook=webhook,
        fee=invoice_response.fee_msat or 0,
        labels=labels,
+        external_id=external_id,
    )

    payment = await create_payment(
@@ -16,7 +16,14 @@ from lnbits.core.crud.assets import (
 from lnbits.core.models.assets import AssetFilters, AssetInfo, AssetUpdate
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.users import AccountId
-from lnbits.core.services.assets import create_user_asset
+from lnbits.core.services.assets import (
+    ASSET_SECURITY_HEADERS,
+    INLINE_ASSET_MIME_TYPES,
+    content_disposition,
+    create_user_asset,
+    normalize_media_type,
+    thumbnail_media_type,
+)
 from lnbits.db import Filters, Page
 from lnbits.decorators import (
    check_account_id_exists,
@@ -75,11 +82,7 @@ async def api_get_asset_data(
    if not asset:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return Response(
-        content=asset.data,
-        media_type=asset.mime_type,
-        headers={"Content-Disposition": f'inline; filename="{asset.name}"'},
-    )
+    return asset_response(asset.data, asset.mime_type, asset.name)


@asset_router.get(
@@ -101,14 +104,14 @@ async def api_get_asset_thumbnail(
    if not asset_info:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return Response(
+    return asset_response(
        content=(
            base64.b64decode(asset_info.thumbnail_base64)
            if asset_info.thumbnail_base64
            else b""
        ),
-        media_type=asset_info.mime_type,
-        headers={"Content-Disposition": f'inline; filename="{asset_info.name}"'},
+        media_type=thumbnail_media_type(),
+        filename=asset_info.name,
    )


@@ -172,3 +175,16 @@ async def api_delete_asset(

    await delete_user_asset(account_id.id, asset_id)
    return SimpleStatus(success=True, message="Asset deleted successfully.")
+
+
+def asset_response(content: bytes, media_type: str, filename: str) -> Response:
+    media_type = normalize_media_type(media_type)
+    disposition = "inline" if media_type in INLINE_ASSET_MIME_TYPES else "attachment"
+    return Response(
+        content=content,
+        media_type=media_type,
+        headers={
+            **ASSET_SECURITY_HEADERS,
+            "Content-Disposition": content_disposition(disposition, filename),
+        },
+    )
@@ -348,7 +348,11 @@ async def handle_oauth_token(request: Request, provider: str) -> RedirectRespons
        userinfo = await provider_sso.verify_and_process(request)
        if not userinfo:
            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid user info.")
-        user_id = decrypt_internal_message(provider_sso.state)
+        if provider_sso.state is None or provider_sso.state == "null":
+            user_id = None
+        else:
+            user_id = decrypt_internal_message(provider_sso.state)
+
    request.session.pop("user", None)
    return await _handle_sso_login(userinfo, user_id)

@@ -4,17 +4,30 @@ from fastapi import APIRouter, Request
 from loguru import logger

 from lnbits.core.crud.payments import (
+    get_payments,
    get_standalone_payment,
+    update_payment,
 )
+from lnbits.core.models import Payment, PaymentFilters
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.payments import CreateInvoice
 from lnbits.core.services.fiat_providers import (
    check_fiat_status,
+    check_revolut_signature,
+    check_square_signature,
    check_stripe_signature,
    verify_paypal_webhook,
 )
-from lnbits.core.services.payments import create_fiat_invoice
+from lnbits.core.services.payments import (
+    create_fiat_invoice,
+    create_wallet_invoice,
+    service_fee_fiat,
+)
+from lnbits.db import Filter, Filters
+from lnbits.fiat import get_fiat_provider
 from lnbits.fiat.base import FiatSubscriptionPaymentOptions
+from lnbits.fiat.revolut import RevolutWallet
+from lnbits.fiat.square import SquareWallet
 from lnbits.settings import settings

 callback_router = APIRouter(prefix="/api/v1/callback", tags=["callback"])
@@ -50,6 +63,41 @@ async def api_generic_webhook_handler(
            message=f"Callback received successfully from '{provider_name}'.",
        )

+    if provider_name.lower() == "square":
+        payload = await request.body()
+        sig_header = request.headers.get("x-square-hmacsha256-signature")
+        check_square_signature(
+            payload,
+            sig_header,
+            settings.square_webhook_signature_key,
+            settings.square_payment_webhook_url,
+        )
+        event = await request.json()
+        await handle_square_event(event)
+
+        return SimpleStatus(
+            success=True,
+            message=f"Callback received successfully from '{provider_name}'.",
+        )
+
+    if provider_name.lower() == "revolut":
+        payload = await request.body()
+        sig_header = request.headers.get("Revolut-Signature")
+        timestamp_header = request.headers.get("Revolut-Request-Timestamp")
+        check_revolut_signature(
+            payload,
+            sig_header,
+            timestamp_header,
+            settings.revolut_webhook_signing_secret,
+        )
+        event = await request.json()
+        await handle_revolut_event(event)
+
+        return SimpleStatus(
+            success=True,
+            message=f"Callback received successfully from '{provider_name}'.",
+        )
+
    return SimpleStatus(
        success=False,
        message=f"Unknown fiat provider '{provider_name}'.",
@@ -280,3 +328,386 @@ def _deserialize_paypal_metadata(custom_id: str) -> FiatSubscriptionPaymentOptio
    except (json.JSONDecodeError, IndexError) as e:
        logger.warning(f"Failed to deserialize PayPal metadata: {e}")
        return FiatSubscriptionPaymentOptions()
+
+
+async def handle_square_event(event: dict):
+    event_id = event.get("event_id") or event.get("id", "")
+    event_type = event.get("type", "")
+    logger.info(f"Handling Square event: '{event_id}'. Type: '{event_type}'.")
+
+    if event_type == "payment.updated":
+        await _handle_square_payment_event(event)
+        return
+
+    if event_type == "invoice.payment_made":
+        await _handle_square_invoice_payment_made(event)
+        return
+
+    logger.warning(f"Unhandled Square event type: '{event_type}'.")
+
+
+async def handle_revolut_event(event: dict):
+    event_type = event.get("event", "")
+    order_id = event.get("order_id")
+    logger.info(f"Handling Revolut event: '{event_type}'. Order ID: '{order_id}'.")
+
+    if event_type in ["ORDER_AUTHORISED", "ORDER_COMPLETED"]:
+        if not order_id:
+            logger.warning("Revolut event missing order_id.")
+            return
+
+        payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
+        if not payment:
+            logger.warning(f"No payment found for Revolut order: '{order_id}'.")
+            await _handle_revolut_subscription_order_paid(order_id)
+            return
+
+        await check_fiat_status(payment)
+        return
+
+    if event_type == "SUBSCRIPTION_INITIATED":
+        await _handle_revolut_subscription_initiated(event)
+        return
+
+    if event_type in [
+        "SUBSCRIPTION_CANCELLED",
+        "SUBSCRIPTION_FINISHED",
+        "SUBSCRIPTION_OVERDUE",
+    ]:
+        logger.info(f"Revolut subscription lifecycle event received: '{event_type}'.")
+        return
+
+    logger.warning(f"Unhandled Revolut event type: '{event_type}'.")
+
+
+async def _handle_revolut_subscription_initiated(event: dict):
+    subscription_id = event.get("subscription_id")
+    if not subscription_id:
+        subscription_id = event.get("id")
+
+    if not subscription_id:
+        logger.warning("Revolut subscription event missing subscription_id.")
+        return
+
+    fiat_provider = await _get_revolut_provider()
+    if not fiat_provider:
+        return
+
+    subscription = await fiat_provider.get_subscription(subscription_id)
+    await _handle_revolut_subscription(subscription, fiat_provider)
+
+
+async def _get_revolut_provider() -> RevolutWallet | None:
+    fiat_provider = await get_fiat_provider("revolut")
+    if not isinstance(fiat_provider, RevolutWallet):
+        logger.warning("Revolut fiat provider is not configured.")
+        return None
+    return fiat_provider
+
+
+async def _handle_revolut_subscription(
+    subscription: dict, fiat_provider: RevolutWallet
+):
+    subscription_id = subscription.get("id")
+    if not subscription_id:
+        logger.warning("Revolut subscription missing id.")
+        return
+
+    reference = fiat_provider.deserialize_subscription_reference(
+        subscription.get("external_reference")
+    )
+    if not reference:
+        logger.warning("Revolut subscription event missing LNbits metadata.")
+        return
+
+    cycle_id = subscription.get("current_cycle_id")
+    if not cycle_id:
+        logger.warning("Revolut subscription missing current_cycle_id.")
+        return
+
+    cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
+    order_id = cycle.get("order_id")
+    if not order_id:
+        logger.warning("Revolut subscription cycle missing order_id.")
+        return
+
+    existing_payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
+    if existing_payment:
+        if existing_payment.external_id != subscription_id:
+            existing_payment.external_id = subscription_id
+            await update_payment(existing_payment)
+        await check_fiat_status(existing_payment)
+        return
+
+    order = await fiat_provider.get_order(order_id)
+    amount_minor = order.get("amount")
+    currency = (order.get("currency") or "").upper()
+    if amount_minor is None or not currency:
+        raise ValueError("Revolut subscription order missing amount or currency.")
+
+    extra = {
+        **(reference.extra or {}),
+        "subscription_request_id": reference.subscription_request_id,
+        "fiat_method": "subscription",
+        "tag": reference.tag,
+        "subscription": {
+            "checking_id": f"order_{order_id}",
+            "payment_request": order.get("checkout_url") or "",
+        },
+    }
+    lnbits_payment = await _create_revolut_subscription_payment(
+        wallet_id=reference.wallet_id,
+        amount_minor=amount_minor,
+        currency=currency,
+        memo=reference.memo or "",
+        extra=extra,
+        order_id=order_id,
+        payment_request=order.get("checkout_url") or "",
+        subscription_id=subscription_id,
+    )
+
+    await check_fiat_status(lnbits_payment)
+
+
+async def _handle_revolut_subscription_order_paid(order_id: str):
+    fiat_provider = await _get_revolut_provider()
+    if not fiat_provider:
+        return
+
+    order = await fiat_provider.get_order(order_id)
+    if order.get("type") != "payment" or order.get("state") != "completed":
+        logger.warning(f"Revolut order is not a completed payment: '{order_id}'.")
+        return
+
+    channel_data = order.get("channel_data") or {}
+    subscription_id = channel_data.get("subscription_id")
+    if not subscription_id:
+        logger.warning(f"Revolut order missing subscription_id: '{order_id}'.")
+        return
+
+    subscription = await fiat_provider.get_subscription(subscription_id)
+    if subscription.get("state") != "active":
+        logger.warning(f"Revolut subscription is not active: '{subscription_id}'.")
+        return
+
+    await _handle_revolut_subscription_initiated(subscription)
+
+
+async def _create_revolut_subscription_payment(
+    wallet_id: str,
+    amount_minor: int,
+    currency: str,
+    memo: str,
+    extra: dict,
+    order_id: str,
+    payment_request: str,
+    subscription_id: str,
+) -> Payment:
+    amount = RevolutWallet.minor_units_to_amount(amount_minor, currency)
+    payment = await create_wallet_invoice(
+        wallet_id,
+        CreateInvoice(
+            unit=currency,
+            amount=amount,
+            memo=memo,
+            extra=extra,
+            internal=True,
+            external_id=subscription_id,
+        ),
+    )
+    payment.fee = -abs(service_fee_fiat(payment.msat, "revolut"))
+    payment.fiat_provider = "revolut"
+    payment.extra["fiat_checking_id"] = f"order_{order_id}"
+    payment.extra["fiat_payment_request"] = payment_request
+    checking_id = f"fiat_revolut_order_{order_id}"
+    await update_payment(payment, checking_id)
+    payment.checking_id = checking_id
+    return payment
+
+
+async def _handle_square_payment_event(event: dict):
+    payment = _square_extract_payment(event)
+    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
+    if payment_options.wallet_id:
+        if not _square_payment_is_completed(payment):
+            logger.debug("Square subscription payment is not completed yet.")
+            return
+        await _handle_square_subscription_payment(payment, payment_options)
+        return
+
+    order_id = payment.get("order_id")
+    if not order_id:
+        logger.warning("Square payment event missing order_id.")
+        return
+
+    lnbits_payment = await get_standalone_payment(f"fiat_square_order_{order_id}")
+    if not lnbits_payment:
+        logger.warning(f"No payment found for Square order: '{order_id}'.")
+        return
+
+    await check_fiat_status(lnbits_payment)
+
+
+async def _handle_square_invoice_payment_made(event: dict):
+    invoice = event.get("data", {}).get("object", {}).get("invoice") or {}
+    order_id = invoice.get("order_id")
+    if not order_id:
+        logger.warning("Square invoice.payment_made event missing order_id.")
+        return
+    subscription_id = invoice.get("subscription_id")
+
+    fiat_provider = await get_fiat_provider("square")
+    if not isinstance(fiat_provider, SquareWallet):
+        logger.warning("Square fiat provider is not configured.")
+        return
+
+    payment = await fiat_provider.get_payment_for_order(order_id)
+    if not payment:
+        logger.warning(f"No Square payment found for invoice order: '{order_id}'.")
+        return
+
+    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
+    if not payment_options.wallet_id:
+        payment_id = payment.get("id")
+        stored_payment = (
+            await get_standalone_payment(f"fiat_square_payment_{payment_id}")
+            if payment_id
+            else None
+        )
+        if not stored_payment and subscription_id:
+            stored_payments = await get_payments(
+                filters=Filters(
+                    filters=[
+                        Filter.parse_query(
+                            "external_id", [subscription_id], PaymentFilters
+                        )
+                    ],
+                    model=PaymentFilters,
+                    sortby="created_at",
+                    direction="desc",
+                    limit=1,
+                )
+            )
+            stored_payment = stored_payments[0] if stored_payments else None
+        if stored_payment:
+            payment_options = _square_payment_options_from_payment(stored_payment)
+        else:
+            logger.warning("Square subscription payment missing LNbits metadata.")
+            return
+
+    await _handle_square_subscription_payment(
+        payment,
+        payment_options,
+        invoice.get("public_url") or "",
+        square_subscription_id=subscription_id,
+    )
+
+
+async def _handle_square_subscription_payment(
+    payment: dict,
+    payment_options: FiatSubscriptionPaymentOptions,
+    payment_request: str = "",
+    square_subscription_id: str | None = None,
+):
+    amount_money = payment.get("amount_money") or {}
+    amount = amount_money.get("amount")
+    currency = (amount_money.get("currency") or "").upper()
+    payment_id = payment.get("id")
+    if amount is None or not currency or not payment_id:
+        raise ValueError("Square subscription payment event missing payment amount.")
+    wallet_id = payment_options.wallet_id
+    if not wallet_id:
+        raise ValueError("Square subscription payment event missing wallet_id.")
+
+    checking_id = f"payment_{payment_id}"
+    existing_payment = await get_standalone_payment(f"fiat_square_{checking_id}")
+    if existing_payment:
+        if (
+            square_subscription_id
+            and existing_payment.external_id != square_subscription_id
+        ):
+            existing_payment.external_id = square_subscription_id
+            await update_payment(existing_payment)
+        await check_fiat_status(existing_payment)
+        return
+
+    square_subscription_id = square_subscription_id or (
+        payment_options.extra or {}
+    ).get("square_subscription_id")
+    extra = {
+        **(payment_options.extra or {}),
+        "subscription_request_id": payment_options.subscription_request_id,
+        "fiat_method": "subscription",
+        "tag": payment_options.tag,
+        "subscription": {
+            "checking_id": checking_id,
+            "payment_request": payment_request,
+        },
+    }
+
+    lnbits_payment = await create_fiat_invoice(
+        wallet_id=wallet_id,
+        invoice_data=CreateInvoice(
+            unit=currency,
+            amount=amount / 100,
+            memo=payment_options.memo or "",
+            extra=extra,
+            fiat_provider="square",
+            external_id=square_subscription_id,
+        ),
+    )
+
+    await check_fiat_status(lnbits_payment)
+
+
+def _square_payment_options_from_payment(
+    payment: Payment,
+) -> FiatSubscriptionPaymentOptions:
+    extra = payment.extra or {}
+    return FiatSubscriptionPaymentOptions(
+        wallet_id=payment.wallet_id,
+        tag=extra.get("tag") or payment.tag,
+        subscription_request_id=extra.get("subscription_request_id"),
+        extra=extra,
+        memo=payment.memo,
+    )
+
+
+def _square_extract_payment(event: dict) -> dict:
+    event_object = event.get("data", {}).get("object", {})
+    return event_object.get("payment") or event_object
+
+
+def _square_payment_is_completed(payment: dict) -> bool:
+    return (payment.get("status") or "").upper() == "COMPLETED"
+
+
+def _square_payment_note(payment: dict) -> str:
+    return payment.get("note") or payment.get("payment_note") or ""
+
+
+def _deserialize_square_metadata(custom_id: str) -> FiatSubscriptionPaymentOptions:
+    try:
+        meta = json.loads(custom_id)
+        if not isinstance(meta, list):
+            return FiatSubscriptionPaymentOptions()
+        wallet_id = meta[0] if len(meta) > 0 else None
+        tag = meta[1] if len(meta) > 1 else None
+        subscription_request_id = meta[2] if len(meta) > 2 else None
+        extra_link = meta[3] if len(meta) > 3 else None
+        memo = meta[4] if len(meta) > 4 else None
+
+        extra = {
+            "link": extra_link,
+            "subscription_request_id": subscription_request_id,
+        }
+
+        return FiatSubscriptionPaymentOptions(
+            wallet_id=wallet_id,
+            tag=tag,
+            subscription_request_id=subscription_request_id,
+            extra=extra,
+            memo=memo,
+        )
+    except (json.JSONDecodeError, IndexError, TypeError):
+        return FiatSubscriptionPaymentOptions()
@@ -2,17 +2,35 @@ from http import HTTPStatus

 from fastapi import APIRouter, Depends, HTTPException
 from loguru import logger
+from pydantic import BaseModel

+from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.wallets import WalletTypeInfo
+from lnbits.core.services import update_cached_settings
 from lnbits.core.services.fiat_providers import test_connection
 from lnbits.decorators import check_admin, require_admin_key
-from lnbits.fiat import StripeWallet, get_fiat_provider
+from lnbits.fiat import RevolutWallet, StripeWallet, get_fiat_provider
 from lnbits.fiat.base import CreateFiatSubscription, FiatSubscriptionResponse

 fiat_router = APIRouter(tags=["Fiat API"], prefix="/api/v1/fiat")


+class RevolutCreateWebhook(BaseModel):
+    url: str
+    endpoint: str | None = None
+    api_secret_key: str | None = None
+    api_version: str | None = None
+
+
+class RevolutCreateWebhookResponse(BaseModel):
+    id: str | None = None
+    url: str
+    events: list[str] = []
+    signing_secret: str
+    already_exists: bool = False
+
+
@fiat_router.put(
    "/check/{provider}",
    status_code=HTTPStatus.OK,
@@ -22,6 +40,54 @@ async def api_test_fiat_provider(provider: str) -> SimpleStatus:
    return await test_connection(provider)


+@fiat_router.post(
+    "/revolut/webhook",
+    status_code=HTTPStatus.OK,
+    dependencies=[Depends(check_admin)],
+)
+async def api_create_revolut_webhook(
+    data: RevolutCreateWebhook,
+) -> RevolutCreateWebhookResponse:
+    try:
+        webhook = await RevolutWallet.create_webhook(
+            url=data.url,
+            endpoint=data.endpoint,
+            api_secret_key=data.api_secret_key,
+            api_version=data.api_version,
+        )
+    except ValueError as exc:
+        logger.warning(exc)
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except Exception as exc:
+        logger.warning(exc)
+        raise HTTPException(
+            status_code=500, detail="Failed to create Revolut webhook."
+        ) from exc
+
+    signing_secret = webhook.get("signing_secret")
+    webhook_url = webhook.get("url") or data.url
+    if not signing_secret:
+        raise HTTPException(
+            status_code=502, detail="Revolut returned no webhook signing secret."
+        )
+
+    updated_settings = {
+        "revolut_payment_webhook_url": webhook_url,
+        "revolut_webhook_signing_secret": signing_secret,
+    }
+    for key, value in updated_settings.items():
+        await set_settings_field(key, value)
+    update_cached_settings(updated_settings)
+
+    return RevolutCreateWebhookResponse(
+        id=webhook.get("id"),
+        url=webhook_url,
+        events=webhook.get("events") or [],
+        signing_secret=signing_secret,
+        already_exists=webhook.get("already_exists", False),
+    )
+
+
@fiat_router.post(
    "/{provider}/subscription",
    status_code=HTTPStatus.OK,
@@ -20,7 +20,7 @@ from lnbits.decorators import (
    check_first_install,
    check_user_exists,
 )
-from lnbits.helpers import check_callback_url, template_renderer
+from lnbits.helpers import check_callback_url, extension_id_from_path, template_renderer
 from lnbits.settings import settings

 from ..crud import get_user
@@ -198,7 +198,9 @@ admin_ui_checks = [Depends(check_admin), Depends(check_admin_ui)]
 async def index(
    request: Request, user: User = Depends(check_user_exists)
 ) -> HTMLResponse:
-    return template_renderer().TemplateResponse(
+    return template_renderer(
+        extension_id=extension_id_from_path(request.url.path)
+    ).TemplateResponse(
        request,
        "base.html",
        {
@@ -211,7 +213,9 @@ async def index(
@generic_router.get("/node/public")
@generic_router.get("/first_install", dependencies=[Depends(check_first_install)])
 async def index_public(request: Request) -> HTMLResponse:
-    return template_renderer().TemplateResponse(request, "base.html", {"public": True})
+    return template_renderer(
+        extension_id=extension_id_from_path(request.url.path)
+    ).TemplateResponse(request, "base.html", {"public": True})


@generic_router.get("/uuidv4/{hex_value}")
@@ -263,6 +263,7 @@ async def api_payments_create(
            payment_request=invoice_data.bolt11,
            extra=invoice_data.extra,
            labels=invoice_data.labels,
+            external_id=invoice_data.external_id,
        )
        return payment

@@ -35,7 +35,7 @@ if settings.lnbits_database_url:
    else:
        if not database_uri.startswith("postgres://"):
            raise ValueError(
-                "Please use the 'postgres://...' " "format for the database URL."
+                "Please use the 'postgres://...' format for the database URL."
            )
        DB_TYPE = POSTGRES

@@ -560,7 +560,9 @@ class Filters(BaseModel, Generic[TFilterModel]):

    def pagination(self) -> str:
        stmt = ""
-        self.limit = self.limit or 10
+        if self.limit == 0:
+            self.limit = 1000
+        self.limit = 10 if self.limit is None else self.limit
        stmt += f"LIMIT {min(1000, self.limit)} "
        if self.offset:
            stmt += f"OFFSET {self.offset}"
@@ -9,6 +9,8 @@ from lnbits.fiat.base import FiatProvider
 from lnbits.settings import settings

 from .paypal import PayPalWallet
+from .revolut import RevolutWallet
+from .square import SquareWallet
 from .stripe import StripeWallet

 fiat_module = importlib.import_module("lnbits.fiat")
@@ -17,6 +19,8 @@ fiat_module = importlib.import_module("lnbits.fiat")
 class FiatProviderType(Enum):
    stripe = "StripeWallet"
    paypal = "PayPalWallet"
+    square = "SquareWallet"
+    revolut = "RevolutWallet"


 async def get_fiat_provider(name: str) -> FiatProvider | None:
@@ -52,5 +56,7 @@ fiat_providers: dict[str, FiatProvider] = {}

 __all__ = [
    "PayPalWallet",
+    "RevolutWallet",
+    "SquareWallet",
    "StripeWallet",
 ]
@@ -95,6 +95,10 @@ class FiatSubscriptionPaymentOptions(BaseModel):
        description="Unique ID that can be used to identify the subscription request."
        "If not provided, one will be generated.",
    )
+    customer_email: str | None = Field(
+        default=None,
+        description="The customer email to use for the subscription.",
+    )
    tag: str | None = Field(
        default=None,
        description="Payments created by the recurring subscription"
@@ -0,0 +1,637 @@
+import asyncio
+import ipaddress
+import json
+from collections.abc import AsyncGenerator
+from decimal import ROUND_HALF_UP, Decimal
+from typing import Any
+from urllib.parse import urlparse
+
+import httpx
+from loguru import logger
+from pydantic import BaseModel, Field, ValidationError
+
+from lnbits.helpers import normalize_endpoint, urlsafe_short_hash
+from lnbits.settings import settings
+
+from .base import (
+    FiatInvoiceResponse,
+    FiatPaymentFailedStatus,
+    FiatPaymentPendingStatus,
+    FiatPaymentResponse,
+    FiatPaymentStatus,
+    FiatPaymentSuccessStatus,
+    FiatProvider,
+    FiatStatusResponse,
+    FiatSubscriptionPaymentOptions,
+    FiatSubscriptionResponse,
+)
+
+
+class RevolutCheckoutOptions(BaseModel):
+    class Config:
+        extra = "ignore"
+
+    success_url: str | None = None
+    metadata: dict[str, Any] = Field(default_factory=dict)
+    description: str | None = None
+
+
+class RevolutCreateInvoiceOptions(BaseModel):
+    class Config:
+        extra = "ignore"
+
+    checkout: RevolutCheckoutOptions | None = None
+
+
+class RevolutSubscriptionReference(BaseModel):
+    wallet_id: str
+    tag: str | None = None
+    subscription_request_id: str | None = None
+    extra: dict[str, Any] | None = None
+    memo: str | None = None
+
+
+REVOLUT_WEBHOOK_EVENTS = [
+    "ORDER_AUTHORISED",
+    "ORDER_COMPLETED",
+    "SUBSCRIPTION_INITIATED",
+]
+
+ZERO_DECIMAL_CURRENCIES = {
+    "BIF",
+    "CLP",
+    "DJF",
+    "GNF",
+    "ISK",
+    "JPY",
+    "KMF",
+    "KRW",
+    "PYG",
+    "RWF",
+    "UGX",
+    "VND",
+    "VUV",
+    "XAF",
+    "XOF",
+    "XPF",
+}
+THREE_DECIMAL_CURRENCIES = {
+    "BHD",
+    "IQD",
+    "JOD",
+    "KWD",
+    "LYD",
+    "OMR",
+    "TND",
+}
+REVOLUT_CUSTOMER_LIST_LIMIT = 500
+REVOLUT_CUSTOMER_LIST_MAX_PAGES = 20
+REVOLUT_REQUEST_TIMEOUT = 30
+
+
+class RevolutWallet(FiatProvider):
+    """https://developer.revolut.com/docs/merchant"""
+
+    def __init__(self):
+        logger.debug("Initializing RevolutWallet")
+        self._settings_fields = self._settings_connection_fields()
+        if not settings.revolut_api_endpoint:
+            raise ValueError("Cannot initialize RevolutWallet: missing endpoint.")
+        if not settings.revolut_api_secret_key:
+            raise ValueError("Cannot initialize RevolutWallet: missing API secret key.")
+
+        self.endpoint = normalize_endpoint(settings.revolut_api_endpoint)
+        self.headers = {
+            "Authorization": f"Bearer {settings.revolut_api_secret_key}",
+            "Revolut-Api-Version": settings.revolut_api_version,
+            "Content-Type": "application/json",
+            "User-Agent": settings.user_agent,
+        }
+        self.client = httpx.AsyncClient(base_url=self.endpoint, headers=self.headers)
+        logger.info("RevolutWallet initialized.")
+
+    async def cleanup(self):
+        try:
+            await self.client.aclose()
+        except RuntimeError as e:
+            logger.warning(f"Error closing Revolut wallet connection: {e}")
+
+    async def status(
+        self, only_check_settings: bool | None = False
+    ) -> FiatStatusResponse:
+        if only_check_settings:
+            if self._settings_fields != self._settings_connection_fields():
+                return FiatStatusResponse("Connection settings have changed.", 0)
+            return FiatStatusResponse(balance=0)
+
+        try:
+            r = await self.client.get(
+                "/api/orders",
+                params={"limit": 1},
+                timeout=REVOLUT_REQUEST_TIMEOUT,
+            )
+            r.raise_for_status()
+            _ = r.json()
+            return FiatStatusResponse(balance=0)
+        except json.JSONDecodeError:
+            return FiatStatusResponse("Server error: 'invalid json response'", 0)
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatStatusResponse(f"Unable to connect to {self.endpoint}.", 0)
+
+    async def create_invoice(
+        self,
+        amount: float,
+        payment_hash: str,
+        currency: str,
+        memo: str | None = None,
+        extra: dict[str, Any] | None = None,
+        **kwargs,
+    ) -> FiatInvoiceResponse:
+        opts = self._parse_create_opts(extra or {})
+        if opts is None:
+            return FiatInvoiceResponse(
+                ok=False, error_message="Invalid Revolut options"
+            )
+
+        amount_minor = self.amount_to_minor_units(amount, currency)
+        checkout = opts.checkout or RevolutCheckoutOptions()
+        success_url = (
+            checkout.success_url
+            or settings.revolut_payment_success_url
+            or "https://lnbits.com"
+        )
+
+        payload = {
+            "amount": amount_minor,
+            "currency": currency.upper(),
+            "description": checkout.description or memo or "LNbits Invoice",
+            "redirect_url": success_url,
+            "metadata": {
+                **checkout.metadata,
+                "payment_hash": payment_hash,
+                "alan_action": "invoice",
+            },
+        }
+
+        try:
+            r = await self.client.post(
+                "/api/orders", json=payload, timeout=REVOLUT_REQUEST_TIMEOUT
+            )
+            r.raise_for_status()
+            data = r.json()
+            order_id = data.get("id")
+            checkout_url = data.get("checkout_url")
+            if not order_id or not checkout_url:
+                return FiatInvoiceResponse(
+                    ok=False, error_message="Server error: missing order id or url"
+                )
+            return FiatInvoiceResponse(
+                ok=True,
+                checking_id=f"order_{order_id}",
+                payment_request=checkout_url,
+            )
+        except json.JSONDecodeError:
+            return FiatInvoiceResponse(
+                ok=False, error_message="Server error: invalid json response"
+            )
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatInvoiceResponse(
+                ok=False, error_message=f"Unable to connect to {self.endpoint}."
+            )
+
+    async def create_subscription(
+        self,
+        subscription_id: str,
+        quantity: int,
+        payment_options: FiatSubscriptionPaymentOptions,
+        **kwargs,
+    ) -> FiatSubscriptionResponse:
+        if quantity != 1:
+            return FiatSubscriptionResponse(
+                ok=False,
+                error_message="Revolut subscriptions do not support quantity.",
+            )
+
+        wallet_id = payment_options.wallet_id
+        if not wallet_id:
+            return FiatSubscriptionResponse(
+                ok=False, error_message="Wallet ID is required."
+            )
+
+        extra = payment_options.extra or {}
+        if not payment_options.subscription_request_id:
+            payment_options.subscription_request_id = urlsafe_short_hash()
+
+        reference = RevolutSubscriptionReference(
+            wallet_id=wallet_id,
+            tag=payment_options.tag,
+            subscription_request_id=payment_options.subscription_request_id,
+            extra=extra,
+            memo=payment_options.memo,
+        )
+        payload: dict[str, Any] = {
+            "plan_variation_id": subscription_id,
+            "external_reference": self._serialize_subscription_reference(reference),
+            "setup_order_redirect_url": (
+                payment_options.success_url
+                or settings.revolut_payment_success_url
+                or "https://lnbits.com"
+            ),
+        }
+        if extra.get("trial_duration"):
+            payload["trial_duration"] = extra["trial_duration"]
+
+        headers = {
+            **self.headers,
+            "Idempotency-Key": payment_options.subscription_request_id,
+        }
+
+        try:
+            customer_id, customer_error = await self._get_subscription_customer_id(
+                payment_options
+            )
+            if not customer_id:
+                return FiatSubscriptionResponse(ok=False, error_message=customer_error)
+            payload["customer_id"] = customer_id
+            r = await self.client.post(
+                "/api/subscriptions",
+                json=payload,
+                headers=headers,
+                timeout=REVOLUT_REQUEST_TIMEOUT,
+            )
+            r.raise_for_status()
+            data = r.json()
+            revolut_subscription_id = data.get("id")
+            setup_order_id = data.get("setup_order_id")
+            if not revolut_subscription_id or not setup_order_id:
+                return FiatSubscriptionResponse(
+                    ok=False,
+                    error_message=(
+                        "Server error: missing subscription id or setup order id"
+                    ),
+                )
+
+            setup_order = await self.get_order(setup_order_id)
+            checkout_url = setup_order.get("checkout_url")
+            if not checkout_url:
+                return FiatSubscriptionResponse(
+                    ok=False, error_message="Server error: missing setup checkout url"
+                )
+
+            return FiatSubscriptionResponse(
+                ok=True,
+                checkout_session_url=checkout_url,
+                subscription_request_id=payment_options.subscription_request_id,
+            )
+        except json.JSONDecodeError:
+            return FiatSubscriptionResponse(
+                ok=False, error_message="Server error: invalid json response"
+            )
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatSubscriptionResponse(
+                ok=False, error_message=f"Unable to connect to {self.endpoint}."
+            )
+
+    async def cancel_subscription(
+        self,
+        subscription_id: str,
+        correlation_id: str,
+        **kwargs,
+    ) -> FiatSubscriptionResponse:
+        try:
+            r = await self.client.post(
+                f"/api/subscriptions/{subscription_id}/cancel",
+                timeout=REVOLUT_REQUEST_TIMEOUT,
+            )
+            r.raise_for_status()
+            return FiatSubscriptionResponse(ok=True)
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatSubscriptionResponse(
+                ok=False, error_message="Unable to cancel subscription."
+            )
+
+    async def pay_invoice(self, payment_request: str) -> FiatPaymentResponse:
+        raise NotImplementedError("Revolut does not support paying invoices directly.")
+
+    async def get_invoice_status(self, checking_id: str) -> FiatPaymentStatus:
+        try:
+            order_id = self._normalize_revolut_id(checking_id)
+            return self._status_from_order(await self.get_order(order_id))
+        except Exception as exc:
+            logger.debug(f"Error getting Revolut invoice status: {exc}")
+            return FiatPaymentPendingStatus()
+
+    async def get_payment_status(self, checking_id: str) -> FiatPaymentStatus:
+        raise NotImplementedError("Revolut does not support outgoing payments.")
+
+    async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:
+        logger.warning(
+            "Revolut does not support paid invoices stream. Use webhooks instead."
+        )
+        mock_queue: asyncio.Queue[str] = asyncio.Queue(0)
+        while settings.lnbits_running:
+            value = await mock_queue.get()
+            yield value
+
+    def _normalize_revolut_id(self, checking_id: str) -> str:
+        value = (
+            checking_id.replace("fiat_revolut_", "", 1)
+            if checking_id.startswith("fiat_revolut_")
+            else checking_id
+        )
+        return value.replace("order_", "", 1) if value.startswith("order_") else value
+
+    async def get_order(self, order_id: str) -> dict[str, Any]:
+        r = await self.client.get(
+            f"/api/orders/{order_id}", timeout=REVOLUT_REQUEST_TIMEOUT
+        )
+        r.raise_for_status()
+        return r.json()
+
+    async def get_subscription(self, subscription_id: str) -> dict[str, Any]:
+        r = await self.client.get(
+            f"/api/subscriptions/{subscription_id}", timeout=REVOLUT_REQUEST_TIMEOUT
+        )
+        r.raise_for_status()
+        return r.json()
+
+    async def get_subscription_cycle(
+        self, subscription_id: str, cycle_id: str
+    ) -> dict[str, Any]:
+        r = await self.client.get(
+            f"/api/subscriptions/{subscription_id}/cycles/{cycle_id}",
+            timeout=REVOLUT_REQUEST_TIMEOUT,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    async def _get_subscription_customer_id(
+        self, payment_options: FiatSubscriptionPaymentOptions
+    ) -> tuple[str | None, str | None]:
+        if not payment_options.customer_email:
+            return (
+                None,
+                "Revolut subscriptions require customer_email.",
+            )
+
+        customer = await self._get_customer_by_email(payment_options.customer_email)
+        customer_id = customer.get("id") if customer else None
+        if customer_id:
+            return customer_id, None
+
+        customer = await self._create_customer(payment_options.customer_email)
+        customer_id = customer.get("id")
+        if not customer_id:
+            return None, "Server error: missing customer id"
+        return customer_id, None
+
+    async def _get_customer_by_email(self, email: str) -> dict[str, Any] | None:
+        page_token = None
+        for _ in range(REVOLUT_CUSTOMER_LIST_MAX_PAGES):
+            customer_page = await self._list_customers(page_token=page_token)
+            customer = _find_customer_by_email(customer_page["customers"], email)
+            if customer:
+                return customer
+
+            page_token = customer_page.get("next_page_token")
+            if not page_token:
+                return None
+        return None
+
+    async def _list_customers(self, page_token: str | None = None) -> dict[str, Any]:
+        params: dict[str, Any] = {"limit": REVOLUT_CUSTOMER_LIST_LIMIT}
+        if page_token:
+            params["page_token"] = page_token
+        r = await self.client.get(
+            "/api/customers", params=params, timeout=REVOLUT_REQUEST_TIMEOUT
+        )
+        r.raise_for_status()
+        return _extract_customer_page(r.json())
+
+    async def _create_customer(self, email: str) -> dict[str, Any]:
+        r = await self.client.post(
+            "/api/customers",
+            json={"email": email},
+            timeout=REVOLUT_REQUEST_TIMEOUT,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    @classmethod
+    async def create_webhook(
+        cls,
+        url: str,
+        endpoint: str | None = None,
+        api_secret_key: str | None = None,
+        api_version: str | None = None,
+    ) -> dict[str, Any]:
+        if not url:
+            raise ValueError("Missing Revolut webhook URL.")
+        cls._validate_webhook_url(url)
+        if not endpoint and not settings.revolut_api_endpoint:
+            raise ValueError("Missing Revolut API endpoint.")
+        if not api_secret_key and not settings.revolut_api_secret_key:
+            raise ValueError("Missing Revolut API secret key.")
+
+        base_url = normalize_endpoint(endpoint or settings.revolut_api_endpoint)
+        secret_key = api_secret_key or settings.revolut_api_secret_key
+        headers = {
+            "Authorization": f"Bearer {secret_key}",
+            "Revolut-Api-Version": api_version or settings.revolut_api_version,
+            "Content-Type": "application/json",
+            "User-Agent": settings.user_agent,
+        }
+        payload = {"url": url, "events": REVOLUT_WEBHOOK_EVENTS}
+        async with httpx.AsyncClient(base_url=base_url, headers=headers) as client:
+            webhooks = await cls._list_webhooks(client)
+            existing = await cls._get_existing_webhook(client, webhooks, url)
+            if existing:
+                existing["already_exists"] = True
+                return existing
+
+            response = await client.post(
+                "/api/webhooks", json=payload, timeout=REVOLUT_REQUEST_TIMEOUT
+            )
+            response.raise_for_status()
+            return response.json()
+
+    @classmethod
+    async def _list_webhooks(cls, client: httpx.AsyncClient) -> list[dict[str, Any]]:
+        response = await client.get("/api/webhooks", timeout=REVOLUT_REQUEST_TIMEOUT)
+        response.raise_for_status()
+        data = response.json()
+        if isinstance(data, list):
+            return data
+        if isinstance(data, dict):
+            for field in ["webhooks", "data", "items"]:
+                if isinstance(data.get(field), list):
+                    return data[field]
+        return []
+
+    @classmethod
+    async def _get_existing_webhook(
+        cls, client: httpx.AsyncClient, webhooks: list[dict[str, Any]], url: str
+    ) -> dict[str, Any] | None:
+        for webhook in webhooks:
+            if cls._normalize_webhook_url(webhook.get("url")) != (
+                cls._normalize_webhook_url(url)
+            ):
+                continue
+
+            webhook_id = webhook.get("id")
+            if webhook_id and (
+                not webhook.get("events") or not webhook.get("signing_secret")
+            ):
+                response = await client.get(
+                    f"/api/webhooks/{webhook_id}", timeout=REVOLUT_REQUEST_TIMEOUT
+                )
+                response.raise_for_status()
+                webhook = response.json()
+
+            events = set(webhook.get("events") or [])
+            missing_events = set(REVOLUT_WEBHOOK_EVENTS) - events
+            if missing_events:
+                raise ValueError(
+                    "A Revolut webhook already exists for this URL, but it is "
+                    f"missing required events: {', '.join(sorted(missing_events))}."
+                )
+
+            if not webhook.get("signing_secret"):
+                raise ValueError(
+                    "A Revolut webhook already exists for this URL, but Revolut "
+                    "did not return a signing secret."
+                )
+
+            return webhook
+        return None
+
+    @classmethod
+    def _normalize_webhook_url(cls, url: str | None) -> str:
+        return (url or "").strip().rstrip("/")
+
+    @classmethod
+    def _validate_webhook_url(cls, url: str) -> None:
+        parsed = urlparse(url)
+        hostname = parsed.hostname
+        if parsed.scheme not in ["http", "https"] or not hostname:
+            raise ValueError("Revolut webhook URL must be a clearnet URL.")
+
+        host = hostname.lower()
+        if host == "localhost" or host.endswith(".localhost"):
+            raise ValueError("Revolut webhook URL must be a clearnet URL.")
+        if host.endswith(".local") or host.endswith(".onion"):
+            raise ValueError("Revolut webhook URL must be a clearnet URL.")
+
+        try:
+            ip = ipaddress.ip_address(host)
+        except ValueError:
+            return
+
+        if (
+            ip.is_loopback
+            or ip.is_private
+            or ip.is_link_local
+            or ip.is_reserved
+            or ip.is_unspecified
+        ):
+            raise ValueError("Revolut webhook URL must be a clearnet URL.")
+
+    def _status_from_order(self, order: dict[str, Any]) -> FiatPaymentStatus:
+        status = (order.get("state") or "").upper()
+        if status == "COMPLETED":
+            return FiatPaymentSuccessStatus()
+        if status in ["CANCELLED", "FAILED"]:
+            return FiatPaymentFailedStatus()
+        return FiatPaymentPendingStatus()
+
+    @classmethod
+    def amount_to_minor_units(cls, amount: float | Decimal, currency: str) -> int:
+        scale = Decimal(10) ** cls.currency_exponent(currency)
+        return int((Decimal(str(amount)) * scale).quantize(Decimal("1"), ROUND_HALF_UP))
+
+    @classmethod
+    def minor_units_to_amount(cls, amount: int, currency: str) -> float:
+        scale = Decimal(10) ** cls.currency_exponent(currency)
+        return float(Decimal(amount) / scale)
+
+    @classmethod
+    def currency_exponent(cls, currency: str) -> int:
+        normalized = currency.upper()
+        if normalized in ZERO_DECIMAL_CURRENCIES:
+            return 0
+        if normalized in THREE_DECIMAL_CURRENCIES:
+            return 3
+        return 2
+
+    def _parse_create_opts(
+        self, raw_opts: dict[str, Any]
+    ) -> RevolutCreateInvoiceOptions | None:
+        try:
+            return RevolutCreateInvoiceOptions.parse_obj(raw_opts)
+        except ValidationError as e:
+            logger.warning(f"Invalid Revolut options: {e}")
+            return None
+
+    def _serialize_subscription_reference(
+        self, reference: RevolutSubscriptionReference
+    ) -> str:
+        payload = reference.dict(exclude_none=True)
+        serialized = json.dumps(payload, separators=(",", ":"))
+        if len(serialized) > 1024:
+            raise ValueError("Revolut subscription external_reference is too long.")
+        return serialized
+
+    def deserialize_subscription_reference(
+        self, external_reference: str | None
+    ) -> RevolutSubscriptionReference | None:
+        if not external_reference:
+            return None
+        try:
+            return RevolutSubscriptionReference.parse_obj(
+                json.loads(external_reference)
+            )
+        except (json.JSONDecodeError, ValidationError) as exc:
+            logger.warning(exc)
+            return None
+
+    def _settings_connection_fields(self) -> str:
+        return "-".join(
+            [
+                str(settings.revolut_api_endpoint),
+                str(settings.revolut_api_secret_key),
+                str(settings.revolut_api_version),
+                str(settings.revolut_webhook_signing_secret),
+            ]
+        )
+
+
+def _extract_customer_page(data: Any) -> dict[str, Any]:
+    if isinstance(data, list):
+        return {"customers": _filter_customer_list(data)}
+    if isinstance(data, dict):
+        for field in ["customers", "data", "items"]:
+            customers = data.get(field)
+            if isinstance(customers, list):
+                return {
+                    "customers": _filter_customer_list(customers),
+                    "next_page_token": data.get("next_page_token"),
+                }
+    return {"customers": []}
+
+
+def _filter_customer_list(customers: list[Any]) -> list[dict[str, Any]]:
+    return [customer for customer in customers if isinstance(customer, dict)]
+
+
+def _find_customer_by_email(
+    customers: list[dict[str, Any]], email: str
+) -> dict[str, Any] | None:
+    normalized_email = email.casefold()
+    for customer in customers:
+        if str(customer.get("email") or "").casefold() == normalized_email:
+            return customer
+    return None
@@ -0,0 +1,620 @@
+import asyncio
+import json
+from collections.abc import AsyncGenerator
+from typing import Any, Literal
+
+import httpx
+from loguru import logger
+from pydantic import BaseModel, Field, ValidationError
+
+from lnbits.helpers import normalize_endpoint, urlsafe_short_hash
+from lnbits.settings import settings
+
+from .base import (
+    FiatInvoiceResponse,
+    FiatPaymentFailedStatus,
+    FiatPaymentPendingStatus,
+    FiatPaymentResponse,
+    FiatPaymentStatus,
+    FiatPaymentSuccessStatus,
+    FiatProvider,
+    FiatStatusResponse,
+    FiatSubscriptionPaymentOptions,
+    FiatSubscriptionResponse,
+)
+
+FiatMethod = Literal["checkout", "subscription"]
+
+
+class SquareCheckoutOptions(BaseModel):
+    class Config:
+        extra = "ignore"
+
+    success_url: str | None = None
+    metadata: dict[str, str] = Field(default_factory=dict)
+    line_item_name: str | None = None
+
+
+class SquareSubscriptionOptions(BaseModel):
+    class Config:
+        extra = "ignore"
+
+    checking_id: str | None = None
+    payment_request: str | None = None
+
+
+class SquareCreateInvoiceOptions(BaseModel):
+    class Config:
+        extra = "ignore"
+
+    fiat_method: FiatMethod = "checkout"
+    checkout: SquareCheckoutOptions | None = None
+    subscription: SquareSubscriptionOptions | None = None
+
+
+class SquareSubscriptionCheckoutInfo(BaseModel):
+    plan_variation_id: str
+    price_money: dict[str, Any]
+
+
+class SquareWallet(FiatProvider):
+    """https://developer.squareup.com/reference/square"""
+
+    def __init__(self):
+        logger.debug("Initializing SquareWallet")
+        self._settings_fields = self._settings_connection_fields()
+        if not settings.square_api_endpoint:
+            raise ValueError("Cannot initialize SquareWallet: missing endpoint.")
+        if not settings.square_access_token:
+            raise ValueError("Cannot initialize SquareWallet: missing access token.")
+        if not settings.square_location_id:
+            raise ValueError("Cannot initialize SquareWallet: missing location ID.")
+
+        self.endpoint = normalize_endpoint(settings.square_api_endpoint)
+        self.location_id = settings.square_location_id
+        self.headers = {
+            "Authorization": f"Bearer {settings.square_access_token}",
+            "Square-Version": settings.square_api_version,
+            "Content-Type": "application/json",
+            "User-Agent": settings.user_agent,
+        }
+        self.client = httpx.AsyncClient(base_url=self.endpoint, headers=self.headers)
+        logger.info("SquareWallet initialized.")
+
+    async def cleanup(self):
+        try:
+            await self.client.aclose()
+        except RuntimeError as e:
+            logger.warning(f"Error closing Square wallet connection: {e}")
+
+    async def status(
+        self, only_check_settings: bool | None = False
+    ) -> FiatStatusResponse:
+        if only_check_settings:
+            if self._settings_fields != self._settings_connection_fields():
+                return FiatStatusResponse("Connection settings have changed.", 0)
+            return FiatStatusResponse(balance=0)
+
+        try:
+            r = await self.client.get(f"/v2/locations/{self.location_id}", timeout=15)
+            r.raise_for_status()
+            _ = r.json()
+            return FiatStatusResponse(balance=0)
+        except json.JSONDecodeError:
+            return FiatStatusResponse("Server error: 'invalid json response'", 0)
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatStatusResponse(f"Unable to connect to {self.endpoint}.", 0)
+
+    async def create_invoice(
+        self,
+        amount: float,
+        payment_hash: str,
+        currency: str,
+        memo: str | None = None,
+        extra: dict[str, Any] | None = None,
+        **kwargs,
+    ) -> FiatInvoiceResponse:
+        opts = self._parse_create_opts(extra or {})
+        if not opts:
+            return FiatInvoiceResponse(ok=False, error_message="Invalid Square options")
+
+        if opts.fiat_method == "subscription":
+            return self._create_subscription_invoice(opts.subscription)
+
+        return await self._create_checkout_invoice(
+            amount=amount,
+            payment_hash=payment_hash,
+            currency=currency,
+            opts=opts,
+            memo=memo,
+        )
+
+    async def create_subscription(
+        self,
+        subscription_id: str,
+        quantity: int,
+        payment_options: FiatSubscriptionPaymentOptions,
+        **kwargs,
+    ) -> FiatSubscriptionResponse:
+        if settings.lnbits_running:
+            return FiatSubscriptionResponse(
+                ok=False, error_message="Subscription not supported for Square."
+            )
+        success_url = (
+            payment_options.success_url
+            or settings.square_payment_success_url
+            or "https://lnbits.com"
+        )
+
+        if not payment_options.subscription_request_id:
+            payment_options.subscription_request_id = urlsafe_short_hash()
+        payment_options.extra = payment_options.extra or {}
+        payment_options.extra["subscription_request_id"] = (
+            payment_options.subscription_request_id
+        )
+        try:
+            checkout_info = await self._get_subscription_checkout_info(subscription_id)
+            metadata = self._serialize_metadata(payment_options)
+            payload = {
+                "idempotency_key": payment_options.subscription_request_id,
+                "description": metadata,
+                "quick_pay": {
+                    "name": (payment_options.memo or "LNbits Subscription")[:255],
+                    "price_money": checkout_info.price_money,
+                    "location_id": self.location_id,
+                },
+                "checkout_options": {
+                    "redirect_url": success_url,
+                    "subscription_plan_id": checkout_info.plan_variation_id,
+                },
+                "payment_note": metadata,
+            }
+            r = await self.client.post(
+                "/v2/online-checkout/payment-links", json=payload
+            )
+            r.raise_for_status()
+            data = r.json()
+            payment_link = data.get("payment_link") or {}
+            url = payment_link.get("url")
+            if not url:
+                return FiatSubscriptionResponse(
+                    ok=False, error_message="Server error: missing url"
+                )
+            return FiatSubscriptionResponse(
+                ok=True,
+                checkout_session_url=url,
+                subscription_request_id=payment_options.subscription_request_id,
+            )
+        except json.JSONDecodeError as exc:
+            logger.warning(exc)
+            return FiatSubscriptionResponse(
+                ok=False, error_message="Server error: invalid json response"
+            )
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatSubscriptionResponse(
+                ok=False, error_message=f"Unable to connect to {self.endpoint}."
+            )
+
+    async def cancel_subscription(
+        self,
+        subscription_id: str,
+        correlation_id: str,
+        **kwargs,
+    ) -> FiatSubscriptionResponse:
+        try:
+            square_subscription_id = await self._get_square_subscription_id(
+                subscription_id, correlation_id
+            )
+            r = await self.client.post(
+                f"/v2/subscriptions/{square_subscription_id}/cancel"
+            )
+            r.raise_for_status()
+            return FiatSubscriptionResponse(ok=True)
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatSubscriptionResponse(
+                ok=False, error_message="Unable to cancel subscription."
+            )
+
+    async def pay_invoice(self, payment_request: str) -> FiatPaymentResponse:
+        raise NotImplementedError("Square does not support paying invoices directly.")
+
+    async def get_invoice_status(self, checking_id: str) -> FiatPaymentStatus:
+        try:
+            square_id = self._normalize_square_id(checking_id)
+            if square_id.startswith("payment_"):
+                payment_id = square_id.replace("payment_", "", 1)
+                return await self._get_payment_status(payment_id)
+
+            order_id = (
+                square_id.replace("order_", "", 1)
+                if square_id.startswith("order_")
+                else square_id
+            )
+            return await self._get_order_status(order_id)
+        except Exception as exc:
+            logger.debug(f"Error getting Square invoice status: {exc}")
+            return FiatPaymentPendingStatus()
+
+    async def get_payment_status(self, checking_id: str) -> FiatPaymentStatus:
+        raise NotImplementedError("Square does not support outgoing payments.")
+
+    async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:
+        logger.warning(
+            "Square does not support paid invoices stream. Use webhooks instead."
+        )
+        mock_queue: asyncio.Queue[str] = asyncio.Queue(0)
+        while settings.lnbits_running:
+            value = await mock_queue.get()
+            yield value
+
+    async def _get_order_status(self, order_id: str) -> FiatPaymentStatus:
+        order = await self._get_order(order_id)
+        payment_id = self._payment_id_from_order(order)
+        if payment_id:
+            return await self._get_payment_status(payment_id)
+
+        if (order.get("state") or "").upper() == "CANCELED":
+            return FiatPaymentFailedStatus()
+        return FiatPaymentPendingStatus()
+
+    async def _get_order(self, order_id: str) -> dict[str, Any]:
+        r = await self.client.get(f"/v2/orders/{order_id}")
+        r.raise_for_status()
+        return r.json().get("order") or {}
+
+    async def get_payment_for_order(self, order_id: str) -> dict[str, Any] | None:
+        order = await self._get_order(order_id)
+        payment_id = self._payment_id_from_order(order)
+        if not payment_id:
+            return None
+        return await self._get_payment(payment_id)
+
+    def _payment_id_from_order(self, order: dict[str, Any]) -> str | None:
+        tenders = order.get("tenders") or []
+        for tender in tenders:
+            payment_id = tender.get("payment_id")
+            if payment_id:
+                return payment_id
+        return None
+
+    async def _get_payment_status(self, payment_id: str) -> FiatPaymentStatus:
+        return self._status_from_payment(await self._get_payment(payment_id))
+
+    async def _get_payment(self, payment_id: str) -> dict[str, Any]:
+        r = await self.client.get(f"/v2/payments/{payment_id}")
+        r.raise_for_status()
+        return r.json().get("payment") or {}
+
+    async def _get_subscription_checkout_info(
+        self, subscription_plan_id: str
+    ) -> SquareSubscriptionCheckoutInfo:
+        catalog_object = await self._get_catalog_object(subscription_plan_id)
+        if catalog_object.get("type") == "SUBSCRIPTION_PLAN":
+            return await self._get_plan_checkout_info(catalog_object)
+
+        if catalog_object.get("type") == "SUBSCRIPTION_PLAN_VARIATION":
+            price_money = await self._get_subscription_price_money(
+                catalog_object,
+            )
+            plan_variation_id = catalog_object.get("id")
+            if not plan_variation_id:
+                raise ValueError("Square subscription plan variation is missing an ID.")
+            return SquareSubscriptionCheckoutInfo(
+                plan_variation_id=plan_variation_id,
+                price_money=price_money,
+            )
+
+        raise ValueError(
+            "Square subscription ID must be a plan ID or plan variation ID."
+        )
+
+    async def _get_plan_checkout_info(
+        self, catalog_object: dict[str, Any]
+    ) -> SquareSubscriptionCheckoutInfo:
+        plan_data = catalog_object.get("subscription_plan_data") or {}
+        plan_variations = plan_data.get("subscription_plan_variations") or []
+        eligible_item_ids = plan_data.get("eligible_item_ids") or []
+        plan_variation = next(
+            (
+                variation
+                for variation in plan_variations
+                if not variation.get("is_deleted")
+            ),
+            None,
+        )
+        if not plan_variation:
+            raise ValueError("Square subscription plan is missing a variation.")
+
+        price_money = await self._get_subscription_price_money(
+            plan_variation,
+            eligible_item_ids=eligible_item_ids,
+        )
+        plan_variation_id = plan_variation.get("id")
+        if not plan_variation_id:
+            raise ValueError("Square subscription plan variation is missing an ID.")
+
+        return SquareSubscriptionCheckoutInfo(
+            plan_variation_id=plan_variation_id,
+            price_money=price_money,
+        )
+
+    async def _get_catalog_object(self, object_id: str) -> dict[str, Any]:
+        r = await self.client.get(f"/v2/catalog/object/{object_id}")
+        r.raise_for_status()
+        return r.json().get("object") or {}
+
+    async def _get_subscription_price_money(
+        self,
+        plan_variation: dict[str, Any],
+        eligible_item_ids: list[str] | None = None,
+    ) -> dict[str, Any]:
+        variation_data = plan_variation.get("subscription_plan_variation_data") or {}
+        phases = variation_data.get("phases") or []
+        for phase in phases:
+            pricing = phase.get("pricing") or {}
+            price_money = pricing.get("price_money") or phase.get(
+                "recurring_price_money"
+            )
+            parsed_price_money = self._parse_price_money(price_money)
+            if parsed_price_money:
+                return parsed_price_money
+
+            if pricing.get("type") == "RELATIVE":
+                return await self._get_relative_subscription_price_money(
+                    eligible_item_ids or []
+                )
+
+        raise ValueError("Square subscription plan variation is missing price_money.")
+
+    async def _get_relative_subscription_price_money(
+        self, eligible_item_ids: list[str]
+    ) -> dict[str, Any]:
+        if len(eligible_item_ids) != 1:
+            raise ValueError(
+                "Square relative subscription plan must have exactly one item."
+            )
+
+        item = await self._get_catalog_object(eligible_item_ids[0])
+        item_variations: list[dict[str, Any]] = []
+        if item.get("type") == "ITEM":
+            item_variations = (item.get("item_data") or {}).get("variations") or []
+        elif item.get("type") == "ITEM_VARIATION":
+            item_variations = [item]
+
+        item_variation = next(
+            (
+                variation
+                for variation in item_variations
+                if not variation.get("is_deleted")
+            ),
+            None,
+        )
+        if not item_variation:
+            raise ValueError("Square subscription item is missing a variation.")
+
+        price_money = self._parse_price_money(
+            (item_variation.get("item_variation_data") or {}).get("price_money")
+        )
+        if price_money:
+            return price_money
+
+        raise ValueError("Square subscription item variation is missing price_money.")
+
+    def _parse_price_money(
+        self, price_money: dict[str, Any] | None
+    ) -> dict[str, Any] | None:
+        if (
+            price_money
+            and price_money.get("amount") is not None
+            and price_money.get("currency")
+        ):
+            return {
+                "amount": int(price_money["amount"]),
+                "currency": price_money["currency"].upper(),
+            }
+        return None
+
+    def _status_from_payment(self, payment: dict[str, Any]) -> FiatPaymentStatus:
+        status = (payment.get("status") or "").upper()
+        if status == "COMPLETED":
+            return FiatPaymentSuccessStatus()
+        if status in ["CANCELED", "FAILED"]:
+            return FiatPaymentFailedStatus()
+        return FiatPaymentPendingStatus()
+
+    async def _create_checkout_invoice(
+        self,
+        amount: float,
+        payment_hash: str,
+        currency: str,
+        opts: SquareCreateInvoiceOptions,
+        memo: str | None = None,
+    ) -> FiatInvoiceResponse:
+        amount_cents = int(amount * 100)
+        co = opts.checkout or SquareCheckoutOptions()
+        success_url = (
+            co.success_url
+            or settings.square_payment_success_url
+            or "https://lnbits.com"
+        )
+        line_item_name = (co.line_item_name or memo or "LNbits Invoice")[:255]
+        metadata = {
+            **co.metadata,
+            "payment_hash": payment_hash,
+            "alan_action": "invoice",
+        }
+
+        payload = {
+            "idempotency_key": payment_hash,
+            "order": {
+                "location_id": self.location_id,
+                "metadata": metadata,
+                "line_items": [
+                    {
+                        "name": line_item_name,
+                        "quantity": "1",
+                        "base_price_money": {
+                            "amount": amount_cents,
+                            "currency": currency.upper(),
+                        },
+                    }
+                ],
+            },
+            "checkout_options": {"redirect_url": success_url},
+        }
+        if memo:
+            payload["payment_note"] = memo[:500]
+
+        try:
+            r = await self.client.post(
+                "/v2/online-checkout/payment-links", json=payload
+            )
+            r.raise_for_status()
+            data = r.json()
+            payment_link = data.get("payment_link") or {}
+            order_id = payment_link.get("order_id")
+            url = payment_link.get("url")
+            if not order_id or not url:
+                return FiatInvoiceResponse(
+                    ok=False, error_message="Server error: missing order id or url"
+                )
+            return FiatInvoiceResponse(
+                ok=True,
+                checking_id=f"order_{order_id}",
+                payment_request=url,
+            )
+        except json.JSONDecodeError:
+            return FiatInvoiceResponse(
+                ok=False, error_message="Server error: invalid json response"
+            )
+        except Exception as exc:
+            logger.warning(exc)
+            return FiatInvoiceResponse(
+                ok=False, error_message=f"Unable to connect to {self.endpoint}."
+            )
+
+    def _create_subscription_invoice(
+        self, opts: SquareSubscriptionOptions | None
+    ) -> FiatInvoiceResponse:
+        term = opts or SquareSubscriptionOptions()
+        checking_id = term.checking_id or f"payment_{urlsafe_short_hash()}"
+        return FiatInvoiceResponse(
+            ok=True,
+            checking_id=checking_id,
+            payment_request=term.payment_request or "",
+        )
+
+    def _normalize_square_id(self, checking_id: str) -> str:
+        return (
+            checking_id.replace("fiat_square_", "", 1)
+            if checking_id.startswith("fiat_square_")
+            else checking_id
+        )
+
+    def _parse_create_opts(
+        self, raw_opts: dict[str, Any]
+    ) -> SquareCreateInvoiceOptions | None:
+        try:
+            return SquareCreateInvoiceOptions.parse_obj(raw_opts)
+        except ValidationError as e:
+            logger.warning(f"Invalid Square options: {e}")
+            return None
+
+    def _serialize_metadata(
+        self, payment_options: FiatSubscriptionPaymentOptions
+    ) -> str:
+        extra_link = None
+        if payment_options.extra:
+            raw_link = payment_options.extra.get("link")
+            extra_link = str(raw_link)[:200] if raw_link else None
+
+        meta = [
+            payment_options.wallet_id,
+            payment_options.tag,
+            payment_options.subscription_request_id,
+            extra_link,
+        ]
+
+        memo_limit = 493 - len(json.dumps(meta, separators=(",", ":")))
+        if memo_limit > 0 and payment_options.memo:
+            meta.append(payment_options.memo[:memo_limit])
+        else:
+            meta.append(None)
+
+        metadata = json.dumps(meta, separators=(",", ":"))
+        if len(metadata) > 500:
+            raise ValueError("Square subscription metadata is too long.")
+        return metadata
+
+    async def _get_square_subscription_id(
+        self, subscription_id: str, wallet_id: str
+    ) -> str:
+        try:
+            from lnbits.core.crud.payments import get_payments
+            from lnbits.core.models import PaymentFilters
+            from lnbits.db import Filter, Filters
+
+            payments = await get_payments(
+                wallet_id=wallet_id,
+                filters=Filters(
+                    filters=[
+                        Filter.parse_query(
+                            "external_id", [subscription_id], PaymentFilters
+                        )
+                    ],
+                    model=PaymentFilters,
+                    sortby="created_at",
+                    direction="desc",
+                    limit=1,
+                ),
+            )
+            payment = next(
+                (
+                    payment
+                    for payment in payments
+                    if payment.external_id and payment.fiat_provider == "square"
+                ),
+                None,
+            )
+            if payment and payment.external_id:
+                return payment.external_id
+
+            payments = await get_payments(
+                wallet_id=wallet_id,
+                incoming=True,
+                filters=Filters(
+                    model=PaymentFilters,
+                    sortby="created_at",
+                    direction="desc",
+                ),
+            )
+            payment = next(
+                (
+                    payment
+                    for payment in payments
+                    if payment.external_id
+                    and payment.fiat_provider == "square"
+                    and (payment.extra or {}).get("subscription_request_id")
+                    == subscription_id
+                ),
+                None,
+            )
+            if payment and payment.external_id:
+                return payment.external_id
+        except Exception as exc:
+            logger.warning(exc)
+
+        return subscription_id
+
+    def _settings_connection_fields(self) -> str:
+        return "-".join(
+            [
+                str(settings.square_api_endpoint),
+                str(settings.square_access_token),
+                str(settings.square_location_id),
+                str(settings.square_api_version),
+            ]
+        )
@@ -52,7 +52,45 @@ def static_url_for(static: str, path: str) -> str:
    return f"/{static}/{path}?v={settings.server_startup_time}"


-def template_renderer(additional_folders: list | None = None) -> Jinja2Templates:
+def extension_id_from_path(path: str) -> str | None:
+    parts = [part for part in path.split("/") if part]
+    if not parts:
+        return None
+
+    if len(parts) >= 3 and parts[0] == "upgrades":
+        return parts[2]
+
+    ext_id = parts[0]
+    ext_i18n_dir = Path(
+        settings.lnbits_extensions_path, "extensions", ext_id, "static", "i18n"
+    )
+    if ext_i18n_dir.is_dir():
+        return ext_id
+
+    return None
+
+
+def extension_i18n_urls(extension_id: str | None) -> list[str]:
+    if not extension_id:
+        return []
+
+    i18n_dir = Path(
+        settings.lnbits_extensions_path, "extensions", extension_id, "static", "i18n"
+    )
+    if not i18n_dir.is_dir():
+        return []
+
+    files = [file.name for file in i18n_dir.glob("*.js") if file.is_file()]
+    return [
+        static_url_for(f"{extension_id}/static", f"i18n/{filename}")
+        for filename in sorted(files, key=lambda name: (name != "en.js", name))
+    ]
+
+
+def template_renderer(
+    additional_folders: list | None = None,
+    extension_id: str | None = None,
+) -> Jinja2Templates:
    folders = [
        "lnbits/templates",
        settings.extension_builder_working_dir_path.as_posix(),
@@ -86,6 +124,14 @@ def template_renderer(additional_folders: list | None = None) -> Jinja2Templates
            t.env.globals["INCLUDED_CSS"] = vendor_files["css"]
            t.env.globals["INCLUDED_COMPONENTS"] = vendor_files["components"]

+    if not extension_id and additional_folders:
+        for folder in additional_folders:
+            parts = Path(folder).parts
+            if parts and parts[-1] == "templates" and len(parts) >= 2:
+                extension_id = parts[-2]
+                break
+    t.env.globals["INCLUDED_EXTENSION_I18N"] = extension_i18n_urls(extension_id)
+
    # backwards compatibility for extensions (tpos)
    t.env.globals["LNBITS_DENOMINATION"] = settings.lnbits_denomination

@@ -7,6 +7,7 @@ from typing import Any
 from fastapi import FastAPI, Request, Response
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 from loguru import logger
+from pyinstrument import Profiler
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
 from slowapi.middleware import SlowAPIMiddleware
@@ -246,3 +247,16 @@ def add_first_install_middleware(app: FastAPI):
        ):
            return RedirectResponse("/first_install")
        return await call_next(request)
+
+
+def add_profiler_middleware(app: FastAPI):
+    @app.middleware("http")
+    async def profile_middleware(request: Request, call_next):
+        profiling = request.query_params.get("profiler", False)
+        if profiling:
+            profiler = Profiler(async_mode="enabled")
+            profiler.start()
+            _ = await call_next(request)
+            profiler.stop()
+            return HTMLResponse(profiler.output_html())
+        return await call_next(request)
@@ -284,7 +284,7 @@ class ThemesSettings(LNbitsSettings):
    lnbits_custom_image: str | None = Field(default="/static/images/logos/lnbits.svg")
    lnbits_ad_space_title: str = Field(default="Supported by")
    lnbits_ad_space: str = Field(
-        default="https://shop.lnbits.com/;/static/images/bitcoin-shop-banner.png;/static/images/bitcoin-shop-banner.png,https://affil.trezor.io/aff_c?offer_id=169&aff_id=33845;/static/images/bitcoin-hardware-wallet.png;/static/images/bitcoin-hardware-wallet.png,https://firefish.io/?ref=lnbits;/static/images/firefish.png;/static/images/firefish.png,https://opensats.org/;/static/images/open-sats.png;/static/images/open-sats.png"
+        default="https://shop.lnbits.com/;/static/images/bitcoin-shop-banner.png;/static/images/bitcoin-shop-banner.png,https://affil.trezor.io/aff_c?offer_id=169&aff_id=33845;/static/images/bitcoin-hardware-wallet.png;/static/images/bitcoin-hardware-wallet.png,https://firefish.io/?ref=lnbits;/static/images/firefish.png;/static/images/firefish.png"
    )  # sneaky sneaky
    lnbits_ad_space_enabled: bool = Field(default=False)
    lnbits_allowed_currencies: list[str] = Field(default=[])
@@ -300,6 +300,7 @@ class ThemesSettings(LNbitsSettings):
    lnbits_default_card_rounded: bool = Field(default=True)
    lnbits_default_card_gradient: bool = Field(default=True)
    lnbits_default_card_shadow: bool = Field(default=False)
+    lnbits_default_burger_menu_background: bool = Field(default=True)


 class OpsSettings(LNbitsSettings):
@@ -323,10 +324,6 @@ class AssetSettings(LNbitsSettings):
            "heic",
            "heif",
            "heics",
-            "text/plain",
-            "text/json" "text/xml",
-            "application/json",
-            "application/pdf",
        ]
    )
    lnbits_asset_thumbnail_width: int = Field(default=128, ge=0)
@@ -588,6 +585,8 @@ class ZBDFundingSource(LNbitsSettings):
 class PhoenixdFundingSource(LNbitsSettings):
    phoenixd_api_endpoint: str | None = Field(default="http://localhost:9740/")
    phoenixd_api_password: str | None = Field(default=None)
+    phoenixd_data_dir: str | None = Field(default=None)
+    phoenixd_mnemonic: str | None = Field(default=None)


 class AlbyFundingSource(LNbitsSettings):
@@ -700,6 +699,35 @@ class PayPalFiatProvider(LNbitsSettings):
    paypal_limits: FiatProviderLimits = Field(default_factory=FiatProviderLimits)


+class SquareFiatProvider(LNbitsSettings):
+    square_enabled: bool = Field(default=False)
+    square_api_endpoint: str = Field(default="https://connect.squareup.com")
+    square_access_token: str | None = Field(default=None)
+    square_location_id: str | None = Field(default=None)
+    square_api_version: str = Field(default="2026-01-22")
+    square_payment_success_url: str = Field(default="https://lnbits.com")
+    square_payment_webhook_url: str = Field(
+        default="https://your-lnbits-domain-here.com/api/v1/callback/square"
+    )
+    square_webhook_signature_key: str | None = Field(default=None)
+
+    square_limits: FiatProviderLimits = Field(default_factory=FiatProviderLimits)
+
+
+class RevolutFiatProvider(LNbitsSettings):
+    revolut_enabled: bool = Field(default=False)
+    revolut_api_endpoint: str = Field(default="https://merchant.revolut.com")
+    revolut_api_secret_key: str | None = Field(default=None)
+    revolut_api_version: str = Field(default="2026-04-20")
+    revolut_payment_success_url: str = Field(default="https://lnbits.com")
+    revolut_payment_webhook_url: str = Field(
+        default="https://your-lnbits-domain-here.com/api/v1/callback/revolut"
+    )
+    revolut_webhook_signing_secret: str | None = Field(default=None)
+
+    revolut_limits: FiatProviderLimits = Field(default_factory=FiatProviderLimits)
+
+
 class LightningSettings(LNbitsSettings):
    lightning_invoice_expiry: int = Field(default=3600, gt=0)

@@ -737,7 +765,12 @@ class FundingSourcesSettings(
    funding_source_max_retries: int = Field(default=4, ge=0)


-class FiatProvidersSettings(StripeFiatProvider, PayPalFiatProvider):
+class FiatProvidersSettings(
+    StripeFiatProvider,
+    PayPalFiatProvider,
+    SquareFiatProvider,
+    RevolutFiatProvider,
+):
    def is_fiat_provider_enabled(self, provider: str | None) -> bool:
        """
        Checks if a specific fiat provider is enabled.
@@ -748,6 +781,10 @@ class FiatProvidersSettings(StripeFiatProvider, PayPalFiatProvider):
            return self.stripe_enabled
        if provider == "paypal":
            return self.paypal_enabled
+        if provider == "square":
+            return self.square_enabled
+        if provider == "revolut":
+            return self.revolut_enabled
        return False

    def get_fiat_providers_for_user(self, user_id: str) -> list[str]:
@@ -767,6 +804,18 @@ class FiatProvidersSettings(StripeFiatProvider, PayPalFiatProvider):
        ):
            allowed_providers.append("paypal")

+        if self.square_enabled and (
+            not self.square_limits.allowed_users
+            or user_id in self.square_limits.allowed_users
+        ):
+            allowed_providers.append("square")
+
+        if self.revolut_enabled and (
+            not self.revolut_limits.allowed_users
+            or user_id in self.revolut_limits.allowed_users
+        ):
+            allowed_providers.append("revolut")
+
        return allowed_providers

    def get_fiat_provider_limits(self, provider_name: str) -> FiatProviderLimits | None:
@@ -1006,10 +1055,9 @@ class EnvSettings(LNbitsSettings):
    debug: bool = Field(default=False)
    debug_database: bool = Field(default=False)
    bundle_assets: bool = Field(default=True)
+    profiler: bool = Field(default=False)
    # When enabled, auth cookies require HTTPS and SSO will reject insecure HTTP.
-    # Keep disabled by default so local HTTP installs continue to work unless
-    # operators explicitly opt into HTTPS-only auth cookies.
-    auth_https_only: bool = Field(default=False)
+    auth_https_only: bool = Field(default=True)
    host: str = Field(default="127.0.0.1")
    port: int = Field(default=5000, gt=0)
    forwarded_allow_ips: str = Field(default="*")
@@ -1234,6 +1282,7 @@ class PublicSettings(BaseModel):
    default_card_rounded: bool = Field(alias="defaultCardRounded")
    default_card_gradient: bool = Field(alias="defaultCardGradient")
    default_card_shadow: bool = Field(alias="defaultCardShadow")
+    default_burger_menu_background: bool = Field(alias="defaultBurgerMenuBackground")
    denomination: str | None = Field()
    extensions: list[str] = Field()
    allowed_currencies: list[str] = Field(alias="allowedCurrencies")
@@ -1297,6 +1346,7 @@ class PublicSettings(BaseModel):
            defaultCardRounded=settings.lnbits_default_card_rounded,
            defaultCardGradient=settings.lnbits_default_card_gradient,
            defaultCardShadow=settings.lnbits_default_card_shadow,
+            defaultBurgerMenuBackground=settings.lnbits_default_burger_menu_background,
            denomination=settings.lnbits_denomination,
            extensions=list(settings.lnbits_installed_extensions_ids),
            allowedCurrencies=settings.lnbits_allowed_currencies,
@@ -395,6 +395,13 @@ body.card-shadow.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card,
  filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
 }

+body.no-burger-background .q-drawer {
+  background-color: transparent !important;
+  background-image: none !important;
+  backdrop-filter: none !important;
+  box-shadow: none !important;
+}
+
 :root {
  --size: 100px;
  --gap: 25px;
@@ -267,6 +267,15 @@ window.localisation.en = {
  webhook_events_list: 'The following events must be supported by the webhook:',
  webhook_stripe_description:
    'One the stripe side you must configure a webhook with a URL that points to your LNbits server.',
+  webhook_square_description:
+    'On the Square side configure a webhook pointing to this exact LNbits URL.',
+  square_webhook_url_hint:
+    'Must exactly match the Square notification URL. LNbits requires the /api/v1/callback/square path.',
+  access_token: 'Access Token',
+  location_id: 'Location ID',
+  square_location_id_hint:
+    'Square location ID to create payment links for. Use the endpoint to select sandbox or production.',
+  api_version: 'API Version',
  payment_proof: 'Payment Proof',
  update: 'Update',
  update_available: 'Update {version} available!',
@@ -275,6 +284,8 @@ window.localisation.en = {
  requires_server_restart:
    'Changing these settings requires a server restart to take effect.',
  funding_source_info: 'Select the active funding wallet',
+  phoenixd_warning:
+    "Phoenixd mnemonic is only available if phoenixd data-dir is specified and is readable by LNbits. It's not indicative of phoenixd not running. It just means LNbits cannot access the mnemonic to display it here.",
  latest_update: 'You are on the latest version {version}.',
  notifications: 'Notifications',
  notifications_configure: 'Configure Notifications',
@@ -479,6 +490,8 @@ window.localisation.en = {
  toggle_card_gradient: 'Toggle gradient on cards',
  card_shadow: 'Card Shadow',
  toggle_card_shadow: 'Toggle shadow on cards',
+  burger_menu_background: 'Burger Menu Background',
+  toggle_burger_menu_background: 'Toggle burger menu background',
  language: 'Language',
  assets: 'Assets',
  max_asset_size_mb: 'Max Asset Size (MB)',
@@ -803,6 +816,8 @@ window.localisation.en = {
  webhook_id_hint: 'PayPal webhook ID used to verify incoming events.',
  webhook_paypal_description:
    'On the PayPal side configure a webhook pointing to your LNbits server.',
+  square_webhook_signature_key_hint:
+    'Square webhook signature key used to verify incoming events.',
  callback_success_url: 'Callback Success URL',
  callback_success_url_hint:
    'The user will be redirected to this URL after the payment is successful',
@@ -452,7 +452,9 @@ window.app.component('username-password', {
      confirmationMethod: 'code',
      confirmationEmail: '',
      confirmationCode: this.invitationCode || '',
-      showConfirmationCode: false
+      showConfirmationCode: false,
+      showPwd: false,
+      showPwdRepeat: false
    }
  },
  methods: {
@@ -5,6 +5,9 @@ window.app.component('lnbits-admin-fiat-providers', {
    return {
      formAddStripeUser: '',
      formAddPaypalUser: '',
+      formAddSquareUser: '',
+      formAddRevolutUser: '',
+      creatingRevolutWebhook: false,
      hideInputToggle: true
    }
  },
@@ -20,6 +23,12 @@ window.app.component('lnbits-admin-fiat-providers', {
        this.formData?.paypal_payment_webhook_url ||
        this.calculateWebhookUrl('paypal')
      )
+    },
+    revolutWebhookUrl() {
+      return (
+        this.formData?.revolut_payment_webhook_url ||
+        this.calculateWebhookUrl('revolut')
+      )
    }
  },
  watch: {
@@ -58,6 +67,8 @@ window.app.component('lnbits-admin-fiat-providers', {
    syncWebhookUrls() {
      this.maybeSetWebhookUrl('stripe_payment_webhook_url', 'stripe')
      this.maybeSetWebhookUrl('paypal_payment_webhook_url', 'paypal')
+      this.maybeSetWebhookUrl('square_payment_webhook_url', 'square')
+      this.maybeSetWebhookUrl('revolut_payment_webhook_url', 'revolut')
    },
    maybeSetWebhookUrl(fieldName, provider) {
      if (!this.formData) {
@@ -77,6 +88,47 @@ window.app.component('lnbits-admin-fiat-providers', {
      }
      this.copyText(url)
    },
+    isClearnetWebhookUrl(url) {
+      let parsedUrl
+      try {
+        parsedUrl = new URL(url)
+      } catch (e) {
+        return false
+      }
+
+      const host = parsedUrl.hostname.toLowerCase()
+      if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+        return false
+      }
+      if (
+        host === 'localhost' ||
+        host.endsWith('.localhost') ||
+        host.endsWith('.local') ||
+        host.endsWith('.onion')
+      ) {
+        return false
+      }
+      if (
+        /^127\./.test(host) ||
+        /^10\./.test(host) ||
+        /^192\.168\./.test(host) ||
+        /^169\.254\./.test(host) ||
+        /^172\.(1[6-9]|2\d|3[0-1])\./.test(host) ||
+        host === '0.0.0.0' ||
+        host === '::1'
+      ) {
+        return false
+      }
+      return true
+    },
+    notifyRevolutWebhookWarning(message) {
+      Quasar.Notify.create({
+        type: 'warning',
+        message,
+        icon: null,
+        closeBtn: true
+      })
+    },
    addStripeAllowedUser() {
      const addUser = this.formAddStripeUser || ''
      if (
@@ -111,6 +163,40 @@ window.app.component('lnbits-admin-fiat-providers', {
      this.formData.paypal_limits.allowed_users =
        this.formData.paypal_limits.allowed_users.filter(u => u !== user)
    },
+    addSquareAllowedUser() {
+      const addUser = this.formAddSquareUser || ''
+      if (
+        addUser.length &&
+        !this.formData.square_limits.allowed_users.includes(addUser)
+      ) {
+        this.formData.square_limits.allowed_users = [
+          ...this.formData.square_limits.allowed_users,
+          addUser
+        ]
+        this.formAddSquareUser = ''
+      }
+    },
+    removeSquareAllowedUser(user) {
+      this.formData.square_limits.allowed_users =
+        this.formData.square_limits.allowed_users.filter(u => u !== user)
+    },
+    addRevolutAllowedUser() {
+      const addUser = this.formAddRevolutUser || ''
+      if (
+        addUser.length &&
+        !this.formData.revolut_limits.allowed_users.includes(addUser)
+      ) {
+        this.formData.revolut_limits.allowed_users = [
+          ...this.formData.revolut_limits.allowed_users,
+          addUser
+        ]
+        this.formAddRevolutUser = ''
+      }
+    },
+    removeRevolutAllowedUser(user) {
+      this.formData.revolut_limits.allowed_users =
+        this.formData.revolut_limits.allowed_users.filter(u => u !== user)
+    },
    checkFiatProvider(providerName) {
      LNbits.api
        .request('PUT', `/api/v1/fiat/check/${providerName}`)
@@ -124,6 +210,48 @@ window.app.component('lnbits-admin-fiat-providers', {
          })
        })
        .catch(LNbits.utils.notifyApiError)
+    },
+    createRevolutWebhook() {
+      const webhookUrl = this.calculateWebhookUrl('revolut')
+      this.formData.revolut_payment_webhook_url = webhookUrl
+
+      if (!this.formData.revolut_api_secret_key) {
+        this.notifyRevolutWebhookWarning(
+          'Add your Revolut API secret key before creating a webhook.'
+        )
+        return
+      }
+      if (!this.isClearnetWebhookUrl(webhookUrl)) {
+        this.notifyRevolutWebhookWarning(
+          'Revolut webhook URL must be a clearnet URL.'
+        )
+        return
+      }
+
+      this.creatingRevolutWebhook = true
+      LNbits.api
+        .request('POST', '/api/v1/fiat/revolut/webhook', null, {
+          url: webhookUrl,
+          endpoint: this.formData.revolut_api_endpoint,
+          api_secret_key: this.formData.revolut_api_secret_key,
+          api_version: this.formData.revolut_api_version
+        })
+        .then(response => {
+          const data = response.data
+          this.formData.revolut_payment_webhook_url = data.url
+          this.formData.revolut_webhook_signing_secret = data.signing_secret
+          Quasar.Notify.create({
+            type: 'positive',
+            message: `Revolut webhook ${
+              data.already_exists ? 'already exists' : 'created'
+            }${data.id ? `: ${data.id}` : ''}.`,
+            icon: null
+          })
+        })
+        .catch(LNbits.utils.notifyApiError)
+        .finally(() => {
+          this.creatingRevolutWebhook = false
+        })
    }
  }
 })
@@ -202,7 +202,18 @@ window.app.component('lnbits-admin-funding-sources', {
          'Phoenixd',
          {
            phoenixd_api_endpoint: 'Endpoint',
-            phoenixd_api_password: 'Key'
+            phoenixd_api_password: 'Key',
+            phoenixd_data_dir: {
+              label: 'Data Directory',
+              hint: 'Directory where phoenixd stores its data, including the seed phrase.'
+            },
+            phoenixd_mnemonic: {
+              label: 'Phoenixd Seed Phrase',
+              hint: 'Only available if phoenixd data-dir is specified',
+              readonly: true,
+              copy: true,
+              qrcode: true
+            }
          }
        ],
        [
@@ -41,5 +41,37 @@ window.app.component('lnbits-admin-site-customisation', {
      ]
    }
  },
-  methods: {}
+  methods: {
+    onBackgroundImageInput(e) {
+      const file = e.target.files[0]
+      if (file) {
+        this.uploadBackgroundImage(file)
+      }
+      e.target.value = null
+    },
+    async uploadBackgroundImage(file) {
+      const formData = new FormData()
+      formData.append('file', file)
+      try {
+        const {data} = await LNbits.api.request(
+          'POST',
+          '/api/v1/assets?public_asset=true',
+          null,
+          formData,
+          {
+            headers: {'Content-Type': 'multipart/form-data'}
+          }
+        )
+        const assetUrl = `${window.location.origin}/api/v1/assets/${data.id}/thumbnail`
+        this.formData.lnbits_default_bgimage = assetUrl
+        Quasar.Notify.create({
+          type: 'positive',
+          message: 'Background image uploaded.',
+          icon: null
+        })
+      } catch (e) {
+        LNbits.utils.notifyApiError(e)
+      }
+    }
+  }
 })
@@ -69,6 +69,14 @@ window.app.component('lnbits-theme', {
        document.body.classList.remove('card-shadow')
      }
    },
+    'g.burgerMenuChoice'(val) {
+      this.$q.localStorage.set('lnbits.burgerMenu', val)
+      if (val === true) {
+        document.body.classList.remove('no-burger-background')
+      } else {
+        document.body.classList.add('no-burger-background')
+      }
+    },
    'g.mobileSimple'(val) {
      this.$q.localStorage.set('lnbits.mobileSimple', val)
      if (val === true) {
@@ -150,6 +158,9 @@ window.app.component('lnbits-theme', {
    if (this.g.cardShadowChoice === true) {
      document.body.classList.add('card-shadow')
    }
+    if (this.g.burgerMenuChoice !== true) {
+      document.body.classList.add('no-burger-background')
+    }
    if (this.g.bgimageChoice !== '') {
      document.body.classList.add('bg-image')
      document.body.style.setProperty(
@@ -1,16 +1,17 @@
 function eventReaction(amount) {
  localUrl = ''
-  reaction = localStorage.getItem('lnbits.reactions')
-  if (!reaction || reaction === 'None') {
+  const reaction =
+    Quasar.LocalStorage.getItem('lnbits.reactions') || SETTINGS.defaultReaction
+  if (!reaction || reaction.toLowerCase() === 'none') {
    return
  }
+
  try {
    if (amount < 0) {
      return
    }
-    reaction = localStorage.getItem('lnbits.reactions')
-    if (reaction) {
-      window[reaction.split('|')[1]]()
+    if (typeof window[reaction] === 'function') {
+      window[reaction]()
    }
  } catch (e) {
    console.log(e)
@@ -29,6 +29,10 @@ window.g = Vue.reactive({
    SETTINGS.defaultCardGradient
  ),
  cardShadowChoice: localStore('lnbits.cardShadow', SETTINGS.defaultCardShadow),
+  burgerMenuChoice: localStore(
+    'lnbits.burgerMenu',
+    SETTINGS.defaultBurgerMenuBackground
+  ),
  reactionChoice: localStore('lnbits.reactions', SETTINGS.defaultReaction),
  bgimageChoice: localStore(
    'lnbits.backgroundImage',
@@ -545,31 +545,56 @@ window.PageAccount = {
      if (file) {
        this.uploadAsset(file)
      }
+      e.target.value = null
    },
-    async uploadAsset(file) {
+    onBackgroundImageInput(e) {
+      const file = e.target.files[0]
+      if (file) {
+        this.uploadBackgroundImage(file)
+      }
+      e.target.value = null
+    },
+    async uploadAsset(
+      file,
+      {isPublic = this.assetsUploadToPublic, notifySuccess = true} = {}
+    ) {
      const formData = new FormData()
      formData.append('file', file)
      try {
-        await LNbits.api.request(
+        const {data} = await LNbits.api.request(
          'POST',
-          `/api/v1/assets?public_asset=${this.assetsUploadToPublic}`,
+          `/api/v1/assets?public_asset=${isPublic}`,
          null,
          formData,
          {
            headers: {'Content-Type': 'multipart/form-data'}
          }
        )
-        this.$q.notify({
-          type: 'positive',
-          message: 'Upload successful!',
-          icon: null
-        })
+        if (notifySuccess) {
+          this.$q.notify({
+            type: 'positive',
+            message: 'Upload successful!',
+            icon: null
+          })
+        }
        await this.getUserAssets()
+        return data
      } catch (e) {
        console.warn(e)
        LNbits.utils.notifyApiError(e)
      }
    },
+    async uploadBackgroundImage(file) {
+      const asset = await this.uploadAsset(file, {
+        isPublic: false,
+        notifySuccess: false
+      })
+      if (!asset) {
+        return
+      }
+      const assetUrl = `${window.location.origin}/api/v1/assets/${asset.id}/thumbnail`
+      await this.siteCustomisationChanged({bgimageChoice: assetUrl})
+    },
    async deleteAsset(asset) {
      LNbits.utils
        .confirmDialog('Are you sure you want to delete this asset?')
@@ -707,7 +732,8 @@ window.PageAccount = {
        darkChoice: this.g.settings.defaultDark,
        cardRoundedChoice: this.g.settings.defaultCardRounded,
        cardGradientChoice: this.g.settings.defaultCardGradient,
-        cardShadowChoice: this.g.settings.defaultCardShadow
+        cardShadowChoice: this.g.settings.defaultCardShadow,
+        burgerMenuChoice: this.g.settings.defaultBurgerMenuBackground
      }
      this.siteCustomisationChanged(defaults)
    }
@@ -21,7 +21,7 @@ window.PageHome = {
      return (
        this.lnurl !== '' &&
        this.g.settings.allowRegister &&
-        'user-id-only' in this.g.settings.authMethods
+        this.g.settings.authMethods.includes('user-id-only')
      )
    },
    formatDescription() {
@@ -70,3 +70,12 @@ body.card-shadow.body--dark {
    filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
  }
 }
+
+body.no-burger-background {
+  .q-drawer {
+    background-color: transparent !important;
+    background-image: none !important;
+    backdrop-filter: none !important;
+    box-shadow: none !important;
+  }
+}
@@ -1,47 +0,0 @@
-/*
- * DOM element rendering detection
- * https://davidwalsh.name/detect-node-insertion
- */
-@keyframes chartjs-render-animation {
-	from { opacity: 0.99; }
-	to { opacity: 1; }
-}
-
-.chartjs-render-monitor {
-	animation: chartjs-render-animation 0.001s;
-}
-
-/*
- * DOM element resizing detection
- * https://github.com/marcj/css-element-queries
- */
-.chartjs-size-monitor,
-.chartjs-size-monitor-expand,
-.chartjs-size-monitor-shrink {
-	position: absolute;
-	direction: ltr;
-	left: 0;
-	top: 0;
-	right: 0;
-	bottom: 0;
-	overflow: hidden;
-	pointer-events: none;
-	visibility: hidden;
-	z-index: -1;
-}
-
-.chartjs-size-monitor-expand > div {
-	position: absolute;
-	width: 1000000px;
-	height: 1000000px;
-	left: 0;
-	top: 0;
-}
-
-.chartjs-size-monitor-shrink > div {
-	position: absolute;
-	width: 200%;
-	height: 200%;
-	left: 0;
-	top: 0;
-}
@@ -1,5 +1,5 @@
 /*!
- * qrcode.vue v3.6.0
+ * qrcode.vue v3.9.0
 * A Vue.js component to generate QRCode. Both support Vue 2 and Vue 3
 * © 2017-PRESENT @scopewu(https://github.com/scopewu)
 * MIT License.
@@ -909,7 +909,18 @@ var qrcodegen;
 })(qrcodegen || (qrcodegen = {}));
 var QR = qrcodegen;

+var _uid = 0;
+function getUid() {
+    if (typeof vue.useId === 'function') {
+        return "".concat(vue.useId(), "-").concat(_uid++);
+    }
+    return "vue-".concat(Math.random().toString(36).slice(2), "-").concat(_uid++);
+}
 var defaultErrorCorrectLevel = 'L';
+var DEFAULT_QR_SIZE = 100;
+var DEFAULT_MARGIN = 0;
+var DEFAULT_IMAGE_SIZE_RATIO = 0.1;
+var IMAGE_EXCAVATE_THICKNESS = 2;
 var ErrorCorrectLevelMap = {
    L: QR.QrCode.Ecc.LOW,
    M: QR.QrCode.Ecc.MEDIUM,
@@ -929,74 +940,139 @@ var SUPPORTS_PATH2D = (function () {
 function validErrorCorrectLevel(level) {
    return level in ErrorCorrectLevelMap;
 }
+function getNeighborFlags(modules, row, col) {
+    var north = row > 0 ? modules[row - 1][col] : false;
+    var south = row < modules.length - 1 ? modules[row + 1][col] : false;
+    var west = col > 0 ? modules[row][col - 1] : false;
+    var east = col < modules[row].length - 1 ? modules[row][col + 1] : false;
+    return {
+        nw: !north && !west,
+        ne: !north && !east,
+        se: !south && !east,
+        sw: !south && !west,
+    };
+}
+function generateRoundedPath(modules, margin, radius) {
+    if (margin === void 0) { margin = 0; }
+    if (radius === void 0) { radius = 0; }
+    var pathSegments = [];
+    var r = Math.min(radius, 0.5);
+    for (var row = 0; row < modules.length; row++) {
+        for (var col = 0; col < modules[row].length; col++) {
+            if (!modules[row][col])
+                continue;
+            var _a = getNeighborFlags(modules, row, col), nw = _a.nw, ne = _a.ne, se = _a.se, sw = _a.sw;
+            var x = col + margin;
+            var y = row + margin;
+            pathSegments.push("M".concat(x + (nw ? r : 0), " ").concat(y), "L".concat(x + 1 - (ne ? r : 0), " ").concat(y));
+            if (ne) {
+                pathSegments.push("A".concat(r, " ").concat(r, " 0 0 1 ").concat(x + 1, " ").concat(y + r));
+            }
+            pathSegments.push("L".concat(x + 1, " ").concat(y + 1 - (se ? r : 0)));
+            if (se) {
+                pathSegments.push("A".concat(r, " ").concat(r, " 0 0 1 ").concat(x + 1 - r, " ").concat(y + 1));
+            }
+            pathSegments.push("L".concat(x + (sw ? r : 0), " ").concat(y + 1));
+            if (sw) {
+                pathSegments.push("A".concat(r, " ").concat(r, " 0 0 1 ").concat(x, " ").concat(y + 1 - r));
+            }
+            pathSegments.push("L".concat(x, " ").concat(y + (nw ? r : 0)));
+            if (nw) {
+                pathSegments.push("A".concat(r, " ").concat(r, " 0 0 1 ").concat(x + r, " ").concat(y));
+            }
+            pathSegments.push('z');
+        }
+    }
+    return pathSegments.join('');
+}
 function generatePath(modules, margin) {
    if (margin === void 0) { margin = 0; }
-    var ops = [];
-    modules.forEach(function (row, y) {
+    var pathSegments = [];
+    for (var y = 0; y < modules.length; y++) {
+        var row = modules[y];
        var start = null;
-        row.forEach(function (cell, x) {
+        for (var x = 0; x < row.length; x++) {
+            var cell = row[x];
            if (!cell && start !== null) {
                // M0 0h7v1H0z injects the space with the move and drops the comma,
-                // saving a char per operation
-                ops.push("M".concat(start + margin, " ").concat(y + margin, "h").concat(x - start, "v1H").concat(start + margin, "z"));
+                pathSegments.push("M".concat(start + margin, " ").concat(y + margin, "h").concat(x - start, "v1H").concat(start + margin, "z"));
                start = null;
-                return;
+                continue;
            }
            // end of row, clean up or skip
            if (x === row.length - 1) {
                if (!cell) {
                    // We would have closed the op above already so this can only mean
                    // 2+ light modules in a row.
-                    return;
+                    continue;
                }
                if (start === null) {
                    // Just a single dark module.
-                    ops.push("M".concat(x + margin, ",").concat(y + margin, " h1v1H").concat(x + margin, "z"));
+                    pathSegments.push("M".concat(x + margin, ",").concat(y + margin, " h1v1H").concat(x + margin, "z"));
                }
                else {
                    // Otherwise finish the current line.
-                    ops.push("M".concat(start + margin, ",").concat(y + margin, " h").concat(x + 1 - start, "v1H").concat(start + margin, "z"));
+                    pathSegments.push("M".concat(start + margin, ",").concat(y + margin, " h").concat(x + 1 - start, "v1H").concat(start + margin, "z"));
                }
-                return;
+                continue;
            }
            if (cell && start === null) {
                start = x;
            }
-        });
-    });
-    return ops.join('');
+        }
+    }
+    return pathSegments.join('');
 }
 function getImageSettings(cells, size, margin, imageSettings) {
    var width = imageSettings.width, height = imageSettings.height, imageX = imageSettings.x, imageY = imageSettings.y;
    var numCells = cells.length + margin * 2;
-    var defaultSize = Math.floor(size * 0.1);
+    var defaultSize = Math.floor(size * DEFAULT_IMAGE_SIZE_RATIO);
    var scale = numCells / size;
    var w = (width || defaultSize) * scale;
    var h = (height || defaultSize) * scale;
    var x = imageX == null ? cells.length / 2 - w / 2 : imageX * scale;
    var y = imageY == null ? cells.length / 2 - h / 2 : imageY * scale;
-    var excavation = null;
-    if (imageSettings.excavate) {
-        var floorX = Math.floor(x);
-        var floorY = Math.floor(y);
-        var ceilW = Math.ceil(w + x - floorX);
-        var ceilH = Math.ceil(h + y - floorY);
-        excavation = { x: floorX, y: floorY, w: ceilW, h: ceilH };
-    }
-    return { x: x, y: y, h: h, w: w, excavation: excavation };
+    var borderRadius = (imageSettings.borderRadius || 0) * scale;
+    return { x: x, y: y, h: h, w: w, borderRadius: borderRadius };
 }
-function excavateModules(modules, excavation) {
-    return modules.slice().map(function (row, y) {
-        if (y < excavation.y || y >= excavation.y + excavation.h) {
-            return row;
-        }
-        return row.map(function (cell, x) {
-            if (x < excavation.x || x >= excavation.x + excavation.w) {
-                return cell;
-            }
-            return false;
-        });
+function useQRCode(props) {
+    var margin = vue.computed(function () { var _a; return ((_a = props.margin) !== null && _a !== void 0 ? _a : DEFAULT_MARGIN) >>> 0; });
+    var cells = vue.computed(function () {
+        var level = validErrorCorrectLevel(props.level) ? props.level : defaultErrorCorrectLevel;
+        return QR.QrCode.encodeText(props.value, ErrorCorrectLevelMap[level]).getModules();
    });
+    var numCells = vue.computed(function () { return cells.value.length + margin.value * 2; });
+    var fgPath = vue.computed(function () {
+        if (props.radius > 0) {
+            return generateRoundedPath(cells.value, margin.value, props.radius);
+        }
+        return generatePath(cells.value, margin.value);
+    });
+    var imageProps = vue.computed(function () {
+        if (!props.imageSettings.src)
+            return null;
+        var settings = getImageSettings(cells.value, props.size, margin.value, props.imageSettings);
+        return {
+            x: settings.x + margin.value,
+            y: settings.y + margin.value,
+            width: settings.w,
+            height: settings.h,
+            borderRadius: settings.borderRadius,
+        };
+    });
+    var imageBorderProps = vue.computed(function () {
+        if (!props.imageSettings.excavate || !imageProps.value)
+            return null;
+        var borderThickness = IMAGE_EXCAVATE_THICKNESS / (props.size / numCells.value);
+        return {
+            x: imageProps.value.x - borderThickness,
+            y: imageProps.value.y - borderThickness,
+            width: imageProps.value.width + borderThickness * 2,
+            height: imageProps.value.height + borderThickness * 2,
+            borderRadius: imageProps.value.borderRadius,
+        };
+    });
+    return { margin: margin, numCells: numCells, cells: cells, fgPath: fgPath, imageProps: imageProps, imageBorderProps: imageBorderProps };
 }
 var QRCodeProps = {
    value: {
@@ -1006,7 +1082,7 @@ var QRCodeProps = {
    },
    size: {
        type: Number,
-        default: 100,
+        default: DEFAULT_QR_SIZE,
    },
    level: {
        type: String,
@@ -1024,7 +1100,7 @@ var QRCodeProps = {
    margin: {
        type: Number,
        required: false,
-        default: 0,
+        default: DEFAULT_MARGIN,
    },
    imageSettings: {
        type: Object,
@@ -1052,6 +1128,12 @@ var QRCodeProps = {
        required: false,
        default: '#fff',
    },
+    radius: {
+        type: Number,
+        required: false,
+        default: 0,
+        validator: function (r) { return !isNaN(r) && r >= 0 && r <= 0.5; },
+    },
 };
 var QRCodeVueProps = __assign(__assign({}, QRCodeProps), { renderAs: {
        type: String,
@@ -1063,36 +1145,11 @@ var QrcodeSvg = vue.defineComponent({
    name: 'QRCodeSvg',
    props: QRCodeProps,
    setup: function (props) {
-        var numCells = vue.ref(0);
-        var fgPath = vue.ref('');
-        var imageProps;
-        var generate = function () {
-            var value = props.value, _level = props.level, _margin = props.margin;
-            var margin = _margin >>> 0;
-            var level = validErrorCorrectLevel(_level) ? _level : defaultErrorCorrectLevel;
-            var cells = QR.QrCode.encodeText(value, ErrorCorrectLevelMap[level]).getModules();
-            numCells.value = cells.length + margin * 2;
-            if (props.imageSettings.src) {
-                var imageSettings = getImageSettings(cells, props.size, margin, props.imageSettings);
-                imageProps = {
-                    x: imageSettings.x + margin,
-                    y: imageSettings.y + margin,
-                    width: imageSettings.w,
-                    height: imageSettings.h,
-                };
-                if (imageSettings.excavation) {
-                    cells = excavateModules(cells, imageSettings.excavation);
-                }
-            }
-            // Drawing strategy: instead of a rect per module, we're going to create a
-            // single path for the dark modules and layer that on top of a light rect,
-            // for a total of 2 DOM nodes. We pay a bit more in string concat but that's
-            // way faster than DOM ops.
-            // For level 1, 441 nodes -> 2
-            // For level 40, 31329 -> 2
-            fgPath.value = generatePath(cells, margin);
-        };
-        var renderGradient = function () {
+        var _a = useQRCode(props), numCells = _a.numCells, fgPath = _a.fgPath, imageProps = _a.imageProps, imageBorderProps = _a.imageBorderProps;
+        var uid = getUid();
+        var qrGradientId = "qrcode.vue-gradient-".concat(uid);
+        var qrLogoClipPathId = "qrcode.vue-logo-clip-path-".concat(uid);
+        var gradientVNode = vue.computed(function () {
            if (!props.gradient)
                return null;
            var gradientProps = props.gradientType === 'linear'
@@ -1109,7 +1166,7 @@ var QrcodeSvg = vue.defineComponent({
                    fx: '50%',
                    fy: '50%',
                };
-            return vue.h(props.gradientType === 'linear' ? 'linearGradient' : 'radialGradient', __assign({ id: 'qr-gradient' }, gradientProps), [
+            return vue.h(props.gradientType === 'linear' ? 'linearGradient' : 'radialGradient', __assign({ id: qrGradientId }, gradientProps), [
                vue.h('stop', {
                    offset: '0%',
                    style: { stopColor: props.gradientStartColor },
@@ -1119,27 +1176,52 @@ var QrcodeSvg = vue.defineComponent({
                    style: { stopColor: props.gradientEndColor },
                }),
            ]);
-        };
-        generate();
-        vue.onUpdated(generate);
+        });
+        var clipPathVNode = vue.computed(function () {
+            if (!imageProps.value)
+                return null;
+            var borderRadius = imageProps.value.borderRadius;
+            if (borderRadius <= 0)
+                return null;
+            return vue.h('clipPath', { id: qrLogoClipPathId }, [
+                vue.h('rect', {
+                    x: imageProps.value.x,
+                    y: imageProps.value.y,
+                    width: imageProps.value.width,
+                    height: imageProps.value.height,
+                    rx: borderRadius,
+                    ry: borderRadius,
+                }),
+            ]);
+        });
        return function () { return vue.h('svg', {
            width: props.size,
            height: props.size,
-            'shape-rendering': "crispEdges",
            xmlns: 'http://www.w3.org/2000/svg',
            viewBox: "0 0 ".concat(numCells.value, " ").concat(numCells.value),
+            role: 'img',
+            'aria-label': props.value,
        }, [
-            vue.h('defs', {}, [renderGradient()]),
+            vue.h('defs', {}, [gradientVNode.value, clipPathVNode.value]),
            vue.h('rect', {
                width: '100%',
                height: '100%',
                fill: props.background,
            }),
            vue.h('path', {
-                fill: props.gradient ? 'url(#qr-gradient)' : props.foreground,
+                fill: props.gradient ? "url(#".concat(qrGradientId, ")") : props.foreground,
                d: fgPath.value,
            }),
-            props.imageSettings.src && vue.h('image', __assign({ href: props.imageSettings.src }, imageProps)),
+            imageBorderProps.value && vue.h('rect', {
+                x: imageBorderProps.value.x,
+                y: imageBorderProps.value.y,
+                width: imageBorderProps.value.width,
+                height: imageBorderProps.value.height,
+                fill: props.background,
+                rx: imageBorderProps.value.borderRadius,
+                ry: imageBorderProps.value.borderRadius,
+            }),
+            props.imageSettings.src && imageProps.value && vue.h('image', __assign(__assign({ href: props.imageSettings.src }, imageProps.value), (imageProps.value.borderRadius > 0 ? { 'clip-path': "url(#".concat(qrLogoClipPathId, ")") } : {}))),
        ]); };
    },
 });
@@ -1147,81 +1229,89 @@ var QrcodeCanvas = vue.defineComponent({
    name: 'QRCodeCanvas',
    props: QRCodeProps,
    setup: function (props, ctx) {
+        var _a = useQRCode(props), margin = _a.margin, cells = _a.cells, numCells = _a.numCells, fgPath = _a.fgPath, imageProps = _a.imageProps, imageBorderProps = _a.imageBorderProps;
        var canvasEl = vue.ref(null);
-        var imageRef = vue.ref(null);
+        var imageEl = vue.ref(null);
+        var drawRoundedRect = function (ctx, x, y, width, height, radius) {
+            ctx.beginPath();
+            if (ctx.roundRect) {
+                ctx.roundRect(x, y, width, height, radius);
+            }
+            else {
+                ctx.rect(x, y, width, height);
+            }
+        };
        var generate = function () {
-            var value = props.value, _level = props.level, size = props.size, _margin = props.margin, background = props.background, foreground = props.foreground, gradient = props.gradient, gradientType = props.gradientType, gradientStartColor = props.gradientStartColor, gradientEndColor = props.gradientEndColor;
-            var margin = _margin >>> 0;
-            var level = validErrorCorrectLevel(_level) ? _level : defaultErrorCorrectLevel;
+            var size = props.size, background = props.background, foreground = props.foreground, gradient = props.gradient, gradientType = props.gradientType, gradientStartColor = props.gradientStartColor, gradientEndColor = props.gradientEndColor;
            var canvas = canvasEl.value;
            if (!canvas) {
                return;
            }
-            var ctx = canvas.getContext('2d');
-            if (!ctx) {
+            var canvasCtx = canvas.getContext('2d');
+            if (!canvasCtx) {
                return;
            }
-            var cells = QR.QrCode.encodeText(value, ErrorCorrectLevelMap[level]).getModules();
-            var numCells = cells.length + margin * 2;
-            var image = imageRef.value;
-            var imageProps = { x: 0, y: 0, width: 0, height: 0 };
-            var showImage = props.imageSettings.src && image != null && image.naturalWidth !== 0 && image.naturalHeight !== 0;
-            if (showImage) {
-                var imageSettings = getImageSettings(cells, props.size, margin, props.imageSettings);
-                imageProps = {
-                    x: imageSettings.x + margin,
-                    y: imageSettings.y + margin,
-                    width: imageSettings.w,
-                    height: imageSettings.h,
-                };
-                if (imageSettings.excavation) {
-                    cells = excavateModules(cells, imageSettings.excavation);
-                }
-            }
-            var devicePixelRatio = window.devicePixelRatio || 1;
-            var scale = (size / numCells) * devicePixelRatio;
+            var image = imageEl.value;
+            var devicePixelRatio = typeof window !== 'undefined' ? window.devicePixelRatio || 1 : 1;
+            var scale = (size / numCells.value) * devicePixelRatio;
            canvas.height = canvas.width = size * devicePixelRatio;
-            ctx.scale(scale, scale);
-            ctx.fillStyle = background;
-            ctx.fillRect(0, 0, numCells, numCells);
+            canvasCtx.setTransform(scale, 0, 0, scale, 0, 0);
+            canvasCtx.fillStyle = background;
+            canvasCtx.fillRect(0, 0, numCells.value, numCells.value);
            if (gradient) {
                var grad = void 0;
                if (gradientType === 'linear') {
-                    grad = ctx.createLinearGradient(0, 0, numCells, numCells);
+                    grad = canvasCtx.createLinearGradient(0, 0, numCells.value, numCells.value);
                }
                else {
-                    grad = ctx.createRadialGradient(numCells / 2, numCells / 2, 0, numCells / 2, numCells / 2, numCells / 2);
+                    grad = canvasCtx.createRadialGradient(numCells.value / 2, numCells.value / 2, 0, numCells.value / 2, numCells.value / 2, numCells.value / 2);
                }
                grad.addColorStop(0, gradientStartColor);
                grad.addColorStop(1, gradientEndColor);
-                ctx.fillStyle = grad;
+                canvasCtx.fillStyle = grad;
            }
            else {
-                ctx.fillStyle = foreground;
+                canvasCtx.fillStyle = foreground;
            }
            if (SUPPORTS_PATH2D) {
-                ctx.fill(new Path2D(generatePath(cells, margin)));
+                canvasCtx.fill(new Path2D(fgPath.value));
            }
            else {
-                cells.forEach(function (row, rdx) {
+                cells.value.forEach(function (row, rdx) {
                    row.forEach(function (cell, cdx) {
                        if (cell) {
-                            ctx.fillRect(cdx + margin, rdx + margin, 1, 1);
+                            canvasCtx.fillRect(cdx + margin.value, rdx + margin.value, 1, 1);
                        }
                    });
                });
            }
-            if (showImage) {
-                ctx.drawImage(image, imageProps.x, imageProps.y, imageProps.width, imageProps.height);
+            var showImage = props.imageSettings.src && image && image.naturalWidth !== 0 && image.naturalHeight !== 0;
+            if (showImage && imageProps.value) {
+                if (imageBorderProps.value) {
+                    var imageBorder = imageBorderProps.value;
+                    canvasCtx.fillStyle = props.background;
+                    drawRoundedRect(canvasCtx, imageBorder.x, imageBorder.y, imageBorder.width, imageBorder.height, imageBorder.borderRadius);
+                    canvasCtx.fill();
+                }
+                var borderRadius = imageProps.value.borderRadius;
+                if (borderRadius > 0) {
+                    canvasCtx.save();
+                    drawRoundedRect(canvasCtx, imageProps.value.x, imageProps.value.y, imageProps.value.width, imageProps.value.height, borderRadius);
+                    canvasCtx.clip();
+                    canvasCtx.drawImage(image, imageProps.value.x, imageProps.value.y, imageProps.value.width, imageProps.value.height);
+                    canvasCtx.restore();
+                }
+                else {
+                    canvasCtx.drawImage(image, imageProps.value.x, imageProps.value.y, imageProps.value.width, imageProps.value.height);
+                }
            }
        };
        vue.onMounted(generate);
-        vue.onUpdated(generate);
-        var style = ctx.attrs.style;
+        vue.watchEffect(generate);
        return function () { return vue.h(vue.Fragment, [
-            vue.h('canvas', __assign(__assign({}, ctx.attrs), { ref: canvasEl, style: __assign(__assign({}, style), { width: "".concat(props.size, "px"), height: "".concat(props.size, "px") }) })),
+            vue.h('canvas', __assign(__assign({}, ctx.attrs), { ref: canvasEl, role: 'img', 'aria-label': props.value, style: __assign(__assign({}, ctx.attrs.style), { width: "".concat(props.size, "px"), height: "".concat(props.size, "px") }) })),
            props.imageSettings.src && vue.h('img', {
-                ref: imageRef,
+                ref: imageEl,
                src: props.imageSettings.src,
                style: { display: 'none' },
                onLoad: generate,
@@ -1231,23 +1321,23 @@ var QrcodeCanvas = vue.defineComponent({
 });
 var QrcodeVue = vue.defineComponent({
    name: 'Qrcode',
-    render: function () {
-        var _a = this.$props, renderAs = _a.renderAs, value = _a.value, size = _a.size, margin = _a.margin, level = _a.level, background = _a.background, foreground = _a.foreground, imageSettings = _a.imageSettings, gradient = _a.gradient, gradientType = _a.gradientType, gradientStartColor = _a.gradientStartColor, gradientEndColor = _a.gradientEndColor;
-        return vue.h(renderAs === 'svg' ? QrcodeSvg : QrcodeCanvas, {
-            value: value,
-            size: size,
-            margin: margin,
-            level: level,
-            background: background,
-            foreground: foreground,
-            imageSettings: imageSettings,
-            gradient: gradient,
-            gradientType: gradientType,
-            gradientStartColor: gradientStartColor,
-            gradientEndColor: gradientEndColor,
-        });
-    },
    props: QRCodeVueProps,
+    setup: function (props) {
+        return function () { return vue.h(props.renderAs === 'svg' ? QrcodeSvg : QrcodeCanvas, {
+            value: props.value,
+            size: props.size,
+            margin: props.margin,
+            level: props.level,
+            background: props.background,
+            foreground: props.foreground,
+            imageSettings: props.imageSettings,
+            gradient: props.gradient,
+            gradientType: props.gradientType,
+            gradientStartColor: props.gradientStartColor,
+            gradientEndColor: props.gradientEndColor,
+            radius: props.radius,
+        }); };
+    },
 });

 exports.QrcodeCanvas = QrcodeCanvas;
@@ -43,8 +43,7 @@ summary {
 abbr[title] {
  border-bottom: none;
  text-decoration: underline;
-  -webkit-text-decoration: underline dotted;
-          text-decoration: underline dotted;
+  text-decoration: underline dotted;
 }

 /**
@@ -200,8 +199,7 @@ input[type=search]::-webkit-search-decoration {
 .material-symbols-outlined,
 .material-symbols-rounded,
 .material-symbols-sharp {
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
  cursor: inherit;
  font-size: inherit;
  display: inline-flex;
@@ -998,8 +996,7 @@ input[type=search]::-webkit-search-decoration {
  height: 1px;
 }
 .q-checkbox__bg, .q-checkbox__icon-container {
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
 }
 .q-checkbox__bg {
  top: 25%;
@@ -2212,8 +2209,7 @@ body.q-ios-padding .q-dialog__inner > div {
  width: 100%;
  min-width: 0;
  outline: 0 !important;
-  -webkit-user-select: auto;
-          user-select: auto;
+  user-select: auto;
 }
 .q-field__native:-webkit-autofill, .q-field__input:-webkit-autofill {
  -webkit-animation-name: q-autofill;
@@ -3039,8 +3035,7 @@ body.body--dark .q-knob--editable:focus:before {
  z-index: 2001;
  height: 100%;
  width: 15px;
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
 }

 .q-layout, .q-header, .q-footer, .q-page {
@@ -3297,8 +3292,7 @@ body.platform-ios .q-layout--containerized {
  height: 1px;
 }
 .q-radio__bg, .q-radio__icon-container {
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
 }
 .q-radio__bg {
  top: 25%;
@@ -3782,8 +3776,7 @@ body.platform-ios:not(.native-mobile) .q-dialog__inner--top .q-select__dialog--f
 .q-slide-item__content {
  background: inherit;
  transition: transform 0.2s ease-in;
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
  cursor: pointer;
 }

@@ -4156,8 +4149,7 @@ body.desktop .q-slider.q-slider--enabled .q-slider__track-container:hover .q-sli
 }
 .q-splitter__separator {
  background-color: rgba(0, 0, 0, 0.12);
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
  position: relative;
  z-index: 1;
 }
@@ -4246,8 +4238,7 @@ body.desktop .q-slider.q-slider--enabled .q-slider__track-container:hover .q-sli
  color: #000;
 }
 .q-stepper__tab--navigation {
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
  cursor: pointer;
 }
 .q-stepper__tab--active, .q-stepper__tab--done {
@@ -4479,8 +4470,7 @@ body.desktop .q-slider.q-slider--enabled .q-slider__track-container:hover .q-sli
 .q-table th {
  font-weight: 500;
  font-size: 12px;
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
 }
 .q-table th.sortable {
  cursor: pointer;
@@ -5484,8 +5474,7 @@ body.desktop .q-table > tbody > tr:not(.q-tr--no-hover):hover > td:not(.q-td--no
  width: 0.5em;
  height: 0.5em;
  transition: left 0.22s cubic-bezier(0.4, 0, 0.2, 1);
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
  z-index: 0;
 }
 .q-toggle__thumb:after {
@@ -10337,6 +10326,7 @@ body.body--dark .inset-shadow-down {
 .glossy {
  background-image: linear-gradient(to bottom, rgba(255, 255, 255, 0.3), rgba(255, 255, 255, 0) 50%, rgba(0, 0, 0, 0.12) 51%, rgba(0, 0, 0, 0.04)) !important;
 }
+
 .q-placeholder::placeholder {
  color: inherit;
  opacity: 0.7;
@@ -10368,8 +10358,7 @@ body.body--dark .inset-shadow-down {
  text-decoration: none;
 }
 .q-link--focusable:focus-visible {
-  -webkit-text-decoration: underline dashed currentColor 1px;
-          text-decoration: underline dashed currentColor 1px;
+  text-decoration: underline dashed currentColor 1px;
 }

 body.electron .q-electron-drag {
@@ -10386,8 +10375,7 @@ img.responsive {
 }

 .non-selectable {
-  -webkit-user-select: none !important;
-          user-select: none !important;
+  user-select: none !important;
 }

 .scroll,
@@ -11045,8 +11033,7 @@ body.q-ios-padding .fullscreen {
 }

 .q-touch {
-  -webkit-user-select: none;
-          user-select: none;
+  user-select: none;
  user-drag: none;
  -khtml-user-drag: none;
  -webkit-user-drag: none;
@@ -90,7 +90,9 @@
      window.g.isPublicPage = false
      {% endif %}
    </script>
-    {% endif %}
+    {% endif %} {% for url in INCLUDED_EXTENSION_I18N %}
+    <script src="{{ url }}"></script>
+    {% endfor %}
    <!-- app init -->
    <script>
      window.app = Vue.createApp({
@@ -774,7 +774,13 @@ include('components/lnbits-error.vue') %}
          v-model="password"
          name="password"
          :label="$t('password') + ' *'"
-          type="password"
+          :type="showPwd ? 'text' : 'password'"
+          ><template v-slot:append>
+            <q-icon
+              :name="showPwd ? 'visibility' : 'visibility_off'"
+              class="cursor-pointer"
+              @click="showPwd = !showPwd"
+            /> </template
        ></q-input>
        <div class="row justify-end">
          <q-btn
@@ -803,16 +809,28 @@ include('components/lnbits-error.vue') %}
          filled
          v-model="password"
          :label="$t('password') + ' *'"
-          type="password"
+          :type="showPwd ? 'text' : 'password'"
          :rules="[val => !val || val.length >= 8 || $t('invalid_password')]"
+          ><template v-slot:append>
+            <q-icon
+              :name="showPwd ? 'visibility' : 'visibility_off'"
+              class="cursor-pointer"
+              @click="showPwd = !showPwd"
+            /> </template
        ></q-input>
        <q-input
          dense
          filled
          v-model="passwordRepeat"
          :label="$t('password_repeat') + ' *'"
-          type="password"
+          :type="showPwdRepeat ? 'text' : 'password'"
          :rules="[val => !val || val.length >= 8 || $t('invalid_password')]"
+          ><template v-slot:append>
+            <q-icon
+              :name="showPwdRepeat ? 'visibility' : 'visibility_off'"
+              class="cursor-pointer"
+              @click="showPwdRepeat = !showPwdRepeat"
+            /> </template
        ></q-input>
        <div
          v-if="confirmationMethodsCount > 1"
@@ -925,16 +943,28 @@ include('components/lnbits-error.vue') %}
          filled
          v-model="password"
          :label="$t('password') + ' *'"
-          type="password"
+          :type="showPwd ? 'text' : 'password'"
          :rules="[val => !val || val.length >= 8 || $t('invalid_password')]"
+          ><template v-slot:append>
+            <q-icon
+              :name="showPwd ? 'visibility' : 'visibility_off'"
+              class="cursor-pointer"
+              @click="showPwd = !showPwd"
+            /> </template
        ></q-input>
        <q-input
          dense
          filled
          v-model="passwordRepeat"
          :label="$t('password_repeat') + ' *'"
-          type="password"
+          :type="showPwdRepeat ? 'text' : 'password'"
          :rules="[val => !val || val.length >= 8 || $t('invalid_password')]"
+          ><template v-slot:append>
+            <q-icon
+              :name="showPwdRepeat ? 'visibility' : 'visibility_off'"
+              class="cursor-pointer"
+              @click="showPwdRepeat = !showPwdRepeat"
+            /> </template
        ></q-input>
        <div class="row justify-end">
          <q-btn
@@ -587,12 +587,544 @@
            <q-item-section> Square </q-item-section>

            <q-item-section side>
-              <div class="row items-center">Disabled</div>
+              <div class="row items-center">
+                <q-toggle
+                  size="md"
+                  :label="$t('enabled')"
+                  v-model="formData.square_enabled"
+                  color="green"
+                  unchecked-icon="clear"
+                />
+              </div>
            </q-item-section>
          </template>

-          <q-card>
-            <q-card-section> Coming Soon </q-card-section>
+          <q-card class="q-pb-xl">
+            <q-expansion-item :label="$t('api')" default-opened>
+              <q-card-section class="q-pa-md">
+                <q-input
+                  filled
+                  type="text"
+                  v-model="formData.square_api_endpoint"
+                  :label="$t('endpoint')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  v-model="formData.square_access_token"
+                  :label="$t('access_token')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  type="text"
+                  v-model="formData.square_location_id"
+                  :label="$t('location_id')"
+                  :hint="$t('square_location_id_hint')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  type="text"
+                  v-model="formData.square_api_version"
+                  :label="$t('api_version')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  type="text"
+                  v-model="formData.square_payment_success_url"
+                  :label="$t('callback_success_url')"
+                  :hint="$t('callback_success_url_hint')"
+                ></q-input>
+              </q-card-section>
+              <q-card-section class="q-pa-md">
+                <div class="row">
+                  <div class="col">
+                    <q-btn
+                      outline
+                      color="grey"
+                      class="float-right"
+                      :label="$t('check_connection')"
+                      @click="checkFiatProvider('square')"
+                    ></q-btn>
+                  </div>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+
+            <q-expansion-item :label="$t('webhook')" default-opened>
+              <q-card-section>
+                <span v-text="$t('webhook_square_description')"></span>
+              </q-card-section>
+              <q-card-section>
+                <div class="row items-center q-gutter-sm q-mt-md">
+                  <div class="col">
+                    <q-input
+                      filled
+                      type="text"
+                      v-model="formData.square_payment_webhook_url"
+                      :label="$t('webhook_url')"
+                      :hint="$t('square_webhook_url_hint')"
+                    ></q-input>
+                  </div>
+                  <div class="col-auto">
+                    <q-btn
+                      outline
+                      color="grey"
+                      icon="content_copy"
+                      @click="
+                        copyWebhookUrl(formData.square_payment_webhook_url)
+                      "
+                      :aria-label="$t('copy_webhook_url')"
+                    >
+                      <q-tooltip>
+                        <span v-text="$t('copy_webhook_url')"></span>
+                      </q-tooltip>
+                    </q-btn>
+                  </div>
+                </div>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  v-model="formData.square_webhook_signature_key"
+                  :label="$t('signing_secret')"
+                  :hint="$t('square_webhook_signature_key_hint')"
+                ></q-input>
+              </q-card-section>
+              <q-card-section>
+                <span v-text="$t('webhook_events_list')"></span>
+                <ul>
+                  <li><code>payment.updated</code></li>
+                  <li><code>invoice.payment_made</code></li>
+                </ul>
+              </q-card-section>
+            </q-expansion-item>
+
+            <q-expansion-item :label="$t('service_fee')">
+              <q-card-section>
+                <div class="row">
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.square_limits.service_fee_percent"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('service_fee_label')"
+                      :hint="$t('service_fee_hint')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.square_limits.service_max_fee_sats"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('service_fee_max')"
+                      :hint="$t('service_fee_max_hint')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="text"
+                      v-model="formData.square_limits.service_fee_wallet_id"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('fee_wallet_label')"
+                      :hint="$t('fee_wallet_hint')"
+                    ></q-input>
+                  </div>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+            <q-expansion-item :label="$t('amount_limits')">
+              <q-card-section>
+                <div class="row">
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.square_limits.service_min_amount_sats"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('min_incoming_payment_amount')"
+                      :hint="$t('min_incoming_payment_amount_desc')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.square_limits.service_max_amount_sats"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('max_incoming_payment_amount')"
+                      :hint="$t('max_incoming_payment_amount_desc')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      v-model="formData.square_limits.service_faucet_wallet_id"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('faucest_wallet_id')"
+                      :hint="$t('faucest_wallet_id_hint')"
+                    ></q-input>
+                  </div>
+                </div>
+                <q-item>
+                  <q-item-section>
+                    <q-item-label v-text="$t('faucest_wallet')"></q-item-label>
+                    <q-item-label caption>
+                      <ul>
+                        <li>
+                          <span
+                            v-text="
+                              $t('faucest_wallet_desc_1', {
+                                provider: 'square'
+                              })
+                            "
+                          ></span>
+                        </li>
+                        <li>
+                          <span
+                            v-text="
+                              $t('faucest_wallet_desc_2', {
+                                provider: 'square'
+                              })
+                            "
+                          ></span>
+                        </li>
+                        <li>
+                          <span v-text="$t('faucest_wallet_desc_3')"></span>
+                        </li>
+                        <li>
+                          <span
+                            v-text="
+                              $t('faucest_wallet_desc_4', {
+                                provider: 'square'
+                              })
+                            "
+                          ></span>
+                        </li>
+                        <li>
+                          <span v-text="$t('faucest_wallet_desc_5')"></span>
+                        </li>
+                      </ul>
+                      <br />
+                    </q-item-label>
+                  </q-item-section>
+                </q-item>
+              </q-card-section>
+            </q-expansion-item>
+            <q-expansion-item :label="$t('allowed_users')">
+              <q-card-section>
+                <q-input
+                  filled
+                  v-model="formAddSquareUser"
+                  @keydown.enter="addSquareAllowedUser"
+                  type="text"
+                  :label="$t('allowed_users_label')"
+                  :hint="
+                    $t('allowed_users_hint_feature', {
+                      feature: 'Square'
+                    })
+                  "
+                >
+                  <q-btn
+                    @click="addSquareAllowedUser"
+                    dense
+                    flat
+                    icon="add"
+                  ></q-btn>
+                </q-input>
+                <div>
+                  <q-chip
+                    v-for="user in formData.square_limits.allowed_users"
+                    @update:model-value="formData.touch = null"
+                    :key="user"
+                    removable
+                    @remove="removeSquareAllowedUser(user)"
+                    color="primary"
+                    text-color="white"
+                    :label="user"
+                    class="ellipsis"
+                  >
+                  </q-chip>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+          </q-card>
+        </q-expansion-item>
+        <q-separator></q-separator>
+        <q-expansion-item header-class="text-primary text-bold">
+          <template v-slot:header>
+            <q-item-section avatar>
+              <q-avatar color="deep-orange-7" text-color="white">R</q-avatar>
+            </q-item-section>
+
+            <q-item-section> Revolut </q-item-section>
+
+            <q-item-section side>
+              <div class="row items-center">
+                <q-toggle
+                  size="md"
+                  :label="$t('enabled')"
+                  v-model="formData.revolut_enabled"
+                  color="green"
+                  unchecked-icon="clear"
+                />
+              </div>
+            </q-item-section>
+          </template>
+
+          <q-card class="q-pb-xl">
+            <q-expansion-item :label="$t('api')" default-opened>
+              <q-card-section class="q-pa-md">
+                <q-input
+                  filled
+                  type="text"
+                  v-model="formData.revolut_api_endpoint"
+                  :label="$t('endpoint')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  v-model="formData.revolut_api_secret_key"
+                  label="API secret key"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  type="text"
+                  v-model="formData.revolut_api_version"
+                  :label="$t('api_version')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  type="text"
+                  v-model="formData.revolut_payment_success_url"
+                  :label="$t('callback_success_url')"
+                  :hint="$t('callback_success_url_hint')"
+                ></q-input>
+              </q-card-section>
+              <q-card-section class="q-pa-md">
+                <div class="row">
+                  <div class="col">
+                    <q-btn
+                      outline
+                      color="grey"
+                      class="float-right"
+                      :label="$t('check_connection')"
+                      @click="checkFiatProvider('revolut')"
+                    ></q-btn>
+                  </div>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+
+            <q-expansion-item :label="$t('webhook')" default-opened>
+              <q-card-section>
+                Configure a Revolut Merchant webhook that points to your LNbits
+                server. LNbits will create it through the Revolut API and
+                subscribe to <code>ORDER_AUTHORISED</code>,
+                <code>ORDER_COMPLETED</code>, and
+                <code>SUBSCRIPTION_INITIATED</code>.
+              </q-card-section>
+              <q-card-section>
+                <div class="row items-center q-gutter-sm q-mt-md">
+                  <div class="col">
+                    <q-input
+                      filled
+                      type="text"
+                      disable
+                      :model-value="revolutWebhookUrl"
+                      :label="$t('webhook_url')"
+                      readonly
+                    ></q-input>
+                  </div>
+                  <div class="col-auto">
+                    <q-btn
+                      outline
+                      color="grey"
+                      icon="content_copy"
+                      @click="copyWebhookUrl(revolutWebhookUrl)"
+                      :aria-label="$t('copy_webhook_url')"
+                    >
+                      <q-tooltip>
+                        <span v-text="$t('copy_webhook_url')"></span>
+                      </q-tooltip>
+                    </q-btn>
+                  </div>
+                </div>
+                <div class="row items-center q-gutter-sm q-mt-md">
+                  <q-btn
+                    type="button"
+                    color="primary"
+                    icon="add_link"
+                    label="Create webhook"
+                    :loading="creatingRevolutWebhook"
+                    @click="createRevolutWebhook"
+                  ></q-btn>
+                  <q-chip
+                    v-if="formData.revolut_webhook_signing_secret"
+                    dense
+                    color="positive"
+                    text-color="white"
+                    icon="verified"
+                  >
+                    Signing secret saved
+                  </q-chip>
+                </div>
+              </q-card-section>
+              <q-card-section>
+                <span v-text="$t('webhook_events_list')"></span>
+                <ul>
+                  <li>
+                    <code>ORDER_AUTHORISED</code>
+                  </li>
+                  <li>
+                    <code>ORDER_COMPLETED</code>
+                  </li>
+                  <li>
+                    <code>SUBSCRIPTION_INITIATED</code>
+                  </li>
+                </ul>
+              </q-card-section>
+            </q-expansion-item>
+
+            <q-expansion-item :label="$t('service_fee')">
+              <q-card-section>
+                <div class="row">
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.revolut_limits.service_fee_percent"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('service_fee_label')"
+                      :hint="$t('service_fee_hint')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.revolut_limits.service_max_fee_sats"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('service_fee_max')"
+                      :hint="$t('service_fee_max_hint')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="text"
+                      v-model="formData.revolut_limits.service_fee_wallet_id"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('fee_wallet_label')"
+                      :hint="$t('fee_wallet_hint')"
+                    ></q-input>
+                  </div>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+
+            <q-expansion-item :label="$t('amount_limits')">
+              <q-card-section>
+                <div class="row">
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.revolut_limits.service_min_amount_sats"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('min_incoming_payment_amount')"
+                      :hint="$t('min_incoming_payment_amount_desc')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.revolut_limits.service_max_amount_sats"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('max_incoming_payment_amount')"
+                      :hint="$t('max_incoming_payment_amount_desc')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      v-model="formData.revolut_limits.service_faucet_wallet_id"
+                      @update:model-value="formData.touch = null"
+                      :label="$t('faucest_wallet_id')"
+                      :hint="$t('faucest_wallet_id_hint')"
+                    ></q-input>
+                  </div>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+
+            <q-expansion-item :label="$t('allowed_users')">
+              <q-card-section>
+                <q-input
+                  filled
+                  v-model="formAddRevolutUser"
+                  @keydown.enter="addRevolutAllowedUser"
+                  type="text"
+                  :label="$t('allowed_users_label')"
+                  :hint="
+                    $t('allowed_users_hint_feature', {
+                      feature: 'Revolut'
+                    })
+                  "
+                >
+                  <q-btn
+                    @click="addRevolutAllowedUser"
+                    dense
+                    flat
+                    icon="add"
+                  ></q-btn>
+                </q-input>
+                <div>
+                  <q-chip
+                    v-for="user in formData.revolut_limits.allowed_users"
+                    @update:model-value="formData.touch = null"
+                    :key="user"
+                    removable
+                    @remove="removeRevolutAllowedUser(user)"
+                    color="primary"
+                    text-color="white"
+                    :label="user"
+                    class="ellipsis"
+                  >
+                  </q-chip>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
          </q-card>
        </q-expansion-item>
      </q-list>
@@ -640,9 +1172,22 @@
            >
          </div>
          <div class="row items-center q-gutter-sm">
-            <div class="text-bold" style="min-width: 140px">
-              Square (coming soon)
-            </div>
+            <div class="text-bold" style="min-width: 140px">Square</div>
+            <q-chip dense color="positive" text-color="white" icon="check"
+              >Checkout</q-chip
+            >
+            <q-chip dense color="warning" text-color="black" icon="schedule"
+              >Subscriptions coming soon</q-chip
+            >
+            <q-chip dense color="negative" text-color="white" icon="close"
+              >Tap-to-pay</q-chip
+            >
+            <q-chip dense color="grey-9" text-color="white" icon="public"
+              >Regions: Square-supported countries</q-chip
+            >
+          </div>
+          <div class="row items-center q-gutter-sm">
+            <div class="text-bold" style="min-width: 140px">Revolut</div>
            <q-chip dense color="positive" text-color="white" icon="check"
              >Checkout</q-chip
            >
@@ -653,7 +1198,7 @@
              >Tap-to-pay</q-chip
            >
            <q-chip dense color="grey-9" text-color="white" icon="public"
-              >Regions: Global</q-chip
+              >Regions: Revolut-supported countries</q-chip
            >
          </div>
        </div>
@@ -52,6 +52,7 @@
              :label="prop.label"
              :hint="prop.hint"
              :value="prop.value"
+              :readonly="prop.readonly || false"
            >
              <q-btn
                v-if="prop.copy"
@@ -73,6 +74,15 @@
              ></q-btn>
            </q-input>
          </div>
+          <p
+            v-if="fund === 'PhoenixdWallet' && key === 'phoenixd_mnemonic'"
+            class="col-12 q-my-md"
+          >
+            <span>
+              <q-icon name="warning" color="orange" size="xs"></q-icon>
+              <span v-text="$t('phoenixd_warning')"></span>
+            </span>
+          </p>
        </div>
        <q-expansion-item
          v-if="
@@ -251,10 +251,27 @@
            type="text"
            v-model="formData.lnbits_default_bgimage"
            label="Background Image"
-            @update:model-value="applyGlobalBgimage"
            hint="This must be a trusted source. It can change the content and it can log your IP address."
          >
+            <template v-slot:append>
+              <q-btn
+                dense
+                flat
+                round
+                icon="upload"
+                @click="$refs.adminBackgroundImageInput.click()"
+              >
+                <q-tooltip>Upload background image</q-tooltip>
+              </q-btn>
+            </template>
          </q-input>
+          <input
+            type="file"
+            ref="adminBackgroundImageInput"
+            accept="image/*"
+            style="display: none"
+            @change="onBackgroundImageInput"
+          />
        </div>
      </div>
      <div class="row q-col-gutter-md q-mb-md">
@@ -303,6 +320,15 @@
          >
          </q-toggle>
        </div>
+        <div class="col-12 col-sm-6 col-lg-2">
+          <q-toggle
+            type="bool"
+            v-model="formData.lnbits_default_burger_menu_background"
+            color="primary"
+            :label="$t('burger_menu_background')"
+          >
+          </q-toggle>
+        </div>
      </div>
    </div>
  </q-card-section>
@@ -492,10 +492,28 @@
                          siteCustomisationChanged({bgimageChoice: $event})
                        "
                      >
+                        <template v-slot:append>
+                          <q-btn
+                            dense
+                            flat
+                            round
+                            icon="upload"
+                            @click="$refs.backgroundImageInput.click()"
+                          >
+                            <q-tooltip>Upload background image</q-tooltip>
+                          </q-btn>
+                        </template>
                        <q-tooltip
                          ><span v-text="$t('background_image')"></span
                        ></q-tooltip>
                      </q-input>
+                      <input
+                        type="file"
+                        ref="backgroundImageInput"
+                        accept="image/*"
+                        style="display: none"
+                        @change="onBackgroundImageInput"
+                      />
                    </div>
                  </div>
                  <div class="row q-mb-md">
@@ -583,6 +601,30 @@
                    </div>
                  </div>

+                  <div class="row q-mb-md">
+                    <div class="col-4">
+                      <span v-text="$t('burger_menu_background')"></span>
+                    </div>
+                    <div class="col-8">
+                      <q-toggle
+                        dense
+                        flat
+                        round
+                        icon="menu_open"
+                        v-model="g.burgerMenuChoice"
+                        @update:model-value="
+                          siteCustomisationChanged({burgerMenuChoice: $event})
+                        "
+                      >
+                        <q-tooltip
+                          ><span
+                            v-text="$t('toggle_burger_menu_background')"
+                          ></span
+                        ></q-tooltip>
+                      </q-toggle>
+                    </div>
+                  </div>
+
                  <div class="row q-mb-md">
                    <div class="col-4">
                      <span v-text="$t('toggle_darkmode')"></span>
@@ -1108,82 +1150,130 @@
                            <q-separator></q-separator>

                            <q-card-section>
-                              <q-btn-dropdown
-                                color="grey"
-                                dense
-                                outline
-                                no-caps
-                                :label="props.row.name"
-                                :icon="props.row.is_public ? 'public' : ''"
+                              <div
+                                class="row items-center no-wrap q-col-gutter-sm"
                              >
-                                <q-list>
-                                  <q-item
-                                    clickable
-                                    v-close-popup
-                                    @click="copyAssetLinkToClipboard(props.row)"
+                                <div class="col">
+                                  <q-btn-dropdown
+                                    color="grey"
+                                    dense
+                                    outline
+                                    no-caps
+                                    class="full-width"
+                                    :label="props.row.name"
+                                    :icon="props.row.is_public ? 'public' : ''"
                                  >
-                                    <q-item-section avatar>
-                                      <q-avatar icon="content_copy" />
-                                    </q-item-section>
-                                    <q-item-section>
-                                      <q-item-label>Copy Link</q-item-label>
-                                      <q-item-label caption
-                                        >Copy asset link to
-                                        clipboard</q-item-label
-                                      >
-                                    </q-item-section>
-                                  </q-item>
-
-                                  <q-item
-                                    clickable
-                                    v-close-popup
-                                    @click="toggleAssetPublicAccess(props.row)"
-                                  >
-                                    <q-item-section avatar>
-                                      <q-avatar
-                                        :icon="
-                                          props.row.is_public
-                                            ? 'public_off'
-                                            : 'public'
+                                    <q-list>
+                                      <q-item
+                                        clickable
+                                        v-close-popup
+                                        @click="
+                                          copyAssetLinkToClipboard(props.row)
                                        "
-                                        text-color="primary"
-                                      />
-                                    </q-item-section>
-                                    <q-item-section v-if="props.row.is_public">
-                                      <q-item-label>Unpublish</q-item-label>
-                                      <q-item-label caption
-                                        >Make this asset private</q-item-label
                                      >
-                                    </q-item-section>
-                                    <q-item-section v-else>
-                                      <q-item-label>Publish</q-item-label>
-                                      <q-item-label caption
-                                        >Make this asset public</q-item-label
-                                      >
-                                    </q-item-section>
-                                  </q-item>
+                                        <q-item-section avatar>
+                                          <q-avatar icon="content_copy" />
+                                        </q-item-section>
+                                        <q-item-section>
+                                          <q-item-label>Copy Link</q-item-label>
+                                          <q-item-label caption
+                                            >Copy asset link to
+                                            clipboard</q-item-label
+                                          >
+                                        </q-item-section>
+                                      </q-item>

-                                  <q-item
-                                    clickable
-                                    v-close-popup
-                                    @click="deleteAsset(props.row)"
-                                  >
-                                    <q-item-section avatar>
-                                      <q-avatar
-                                        icon="delete"
-                                        text-color="negative"
-                                      />
-                                    </q-item-section>
-                                    <q-item-section>
-                                      <q-item-label>Delete</q-item-label>
-                                      <q-item-label caption
-                                        >Permanently delete this
-                                        asset</q-item-label
+                                      <q-item
+                                        clickable
+                                        v-close-popup
+                                        @click="
+                                          toggleAssetPublicAccess(props.row)
+                                        "
                                      >
-                                    </q-item-section>
-                                  </q-item>
-                                </q-list>
-                              </q-btn-dropdown>
+                                        <q-item-section avatar>
+                                          <q-avatar
+                                            :icon="
+                                              props.row.is_public
+                                                ? 'public_off'
+                                                : 'public'
+                                            "
+                                            text-color="primary"
+                                          />
+                                        </q-item-section>
+                                        <q-item-section
+                                          v-if="props.row.is_public"
+                                        >
+                                          <q-item-label>Unpublish</q-item-label>
+                                          <q-item-label caption
+                                            >Make this asset
+                                            private</q-item-label
+                                          >
+                                        </q-item-section>
+                                        <q-item-section v-else>
+                                          <q-item-label>Publish</q-item-label>
+                                          <q-item-label caption
+                                            >Make this asset
+                                            public</q-item-label
+                                          >
+                                        </q-item-section>
+                                      </q-item>
+
+                                      <q-item
+                                        clickable
+                                        v-close-popup
+                                        @click="deleteAsset(props.row)"
+                                      >
+                                        <q-item-section avatar>
+                                          <q-avatar
+                                            icon="delete"
+                                            text-color="negative"
+                                          />
+                                        </q-item-section>
+                                        <q-item-section>
+                                          <q-item-label>Delete</q-item-label>
+                                          <q-item-label caption
+                                            >Permanently delete this
+                                            asset</q-item-label
+                                          >
+                                        </q-item-section>
+                                      </q-item>
+                                    </q-list>
+                                  </q-btn-dropdown>
+                                </div>
+                                <div class="col-auto">
+                                  <q-btn
+                                    type="a"
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    color="primary"
+                                    dense
+                                    flat
+                                    round
+                                    icon="image"
+                                    :href="`/api/v1/assets/${props.row.id}/data`"
+                                  >
+                                    <q-tooltip>Full image</q-tooltip>
+                                  </q-btn>
+                                </div>
+                                <div
+                                  class="col-auto"
+                                  v-if="props.row.thumbnail_base64"
+                                >
+                                  <q-btn
+                                    type="a"
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    color="secondary"
+                                    dense
+                                    flat
+                                    round
+                                    icon="photo_size_select_small"
+                                    :href="`/api/v1/assets/${props.row.id}/thumbnail`"
+                                  >
+                                    <q-tooltip>Thumbnail</q-tooltip>
+                                  </q-btn>
+                                </div>
+                              </div>
                            </q-card-section>
                          </q-card>
                        </div>
@@ -394,6 +394,44 @@
                <span v-text="$t('pay_with', {provider: 'PayPal'})"></span>
              </q-item-section>
            </q-item>
+            <q-separator
+              v-if="g.user.fiat_providers?.includes('square')"
+            ></q-separator>
+            <q-item
+              v-if="g.user.fiat_providers?.includes('square')"
+              :active="receive.fiatProvider === 'square'"
+              @click="receive.fiatProvider = 'square'"
+              active-class="bg-teal-1 text-grey-8 text-weight-bold"
+              clickable
+              v-ripple
+            >
+              <q-item-section avatar>
+                <q-avatar>
+                  <q-img src="/static/images/square_logo.png"></q-img>
+                </q-avatar>
+              </q-item-section>
+              <q-item-section>
+                <span v-text="$t('pay_with', {provider: 'Square'})"></span>
+              </q-item-section>
+            </q-item>
+            <q-separator
+              v-if="g.user.fiat_providers?.includes('revolut')"
+            ></q-separator>
+            <q-item
+              v-if="g.user.fiat_providers?.includes('revolut')"
+              :active="receive.fiatProvider === 'revolut'"
+              @click="receive.fiatProvider = 'revolut'"
+              active-class="bg-teal-1 text-grey-8 text-weight-bold"
+              clickable
+              v-ripple
+            >
+              <q-item-section avatar>
+                <q-avatar color="deep-orange-7" text-color="white">R</q-avatar>
+              </q-item-section>
+              <q-item-section>
+                <span v-text="$t('pay_with', {provider: 'Revolut'})"></span>
+              </q-item-section>
+            </q-item>
          </q-list>
        </div>

@@ -4,9 +4,11 @@ import hashlib
 import json
 import urllib.parse
 from collections.abc import AsyncGenerator
+from pathlib import Path
 from typing import Any

 import httpx
+from embit.bip39 import mnemonic_is_valid
 from httpx import RequestError, TimeoutException
 from loguru import logger
 from websockets import connect
@@ -61,6 +63,8 @@ class PhoenixdWallet(Wallet):
        }

        self.client = httpx.AsyncClient(base_url=self.endpoint, headers=self.headers)
+        self._seed_mnemonic_to_persist: str | None = None
+        self._load_mnemonic_from_seed_file()

    async def cleanup(self):
        try:
@@ -69,6 +73,7 @@ class PhoenixdWallet(Wallet):
            logger.warning(f"Error closing wallet connection: {e}")

    async def status(self) -> StatusResponse:
+        await self._persist_loaded_mnemonic()
        try:
            r = await self.client.get("/getinfo", timeout=10)
            r.raise_for_status()
@@ -101,7 +106,6 @@ class PhoenixdWallet(Wallet):
        unhashed_description: bytes | None = None,
        **kwargs,
    ) -> InvoiceResponse:
-
        try:
            msats_amount = amount
            data: dict[str, Any] = {
@@ -309,7 +313,7 @@ class PhoenixdWallet(Wallet):
                            and message_json.get("type") == "payment_received"
                        ):
                            logger.info(
-                                f'payment-received: {message_json["paymentHash"]}'
+                                f"payment-received: {message_json['paymentHash']}"
                            )
                            yield message_json["paymentHash"]

@@ -319,3 +323,49 @@ class PhoenixdWallet(Wallet):
                    "retrying in 5 seconds"
                )
                await asyncio.sleep(5)
+
+    def _load_mnemonic_from_seed_file(self):
+        data_dir = settings.phoenixd_data_dir
+        if not data_dir:
+            return
+
+        seed_path = Path(data_dir).expanduser() / "seed.dat"
+        if not seed_path.is_file():
+            return
+
+        try:
+            mnemonic = seed_path.read_text(encoding="utf-8").strip()
+            if mnemonic == settings.phoenixd_mnemonic:
+                return
+        except OSError as exc:
+            logger.warning(f"Failed to read Phoenixd seed file '{seed_path}': {exc}")
+            return
+
+        if not mnemonic:
+            logger.warning(f"Phoenixd seed file '{seed_path}' is empty.")
+            return
+
+        if not mnemonic_is_valid(mnemonic):
+            logger.warning(
+                f"Phoenixd seed file '{seed_path}' does not contain a valid "
+                "BIP39 mnemonic."
+            )
+            return
+
+        settings.phoenixd_mnemonic = mnemonic
+        self._seed_mnemonic_to_persist = mnemonic
+
+    async def _persist_loaded_mnemonic(self):
+        if not self._seed_mnemonic_to_persist:
+            return
+
+        logger.info("Updating 'PHOENIXD_MNEMONIC' mnemonic settings.")
+        try:
+            from lnbits.core.crud.settings import set_settings_field
+
+            await set_settings_field(
+                "phoenixd_mnemonic", self._seed_mnemonic_to_persist
+            )
+            self._seed_mnemonic_to_persist = None
+        except Exception as exc:
+            logger.warning(f"Failed to persist Phoenixd mnemonic: {exc}")
@@ -15,24 +15,24 @@
  "devDependencies": {
    "clean-css-cli": "^5.6.3",
    "concat": "^1.0.3",
-    "prettier": "^3.7.4",
+    "prettier": "^3.8.3",
    "pyright": "1.1.289",
-    "sass": "^1.94.2",
-    "terser": "^5.44.1"
+    "sass": "^1.99.0",
+    "terser": "^5.47.1"
  },
  "dependencies": {
-    "axios": "^1.13.5",
+    "axios": "^1.16.0",
    "chart.js": "^4.5.1",
    "moment": "^2.30.1",
-    "nostr-tools": "^2.18.2",
-    "qrcode.vue": "^3.6.0",
-    "quasar": "2.18.6",
+    "nostr-tools": "^2.23.3",
+    "qrcode.vue": "^3.9.0",
+    "quasar": "2.19.3",
    "showdown": "^2.1.0",
    "underscore": "^1.13.8",
-    "vue": "3.5.25",
-    "vue-i18n": "^11.2.2",
+    "vue": "3.5.34",
+    "vue-i18n": "^11.4.2",
    "vue-qrcode-reader": "^5.7.3",
-    "vue-router": "4.6.3",
+    "vue-router": "5.0.6",
    "vuex": "4.1.0"
  },
  "vendor": [
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.3.2 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand.

 [[package]]
 name = "aiohappyeyeballs"
@@ -3388,6 +3388,88 @@ files = [
 [package.extras]
 windows-terminal = ["colorama (>=0.4.6)"]

+[[package]]
+name = "pyinstrument"
+version = "5.1.2"
+description = "Call stack profiler for Python. Shows you why your code is slow!"
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+files = [
+    {file = "pyinstrument-5.1.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:f224fe80ba288a00980af298d3808219f9d246fd95b4f91729c9c33a0dc54fe6"},
+    {file = "pyinstrument-5.1.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:7df09fc0d5b72daf48b73cdf07738761bff7f656c81aff686b3ccdd7d2abe236"},
+    {file = "pyinstrument-5.1.2-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:75a7e17377d4405666bbaf126b1fd7bbb7e206d7246e6db3d62864d3d4790ae3"},
+    {file = "pyinstrument-5.1.2-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5381cc6583d26e04d9298acded4242f4fe71986f1472c8aee6992c6816f0cac5"},
+    {file = "pyinstrument-5.1.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:ec08a530bef8d3492d31d8b0b12d0cfde09539f2a1c4b9678662ebc3c843e478"},
+    {file = "pyinstrument-5.1.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:9d671168508129b472be570bc9aee361190ba917b997c703bd134bb4de445ce7"},
+    {file = "pyinstrument-5.1.2-cp310-cp310-win32.whl", hash = "sha256:5957a94f84564b374a7f856d1b322345d600964280b0d687b8ddcc483f21e576"},
+    {file = "pyinstrument-5.1.2-cp310-cp310-win_amd64.whl", hash = "sha256:38a2180a7801c51610b50e5d423674b21872efd019ccf05a11b7f9016cb1dcfc"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:3739a05583ea6312c385eb59fe985cd20d9048e95f9eeeb6a2f6c35202e2d36e"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:7c9ee05dc75ac5fb18498c311e624f77f7f321f7ff325b251aa09e52e46f1d6a"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7a49a55ca5b75218767e29cacbe515d0b66fc18cb48a937bca0f77b8dafc7202"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0c45c14974ff04b1bfdc6c2a448627c6da7409c7800d0eb7bd03fb435dcb41d7"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:22b9c04b3982c41c04b1c5ed05d1bc3a2ba26533450084058119f6dc160e70a3"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5c4995ee0774801790c138f0dfec17d4e7a7ef09a6d56d53cbcbf0578a711021"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-win32.whl", hash = "sha256:fe449e4a8ee60a2a27cf509350a584670f4c3704649601be7937598f09dbe7ca"},
+    {file = "pyinstrument-5.1.2-cp311-cp311-win_amd64.whl", hash = "sha256:3fb839429671a42bf349335af4c1ce5cf83386ac11f04df0bc40720d4cb7d77d"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:2519865d4bf58936f2506c1c46a82d29a20f3239aa50c941df1ca9618c7da5f0"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:059442106b8b5de29ae5ac1bdc20d044fed4da534b8caba434b6ffb119037bf5"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cd51f2d54fc39a4cfd73ba6be27cd0187123132ce3f445b639bff5e1b23d7e26"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:12af1e83795b6c640d657d339014dd1ff718b182dec736d7d1f1d8a97534eb53"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2565513658e742c5eb691a779cb29d19d01bc9ee951d0eb76482e9f343c38c2e"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5afd0ba788a1d112da49fb77966918e01df1f9e7d62e72894d82f7acb0996c2d"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-win32.whl", hash = "sha256:554077b031b278593cb2301f0057be771ea62a729878c69aaf29fcdfb7b71281"},
+    {file = "pyinstrument-5.1.2-cp312-cp312-win_amd64.whl", hash = "sha256:55a905384ba43efc924b8863aa6cfd276f029e4aa70c4a0e3b7389e27b191e45"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:7b8bab2334bf1d4c9e92d61db574300b914b594588a6b6dd67c45450152dfc29"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:13dcc138a61298ef4994b7aebff509d2c06db89dfd6e2021f0b9cd96aaa44ec3"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c8abd4a7ffa2e7f9e00039a5e549e8eebc80d7ca8d43f0fb51a50ff2b117ce4a"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:eb3a05108edebc30f31e2c69c904576042f1158b2513ab80adc08f7848a7a8f0"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f70d588b53f3f35829d1d1ddfa05e07fcebf1434b3b1509d542ca317d8e9a2a5"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b007327e0d6a6a01d5064883dd27c19996f044ce7488d507826fee7884e6a32e"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-win32.whl", hash = "sha256:9ba0e6b17a7e86c3dc02d208e4c25506e8f914d9964ae89449f1f37f0b70abc0"},
+    {file = "pyinstrument-5.1.2-cp313-cp313-win_amd64.whl", hash = "sha256:660d7fc486a839814db0b2f716bc13d8b99b9c780aaeb47f74a70a34adc02a7b"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:0baed297beee2bb9897e737bbd89e3b9d45a2fbbea9f1ad4e809007d780a9b1e"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:ebb910a32a45bde6c3fc30c578efc28a54517990e11e94b5e48a0d5479728568"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bad403c157f9c6dba7f731a6fca5bfcd8ca2701a39bcc717dcc6e0b10055ffc4"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2f456cabdb95fd343c798a7f2a56688b028f981522e283c5f59bd59195b66df5"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:4e9c4dcc1f2c4a0cd6b576e3604abc37496a7868243c9a1443ad3b9db69d590f"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:acf93b128328c6d80fdb85431068ac17508f0f7845e89505b0ea6130dead5ca6"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-win32.whl", hash = "sha256:9c7f0167903ecff8b1d744f7e37b2bd4918e05a69cca724cb112f5ed59d1e41b"},
+    {file = "pyinstrument-5.1.2-cp314-cp314-win_amd64.whl", hash = "sha256:ce3f6b1f9a2b5d74819ecc07d631eadececf915f551474a75ad65ac580ec5a0e"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:af8651b239049accbeecd389d35823233f649446f76f47fd005316b05d08cef2"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c6082f1c3e43e1d22834e91ba8975f0080186df4018a04b4dd29f9623c59df1d"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c031eb066ddc16425e1e2f56aad5c1ce1e27b2432a70329e5385b85e812decee"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f447ec391cad30667ba412dce41607aaa20d4a2496a7ab867e0c199f0fe3ae3d"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:50299bddfc1fe0039898f895b10ef12f9db08acffb4d85326fad589cda24d2ee"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a193ff08825ece115ececa136832acb14c491c77ab1e6b6a361905df8753d5c6"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-win32.whl", hash = "sha256:de887ba19e1057bd2d86e6584f17788516a890ae6fe1b7eed9927873f416b4d8"},
+    {file = "pyinstrument-5.1.2-cp314-cp314t-win_amd64.whl", hash = "sha256:b6a71f5e7f53c86c9b476b30cf19509463a63581ef17ddbd8680fee37ae509db"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:47f14f248108f1202d48f34903bddc053a47c62ce46908aee848c1f667a1925b"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:cc3f2688981af764fa2c5f5a00d7040c0c12771ca5a026730f2d826f7a28d277"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7afb24d11d24fb1762059240ed97a1a4607779d5f221f91d62b67ae089bd506d"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3d21221a29718d5dcdc1453dbbbdd100734525672ef1e34ff03d49bc5d688ca4"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:3b68aa9f0d5217c67370762c99a80750ce56f66e5e9281c31b5baa3e4b88894d"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:755702f01800934c3bec3c0d30483f97b6ff1fc1d2afcf6d816584703c9f1235"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-win32.whl", hash = "sha256:2bacb980c95d4c9ea6a253e5ccf3e99993082de29ff7e7fc397e9484355577b1"},
+    {file = "pyinstrument-5.1.2-cp38-cp38-win_amd64.whl", hash = "sha256:2588bc34c25d50f29d3a117c7dfac06513ee59c507b65081e66ca9569bcf45e0"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:bea0687665c181c6e62677fb560739a473c4286816582a43f8eb0aa6094ed529"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:64246d2bd475870b62ed5df4808bfb33328135e8dfbdff823f9cb7d1358eb40b"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ff6fd3c7907e57f082cdd405bec1b34768c1810a165538299d259ee1bff5d7b6"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:af09af38ee8407ca273407e24a8e6470d2444561d01005ee6a8db5f2fd908c08"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:1249d2799cdd57151b4444167e5c7736e2c9b5e79bd781b0779d631338509553"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:2d653206f50260f20bc78339c3d7aa0f19f8cf9c9f71939fbf02e2ea30353487"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-win32.whl", hash = "sha256:d0b0c6e289725f14d0ff73f8190c953bdcb98f21c5c29c3eafb0dca8025583cb"},
+    {file = "pyinstrument-5.1.2-cp39-cp39-win_amd64.whl", hash = "sha256:db8243e602aca43dc7ce8e40ed7d0ca4820d024c3c03824870c5a9e98f84e953"},
+    {file = "pyinstrument-5.1.2.tar.gz", hash = "sha256:af149d672da9493fa37334a1cc68f7b80c3e6cb9fd99b9e426c447db5c650bf0"},
+]
+
+[package.extras]
+bin = ["click", "nox"]
+docs = ["furo (==2024.7.18)", "myst-parser (==3.0.1)", "sphinx (==7.4.7)", "sphinx-autobuild (==2024.4.16)", "sphinxcontrib-programoutput (==0.17)"]
+examples = ["django", "litestar", "numpy"]
+test = ["cffi (>=1.17.0)", "flaky", "greenlet (>=3)", "ipython", "pytest", "pytest-asyncio (==0.23.8)", "trio"]
+types = ["typing_extensions"]
+
 [[package]]
 name = "pyjwt"
 version = "2.12.1"
@@ -4478,14 +4560,14 @@ files = [

 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 description = "HTTP library with thread-safe connection pooling, file post, and more."
 optional = false
-python-versions = ">=3.9"
+python-versions = ">=3.10"
 groups = ["main", "dev"]
 files = [
-    {file = "urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4"},
-    {file = "urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"},
+    {file = "urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897"},
+    {file = "urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c"},
 ]

 [package.extras]
@@ -5028,4 +5110,4 @@ migration = ["psycopg2-binary"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10,<3.13"
-content-hash = "42751c05e1fa8250ff90981def5e0ce8d1b284eeb2acc2c7ac9ae5847cf99e17"
+content-hash = "4050934800e6dfcc5242d1847d3db69eb6e91d634c09368a28255ad3c908b568"
@@ -1,6 +1,6 @@
 [project]
 name = "lnbits"
-version = "1.5.3"
+version = "1.5.4"
 requires-python = ">=3.10,<3.13"
 description = "LNbits, free and open-source Lightning wallet and accounts system."
 authors = [{ name = "Alan Bits", email = "alan@lnbits.com" }]
@@ -51,6 +51,8 @@ dependencies = [
    "pillow~=12.1.0",
    "python-dotenv~=1.2.1",
    "greenlet~=3.3.0",
+    "urllib3>=2.7.0",
+    "pyinstrument>=5.1.2",
 ]

 [project.scripts]
@@ -82,9 +84,12 @@ dev = [
  "pytest-mock~=3.15.1",
  "types-mock~=5.2.0.20250924",
  "mock~=5.2.0",
-  "grpcio-tools~=1.76.0"
+  "grpcio-tools~=1.76.0",
 ]

+[tool.uv]
+exclude-newer = "1 week"
+
 [tool.poetry]
 packages = [
  {include = "lnbits"},
@@ -13,14 +13,15 @@ async def test_asset_api_upload_list_update_and_delete(
    client: AsyncClient,
    user_headers_from: dict[str, str],
 ):
+    payload = get_png_bytes()
    upload = await client.post(
        "/api/v1/assets?public_asset=false",
        headers={"Authorization": user_headers_from["Authorization"]},
-        files={"file": ("note.txt", b"hello world", "text/plain")},
+        files={"file": ("note.png", payload, "image/png")},
    )
    assert upload.status_code == 200
    asset = upload.json()
-    assert asset["name"] == "note.txt"
+    assert asset["name"] == "note.png"
    assert asset["is_public"] is False

    page = await client.get("/api/v1/assets/paginated", headers=user_headers_from)
@@ -29,27 +30,30 @@ async def test_asset_api_upload_list_update_and_delete(

    info = await client.get(f"/api/v1/assets/{asset['id']}", headers=user_headers_from)
    assert info.status_code == 200
-    assert info.json()["name"] == "note.txt"
+    assert info.json()["name"] == "note.png"

    data = await client.get(
        f"/api/v1/assets/{asset['id']}/data", headers=user_headers_from
    )
    assert data.status_code == 200
-    assert data.content == b"hello world"
-    assert data.headers["content-disposition"] == 'inline; filename="note.txt"'
+    assert data.content == payload
+    assert data.headers["content-type"] == "image/png"
+    assert data.headers["content-disposition"] == 'inline; filename="note.png"'
+    assert data.headers["x-content-type-options"] == "nosniff"
+    assert data.headers["content-security-policy"].startswith("sandbox")

    updated = await client.put(
        f"/api/v1/assets/{asset['id']}",
        headers=user_headers_from,
-        json={"name": "renamed.txt", "is_public": True},
+        json={"name": "renamed.png", "is_public": True},
    )
    assert updated.status_code == 200
-    assert updated.json()["name"] == "renamed.txt"
+    assert updated.json()["name"] == "renamed.png"
    assert updated.json()["is_public"] is True

    public_data = await client.get(f"/api/v1/assets/{asset['id']}/data")
    assert public_data.status_code == 200
-    assert public_data.content == b"hello world"
+    assert public_data.content == payload

    deleted = await client.delete(
        f"/api/v1/assets/{asset['id']}", headers=user_headers_from
@@ -98,15 +102,51 @@ async def test_asset_api_enforces_visibility_and_supports_admin_updates(
    assert admin_updated.json()["is_public"] is True
    assert admin_updated.json()["name"] == "admin-visible.png"

+    image_data = await client.get(f"/api/v1/assets/{private_asset.id}/data")
+    assert image_data.status_code == 200
+    assert image_data.headers["content-type"] == "image/png"
+    assert image_data.headers["content-disposition"] == (
+        'inline; filename="admin-visible.png"'
+    )
+    assert image_data.headers["x-content-type-options"] == "nosniff"
+
    thumbnail = await client.get(f"/api/v1/assets/{private_asset.id}/thumbnail")
    assert thumbnail.status_code == 200
    assert thumbnail.content
    assert thumbnail.headers["content-type"] == "image/png"
+    assert thumbnail.headers["content-disposition"] == (
+        'inline; filename="admin-visible.png"'
+    )
+
+
+@pytest.mark.anyio
+async def test_asset_api_blocks_non_image_uploads(
+    client: AsyncClient,
+    user_headers_from: dict[str, str],
+):
+    payload = (
+        b'<?xml version="1.0"?>'
+        b'<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform">'
+        b'<xsl:template match="/">'
+        b"<script>alert(1)</script>"
+        b"</xsl:template>"
+        b"</xsl:stylesheet>"
+    )
+
+    blocked = await client.post(
+        "/api/v1/assets",
+        headers={"Authorization": user_headers_from["Authorization"]},
+        files={"file": ("payload.xsl", payload, "text/xml")},
+    )
+
+    assert blocked.status_code == 400
+    assert blocked.json()["detail"] == "File type 'text/xml' not allowed."


@pytest.mark.anyio
 async def test_asset_api_validates_uploads_and_missing_assets(
    client: AsyncClient,
+    to_user,
    user_headers_from: dict[str, str],
 ):
    invalid = await client.post(
@@ -117,6 +157,15 @@ async def test_asset_api_validates_uploads_and_missing_assets(
    assert invalid.status_code == 400
    assert "not allowed" in invalid.json()["detail"]

+    fake_image_headers = await get_user_token_headers(client, to_user.id)
+    fake_image = await client.post(
+        "/api/v1/assets",
+        headers={"Authorization": fake_image_headers["Authorization"]},
+        files={"file": ("fake.png", b"<root></root>", "image/png")},
+    )
+    assert fake_image.status_code == 400
+    assert "does not match declared file type" in fake_image.json()["detail"]
+
    missing = await client.delete(
        f"/api/v1/assets/{uuid4().hex}",
        headers=user_headers_from,
@@ -128,7 +177,9 @@ async def test_asset_api_validates_uploads_and_missing_assets(

    stored = await create_user_asset(
        "missing-user-check",
-        make_upload_file(b"content", filename="content.txt", content_type="text/plain"),
+        make_upload_file(
+            get_png_bytes(), filename="content.png", content_type="image/png"
+        ),
        is_public=True,
    )
    fetched = await get_user_asset("missing-user-check", stored.id)
@@ -4,13 +4,18 @@ from uuid import uuid4
 import pytest
 from httpx import AsyncClient

-from lnbits.core.models import Account, CreateInvoice
+from lnbits.core.models import Account, CreateInvoice, Payment
 from lnbits.core.services.payments import create_wallet_invoice
 from lnbits.core.services.users import create_user_account
 from lnbits.core.views.callback_api import (
    handle_paypal_event,
+    handle_revolut_event,
+    handle_square_event,
    handle_stripe_event,
 )
+from lnbits.fiat.revolut import RevolutWallet
+from lnbits.fiat.square import SquareWallet
+from lnbits.settings import Settings


@pytest.mark.anyio
@@ -23,7 +28,15 @@ async def test_callback_api_generic_webhook_handler_routes_providers(
    paypal_mock = mocker.patch(
        "lnbits.core.views.callback_api.handle_paypal_event", mocker.AsyncMock()
    )
+    square_mock = mocker.patch(
+        "lnbits.core.views.callback_api.handle_square_event", mocker.AsyncMock()
+    )
+    revolut_mock = mocker.patch(
+        "lnbits.core.views.callback_api.handle_revolut_event", mocker.AsyncMock()
+    )
    mocker.patch("lnbits.core.views.callback_api.check_stripe_signature")
+    mocker.patch("lnbits.core.views.callback_api.check_square_signature")
+    mocker.patch("lnbits.core.views.callback_api.check_revolut_signature")
    mocker.patch(
        "lnbits.core.views.callback_api.verify_paypal_webhook", mocker.AsyncMock()
    )
@@ -45,6 +58,27 @@ async def test_callback_api_generic_webhook_handler_routes_providers(
    assert paypal.json()["success"] is True
    paypal_mock.assert_awaited_once()

+    square = await http_client.post(
+        "/api/v1/callback/square",
+        headers={"x-square-hmacsha256-signature": "sig"},
+        json={"event_id": "evt_3", "type": "payment.updated"},
+    )
+    assert square.status_code == 200
+    assert square.json()["success"] is True
+    square_mock.assert_awaited_once()
+
+    revolut = await http_client.post(
+        "/api/v1/callback/revolut",
+        headers={
+            "Revolut-Signature": "sig",
+            "Revolut-Request-Timestamp": "1700000000",
+        },
+        json={"event": "ORDER_COMPLETED", "order_id": "order_1"},
+    )
+    assert revolut.status_code == 200
+    assert revolut.json()["success"] is True
+    revolut_mock.assert_awaited_once()
+
    unknown = await http_client.post("/api/v1/callback/unknown", json={"id": "evt_3"})
    assert unknown.status_code == 200
    assert unknown.json()["success"] is False
@@ -95,7 +129,258 @@ async def test_callback_api_handles_paid_events_with_real_payments(mocker):


@pytest.mark.anyio
-async def test_callback_api_handles_subscription_flows_and_validation(mocker):
+async def test_callback_api_handles_square_paid_events(mocker):
+    payment = mocker.Mock()
+    get_payment = mocker.patch(
+        "lnbits.core.views.callback_api.get_standalone_payment",
+        mocker.AsyncMock(return_value=payment),
+    )
+    fiat_status_mock = mocker.patch(
+        "lnbits.core.views.callback_api.check_fiat_status", mocker.AsyncMock()
+    )
+
+    await handle_square_event(
+        {
+            "event_id": "evt_square",
+            "type": "payment.updated",
+            "data": {
+                "object": {
+                    "payment": {
+                        "id": "payment_1",
+                        "order_id": "order_1",
+                        "status": "COMPLETED",
+                    }
+                }
+            },
+        }
+    )
+
+    get_payment.assert_awaited_once_with("fiat_square_order_order_1")
+    fiat_status_mock.assert_awaited_once_with(payment)
+
+
+@pytest.mark.anyio
+async def test_callback_api_handles_revolut_paid_events(mocker):
+    payment = mocker.Mock()
+    get_payment = mocker.patch(
+        "lnbits.core.views.callback_api.get_standalone_payment",
+        mocker.AsyncMock(return_value=payment),
+    )
+    fiat_status_mock = mocker.patch(
+        "lnbits.core.views.callback_api.check_fiat_status", mocker.AsyncMock()
+    )
+
+    await handle_revolut_event(
+        {
+            "event": "ORDER_COMPLETED",
+            "order_id": "order_1",
+        }
+    )
+
+    get_payment.assert_awaited_once_with("fiat_revolut_order_order_1")
+    fiat_status_mock.assert_awaited_once_with(payment)
+
+
+@pytest.mark.anyio
+async def test_callback_api_handles_revolut_subscription_event(
+    mocker, settings: Settings
+):
+    wallet_id = "wallet_1"
+    payment = mocker.Mock()
+    payment.extra = {}
+    payment.msat = 925_000
+
+    settings.revolut_api_endpoint = "https://sandbox-merchant.revolut.com"
+    settings.revolut_api_secret_key = "revolut-secret"
+    settings.revolut_api_version = "2026-04-20"
+    revolut_provider = RevolutWallet()
+    mocker.patch.object(
+        revolut_provider,
+        "get_subscription",
+        return_value={
+            "id": "SUBSCRIPTION_1",
+            "current_cycle_id": "CYCLE_1",
+            "external_reference": json.dumps(
+                {
+                    "wallet_id": wallet_id,
+                    "tag": "members",
+                    "subscription_request_id": "request_1",
+                    "extra": {"link": "link-1", "customer_id": "customer_1"},
+                    "memo": "Revolut Members",
+                }
+            ),
+        },
+    )
+    mocker.patch.object(
+        revolut_provider,
+        "get_subscription_cycle",
+        return_value={"id": "CYCLE_1", "order_id": "ORDER_SUB_1"},
+    )
+    mocker.patch.object(
+        revolut_provider,
+        "get_order",
+        return_value={
+            "id": "ORDER_SUB_1",
+            "amount": 925,
+            "currency": "USD",
+            "checkout_url": "https://checkout.revolut.com/payment-link/sub_1",
+        },
+    )
+    mocker.patch(
+        "lnbits.core.views.callback_api.get_fiat_provider",
+        mocker.AsyncMock(return_value=revolut_provider),
+    )
+    mocker.patch(
+        "lnbits.core.views.callback_api.get_standalone_payment",
+        mocker.AsyncMock(side_effect=[None]),
+    )
+    create_wallet_invoice_mock = mocker.patch(
+        "lnbits.core.views.callback_api.create_wallet_invoice",
+        mocker.AsyncMock(return_value=payment),
+    )
+    mocker.patch("lnbits.core.views.callback_api.service_fee_fiat", return_value=2)
+    update_payment_mock = mocker.patch(
+        "lnbits.core.views.callback_api.update_payment", mocker.AsyncMock()
+    )
+    fiat_status_mock = mocker.patch(
+        "lnbits.core.views.callback_api.check_fiat_status", mocker.AsyncMock()
+    )
+
+    await handle_revolut_event(
+        {
+            "event": "SUBSCRIPTION_INITIATED",
+            "subscription_id": "SUBSCRIPTION_1",
+        }
+    )
+
+    assert create_wallet_invoice_mock.await_count == 1
+    called_wallet_id, invoice = create_wallet_invoice_mock.await_args.args
+    assert called_wallet_id == "wallet_1"
+    assert invoice.amount == 9.25
+    assert invoice.memo == "Revolut Members"
+    assert invoice.external_id == "SUBSCRIPTION_1"
+    assert invoice.internal is True
+    assert invoice.extra["fiat_method"] == "subscription"
+    assert invoice.extra["subscription"]["checking_id"] == "order_ORDER_SUB_1"
+    assert payment.fiat_provider == "revolut"
+    assert payment.fee == -2
+    assert payment.extra["fiat_checking_id"] == "order_ORDER_SUB_1"
+    assert payment.checking_id == "fiat_revolut_order_ORDER_SUB_1"
+    update_payment_mock.assert_awaited_once_with(
+        payment, "fiat_revolut_order_ORDER_SUB_1"
+    )
+    fiat_status_mock.assert_awaited_once_with(payment)
+
+
+@pytest.mark.anyio
+async def test_callback_api_handles_revolut_subscription_order_event(
+    mocker, settings: Settings
+):
+    wallet_id = "wallet_1"
+    payment = mocker.Mock()
+    payment.extra = {}
+    payment.msat = 925_000
+
+    settings.revolut_api_endpoint = "https://sandbox-merchant.revolut.com"
+    settings.revolut_api_secret_key = "revolut-secret"
+    settings.revolut_api_version = "2026-04-20"
+    revolut_provider = RevolutWallet()
+    subscription = {
+        "id": "SUBSCRIPTION_1",
+        "state": "active",
+        "current_cycle_id": "CYCLE_1",
+        "external_reference": json.dumps(
+            {
+                "wallet_id": wallet_id,
+                "tag": "members",
+                "subscription_request_id": "request_1",
+                "extra": {"link": "link-1"},
+                "memo": "Revolut Members",
+            }
+        ),
+    }
+    order = {
+        "id": "ORDER_SUB_1",
+        "type": "payment",
+        "state": "completed",
+        "amount": 925,
+        "currency": "USD",
+        "checkout_url": "https://checkout.revolut.com/payment-link/sub_1",
+        "channel_data": {
+            "subscription_id": "SUBSCRIPTION_1",
+            "subscription_cycle_id": "CYCLE_1",
+        },
+    }
+    get_order_mock = mocker.patch.object(
+        revolut_provider, "get_order", side_effect=[order, order]
+    )
+    get_subscription_mock = mocker.patch.object(
+        revolut_provider,
+        "get_subscription",
+        return_value=subscription,
+    )
+    mocker.patch.object(
+        revolut_provider,
+        "get_subscription_cycle",
+        return_value={"id": "CYCLE_1", "order_id": "ORDER_SUB_1"},
+    )
+    mocker.patch(
+        "lnbits.core.views.callback_api.get_fiat_provider",
+        mocker.AsyncMock(return_value=revolut_provider),
+    )
+    get_payment_mock = mocker.patch(
+        "lnbits.core.views.callback_api.get_standalone_payment",
+        mocker.AsyncMock(side_effect=[None, None]),
+    )
+    create_wallet_invoice_mock = mocker.patch(
+        "lnbits.core.views.callback_api.create_wallet_invoice",
+        mocker.AsyncMock(return_value=payment),
+    )
+    mocker.patch("lnbits.core.views.callback_api.service_fee_fiat", return_value=2)
+    update_payment_mock = mocker.patch(
+        "lnbits.core.views.callback_api.update_payment", mocker.AsyncMock()
+    )
+    fiat_status_mock = mocker.patch(
+        "lnbits.core.views.callback_api.check_fiat_status", mocker.AsyncMock()
+    )
+
+    await handle_revolut_event(
+        {
+            "event": "ORDER_COMPLETED",
+            "order_id": "ORDER_SUB_1",
+        }
+    )
+
+    assert get_payment_mock.await_count == 2
+    get_payment_mock.assert_any_await("fiat_revolut_order_ORDER_SUB_1")
+    assert get_order_mock.await_count == 2
+    assert [call.args for call in get_subscription_mock.await_args_list] == [
+        ("SUBSCRIPTION_1",),
+        ("SUBSCRIPTION_1",),
+    ]
+    assert create_wallet_invoice_mock.await_count == 1
+    called_wallet_id, invoice = create_wallet_invoice_mock.await_args.args
+    assert called_wallet_id == "wallet_1"
+    assert invoice.amount == 9.25
+    assert invoice.memo == "Revolut Members"
+    assert invoice.external_id == "SUBSCRIPTION_1"
+    assert invoice.internal is True
+    assert invoice.extra["fiat_method"] == "subscription"
+    assert invoice.extra["subscription"]["checking_id"] == "order_ORDER_SUB_1"
+    assert payment.fiat_provider == "revolut"
+    assert payment.fee == -2
+    assert payment.extra["fiat_checking_id"] == "order_ORDER_SUB_1"
+    assert payment.checking_id == "fiat_revolut_order_ORDER_SUB_1"
+    update_payment_mock.assert_awaited_once_with(
+        payment, "fiat_revolut_order_ORDER_SUB_1"
+    )
+    fiat_status_mock.assert_awaited_once_with(payment)
+
+
+@pytest.mark.anyio
+async def test_callback_api_handles_subscription_flows_and_validation(
+    mocker, settings: Settings
+):
    user = await create_user_account(
        Account(
            id=uuid4().hex,
@@ -163,6 +448,99 @@ async def test_callback_api_handles_subscription_flows_and_validation(mocker):
    )
    assert create_fiat_invoice_mock.await_count == 2

+    await handle_square_event(
+        {
+            "event_id": "evt_square_subscription",
+            "type": "payment.updated",
+            "data": {
+                "object": {
+                    "payment": {
+                        "id": "PAYMENT_SUB_1",
+                        "order_id": "ORDER_SUB_1",
+                        "status": "COMPLETED",
+                        "amount_money": {"amount": 925, "currency": "USD"},
+                        "note": json.dumps(
+                            [
+                                wallet.id,
+                                "members",
+                                "subscription_square_1",
+                                "link-1",
+                                "Square Members",
+                            ]
+                        ),
+                    }
+                }
+            },
+        }
+    )
+    assert create_fiat_invoice_mock.await_count == 3
+    square_call = create_fiat_invoice_mock.await_args.kwargs
+    assert square_call["wallet_id"] == wallet.id
+    square_invoice = square_call["invoice_data"]
+    assert square_invoice.fiat_provider == "square"
+    assert square_invoice.amount == 9.25
+    assert square_invoice.memo == "Square Members"
+    assert square_invoice.extra["fiat_method"] == "subscription"
+    assert square_invoice.extra["tag"] == "members"
+    assert (
+        square_invoice.extra["subscription"]["checking_id"] == "payment_PAYMENT_SUB_1"
+    )
+
+    payment.extra = {
+        "subscription_request_id": "subscription_square_1",
+        "tag": "members",
+        "link": "link-1",
+    }
+    payment.external_id = "SUBSCRIPTION_1"
+    payment.memo = "Square Members"
+    settings.square_api_endpoint = "https://connect.squareupsandbox.com"
+    settings.square_access_token = "square-token"
+    settings.square_location_id = "LOC123"
+    settings.square_api_version = "2026-01-22"
+    square_provider = SquareWallet()
+    mocker.patch.object(
+        square_provider,
+        "get_payment_for_order",
+        return_value={
+            "id": "PAYMENT_SUB_2",
+            "status": "COMPLETED",
+            "amount_money": {"amount": 925, "currency": "USD"},
+        },
+    )
+    mocker.patch(
+        "lnbits.core.views.callback_api.get_fiat_provider",
+        mocker.AsyncMock(return_value=square_provider),
+    )
+    mocker.patch(
+        "lnbits.core.views.callback_api.get_payments",
+        mocker.AsyncMock(return_value=[payment]),
+    )
+
+    await handle_square_event(
+        {
+            "event_id": "evt_square_invoice",
+            "type": "invoice.payment_made",
+            "data": {
+                "object": {
+                    "invoice": {
+                        "order_id": "ORDER_SUB_2",
+                        "subscription_id": "SUBSCRIPTION_1",
+                        "public_url": "https://square.example/invoice",
+                    }
+                }
+            },
+        }
+    )
+    assert create_fiat_invoice_mock.await_count == 4
+    square_invoice_call = create_fiat_invoice_mock.await_args.kwargs
+    square_invoice = square_invoice_call["invoice_data"]
+    assert square_invoice.external_id == "SUBSCRIPTION_1"
+    assert "square_subscription_id" not in square_invoice.extra
+    assert (
+        square_invoice.extra["subscription"]["payment_request"]
+        == "https://square.example/invoice"
+    )
+
    with pytest.raises(
        ValueError, match="PayPal subscription event missing custom metadata."
    ):
@@ -173,3 +551,83 @@ async def test_callback_api_handles_subscription_flows_and_validation(mocker):
                "resource": {"amount": {"currency": "USD", "total": "5.00"}},
            }
        )
+
+
+@pytest.mark.anyio
+async def test_square_invoice_payment_updates_existing_subscription_external_id(
+    settings: Settings, mocker
+):
+    payment = Payment(
+        checking_id="fiat_square_payment_PAYMENT_SUB_1",
+        payment_hash="hash_square_subscription",
+        wallet_id="wallet_1",
+        amount=925000,
+        fee=0,
+        bolt11="lnbc1square",
+        fiat_provider="square",
+        extra={
+            "subscription_request_id": "subscription_square_1",
+            "tag": "members",
+            "link": "link-1",
+        },
+        memo="Square Members",
+    )
+    settings.square_api_endpoint = "https://connect.squareupsandbox.com"
+    settings.square_access_token = "square-token"
+    settings.square_location_id = "LOC123"
+    settings.square_api_version = "2026-01-22"
+    square_provider = SquareWallet()
+    mocker.patch.object(
+        square_provider,
+        "get_payment_for_order",
+        return_value={
+            "id": "PAYMENT_SUB_1",
+            "status": "COMPLETED",
+            "amount_money": {"amount": 925, "currency": "USD"},
+        },
+    )
+    mocker.patch(
+        "lnbits.core.views.callback_api.get_fiat_provider",
+        mocker.AsyncMock(return_value=square_provider),
+    )
+    get_standalone_payment_mock = mocker.patch(
+        "lnbits.core.views.callback_api.get_standalone_payment",
+        mocker.AsyncMock(return_value=payment),
+    )
+    update_payment_mock = mocker.patch(
+        "lnbits.core.views.callback_api.update_payment",
+        mocker.AsyncMock(),
+    )
+    get_payments_mock = mocker.patch(
+        "lnbits.core.views.callback_api.get_payments",
+        mocker.AsyncMock(return_value=[]),
+    )
+    create_fiat_invoice_mock = mocker.patch(
+        "lnbits.core.views.callback_api.create_fiat_invoice",
+        mocker.AsyncMock(),
+    )
+    fiat_status_mock = mocker.patch(
+        "lnbits.core.views.callback_api.check_fiat_status", mocker.AsyncMock()
+    )
+
+    await handle_square_event(
+        {
+            "event_id": "evt_square_invoice",
+            "type": "invoice.payment_made",
+            "data": {
+                "object": {
+                    "invoice": {
+                        "order_id": "ORDER_SUB_1",
+                        "subscription_id": "SUBSCRIPTION_1",
+                    }
+                }
+            },
+        }
+    )
+
+    get_standalone_payment_mock.assert_awaited_with("fiat_square_payment_PAYMENT_SUB_1")
+    assert payment.external_id == "SUBSCRIPTION_1"
+    update_payment_mock.assert_awaited_once_with(payment)
+    fiat_status_mock.assert_awaited_once_with(payment)
+    get_payments_mock.assert_not_awaited()
+    create_fiat_invoice_mock.assert_not_awaited()
@@ -4,6 +4,8 @@ from pytest_mock.plugin import MockerFixture

 from lnbits.core.models.misc import SimpleStatus
 from lnbits.fiat.base import FiatSubscriptionResponse
+from lnbits.fiat.revolut import REVOLUT_WEBHOOK_EVENTS
+from lnbits.settings import Settings


 class _UnsetSecret:
@@ -144,3 +146,82 @@ async def test_fiat_api_connection_token_validates_provider_configuration(
    assert ok.status_code == 200
    assert ok.json() == {"secret": "tok_live"}
    assert good_provider.await_count == 1
+
+
+@pytest.mark.anyio
+async def test_fiat_api_creates_revolut_webhook(
+    client: AsyncClient,
+    superuser_token: str,
+    settings: Settings,
+    mocker: MockerFixture,
+):
+    create_webhook = mocker.patch(
+        "lnbits.core.views.fiat_api.RevolutWallet.create_webhook",
+        mocker.AsyncMock(
+            return_value={
+                "id": "webhook_1",
+                "url": "https://lnbits.example/api/v1/callback/revolut",
+                "events": REVOLUT_WEBHOOK_EVENTS,
+                "signing_secret": "whsec_1",
+            }
+        ),
+    )
+
+    response = await client.post(
+        "/api/v1/fiat/revolut/webhook",
+        headers={"Authorization": f"Bearer {superuser_token}"},
+        json={
+            "url": "https://lnbits.example/api/v1/callback/revolut",
+            "endpoint": "https://sandbox-merchant.revolut.com",
+            "api_secret_key": "secret_1",
+            "api_version": "2026-04-20",
+        },
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": "webhook_1",
+        "url": "https://lnbits.example/api/v1/callback/revolut",
+        "events": REVOLUT_WEBHOOK_EVENTS,
+        "signing_secret": "whsec_1",
+        "already_exists": False,
+    }
+    create_webhook.assert_awaited_once_with(
+        url="https://lnbits.example/api/v1/callback/revolut",
+        endpoint="https://sandbox-merchant.revolut.com",
+        api_secret_key="secret_1",
+        api_version="2026-04-20",
+    )
+    assert settings.revolut_payment_webhook_url == (
+        "https://lnbits.example/api/v1/callback/revolut"
+    )
+    assert settings.revolut_webhook_signing_secret == "whsec_1"
+
+
+@pytest.mark.anyio
+async def test_fiat_api_rejects_local_revolut_webhook(
+    client: AsyncClient,
+    superuser_token: str,
+    mocker: MockerFixture,
+):
+    create_webhook = mocker.patch(
+        "lnbits.core.views.fiat_api.RevolutWallet.create_webhook",
+        mocker.AsyncMock(
+            side_effect=ValueError("Revolut webhook URL must be a clearnet URL.")
+        ),
+    )
+
+    response = await client.post(
+        "/api/v1/fiat/revolut/webhook",
+        headers={"Authorization": f"Bearer {superuser_token}"},
+        json={
+            "url": "http://localhost:5000/api/v1/callback/revolut",
+            "endpoint": "https://sandbox-merchant.revolut.com",
+            "api_secret_key": "secret_1",
+            "api_version": "2026-04-20",
+        },
+    )
+
+    assert response.status_code == 400
+    assert response.json()["detail"] == ("Revolut webhook URL must be a clearnet URL.")
+    create_webhook.assert_awaited_once()
@@ -4,9 +4,10 @@ from uuid import uuid4

 import pytest
 from fastapi import HTTPException
+from pydantic import ValidationError

-from lnbits.core.crud.payments import create_payment
-from lnbits.core.models import Account, CreateInvoice, PaymentState
+from lnbits.core.crud.payments import create_payment, get_payments
+from lnbits.core.models import Account, CreateInvoice, PaymentFilters, PaymentState
 from lnbits.core.models.payments import CancelInvoice, CreatePayment, SettleInvoice
 from lnbits.core.models.users import AccountId
 from lnbits.core.models.wallets import KeyType, WalletTypeInfo
@@ -21,7 +22,7 @@ from lnbits.core.views.payment_api import (
    api_payments_settle,
    api_payments_wallets_stats,
 )
-from lnbits.db import Filters
+from lnbits.db import Filter, Filters
 from lnbits.wallets.base import InvoiceResponse

 ZERO_AMOUNT_INVOICE = (
@@ -91,6 +92,60 @@ async def test_payment_api_stats_and_all_paginated(admin_user):
    assert second_wallet.id in wallet_ids


+@pytest.mark.anyio
+async def test_payment_external_id_is_stored_and_validated():
+    user = await create_user_account(
+        Account(
+            id=uuid4().hex,
+            username=f"user_{uuid4().hex[:8]}",
+            email=f"user_{uuid4().hex[:8]}@lnbits.com",
+        )
+    )
+    wallet = user.wallets[0]
+
+    first_payment = await create_wallet_invoice(
+        wallet.id,
+        CreateInvoice(
+            out=False,
+            amount=21,
+            memo="external reference",
+            external_id="provider_payment_123",
+        ),
+    )
+    second_payment = await create_wallet_invoice(
+        wallet.id,
+        CreateInvoice(
+            out=False,
+            amount=22,
+            memo="external reference newest",
+            external_id="provider_payment_123",
+        ),
+    )
+
+    assert first_payment.external_id == "provider_payment_123"
+    assert second_payment.external_id == "provider_payment_123"
+    stored_payments = await get_payments(
+        wallet_id=wallet.id,
+        filters=Filters(
+            filters=[
+                Filter.parse_query(
+                    "external_id", ["provider_payment_123"], PaymentFilters
+                )
+            ],
+            model=PaymentFilters,
+            sortby="created_at",
+            direction="desc",
+        ),
+    )
+    assert [payment.checking_id for payment in stored_payments] == [
+        second_payment.checking_id,
+        first_payment.checking_id,
+    ]
+
+    with pytest.raises(ValidationError, match="Invalid external id"):
+        CreateInvoice(out=False, amount=21, external_id="provider payment 123")
+
+
@pytest.mark.anyio
 async def test_payment_api_fee_reserve_and_hold_invoice_actions(mocker):
    user = await create_user_account(
@@ -1,7 +1,32 @@
 import pytest

+from lnbits.db import Filters
 from tests.helpers import DbTestModel

+TEST_DB_FETCH_PAGE_ROWS: tuple[dict[str, str], ...] = (
+    {"id": "1", "name": "Alice", "value": "foo"},
+    {"id": "2", "name": "Bob", "value": "bar"},
+    {"id": "3", "name": "Carol", "value": "bar"},
+    {"id": "4", "name": "Dave", "value": "bar"},
+    {"id": "5", "name": "Dave", "value": "foo"},
+    {"id": "6", "name": "Eve", "value": "foo"},
+    {"id": "7", "name": "Frank", "value": "bar"},
+    {"id": "8", "name": "Grace", "value": "foo"},
+    {"id": "9", "name": "Heidi", "value": "bar"},
+    {"id": "10", "name": "Ivan", "value": "foo"},
+    {"id": "11", "name": "Judy", "value": "bar"},
+    {"id": "12", "name": "Mallory", "value": "foo"},
+    {"id": "13", "name": "Niaj", "value": "bar"},
+    {"id": "14", "name": "Olivia", "value": "foo"},
+    {"id": "15", "name": "Peggy", "value": "bar"},
+    {"id": "16", "name": "Rupert", "value": "foo"},
+    {"id": "17", "name": "Sybil", "value": "bar"},
+    {"id": "18", "name": "Trent", "value": "foo"},
+    {"id": "19", "name": "Victor", "value": "bar"},
+    {"id": "20", "name": "Walter", "value": "foo"},
+    {"id": "21", "name": "Zoe", "value": "bar"},
+)
+

@pytest.fixture(scope="session")
 async def fetch_page(db):
@@ -13,14 +38,14 @@ async def fetch_page(db):
            name TEXT NOT NULL
        )
        """)
-    await db.execute("""
-        INSERT INTO test_db_fetch_page (id, name, value) VALUES
-            ('1', 'Alice', 'foo'),
-            ('2', 'Bob', 'bar'),
-            ('3', 'Carol', 'bar'),
-            ('4', 'Dave', 'bar'),
-            ('5', 'Dave', 'foo')
-        """)
+    for row in TEST_DB_FETCH_PAGE_ROWS:
+        await db.execute(
+            """
+            INSERT INTO test_db_fetch_page (id, name, value)
+            VALUES (:id, :name, :value)
+            """,
+            row,
+        )
    yield
    await db.execute("DROP TABLE test_db_fetch_page")

@@ -33,8 +58,35 @@ async def test_db_fetch_page_simple(fetch_page, db):
    )

    assert row
-    assert row.total == 5
-    assert len(row.data) == 5
+    assert row.total == len(TEST_DB_FETCH_PAGE_ROWS)
+    assert len(row.data) == Filters().limit
+
+
+@pytest.mark.anyio
+async def test_db_fetch_page_limit_zero_returns_all(fetch_page, db):
+    row = await db.fetch_page(
+        query="select * from test_db_fetch_page",
+        filters=Filters(limit=0),
+        model=DbTestModel,
+    )
+
+    assert row
+    assert row.total == len(TEST_DB_FETCH_PAGE_ROWS)
+    assert len(row.data) == len(TEST_DB_FETCH_PAGE_ROWS)
+
+
+@pytest.mark.anyio
+async def test_db_fetch_page_limit(fetch_page, db):
+    limit = 5
+    row = await db.fetch_page(
+        query="select * from test_db_fetch_page",
+        filters=Filters(limit=limit),
+        model=DbTestModel,
+    )
+
+    assert row
+    assert row.total == len(TEST_DB_FETCH_PAGE_ROWS)
+    assert len(row.data) == limit


@pytest.mark.anyio
@@ -45,7 +97,7 @@ async def test_db_fetch_page_group_by(fetch_page, db):
        group_by=["name"],
    )
    assert row
-    assert row.total == 4
+    assert row.total == len({test_row["name"] for test_row in TEST_DB_FETCH_PAGE_ROWS})


@pytest.mark.anyio
@@ -56,7 +108,9 @@ async def test_db_fetch_page_group_by_multiple(fetch_page, db):
        group_by=["value", "name"],
    )
    assert row
-    assert row.total == 5
+    assert row.total == len(
+        {(test_row["value"], test_row["name"]) for test_row in TEST_DB_FETCH_PAGE_ROWS}
+    )


@pytest.mark.anyio
@@ -15,7 +15,7 @@ from tests.helpers import make_upload_file

@pytest.mark.anyio
 async def test_create_user_asset_validates_upload_constraints(
-    settings: Settings, mocker: MockerFixture
+    app, settings: Settings, mocker: MockerFixture
 ):
    file_without_type = make_upload_file(b"hello", filename="a.txt", content_type=None)
    with pytest.raises(ValueError, match="File must have a content type."):
@@ -31,6 +31,40 @@ async def test_create_user_asset_validates_upload_constraints(
    ):
        await create_user_asset("user-1", bad_type, is_public=False)

+    xsl_upload = make_upload_file(
+        b"hello",
+        filename="style.xsl",
+        content_type="text/xml",
+    )
+    with pytest.raises(ValueError, match="File type 'text/xml' not allowed."):
+        await create_user_asset("user-1", xsl_upload, is_public=False)
+
+    original_allowed_mime_types = list(settings.lnbits_assets_allowed_mime_types)
+    try:
+        settings.lnbits_assets_allowed_mime_types = [
+            *original_allowed_mime_types,
+            "text/xml",
+        ]
+        xsl_content = make_upload_file(
+            b'<stylesheet xmlns="http://www.w3.org/1999/XSL/Transform"></stylesheet>',
+            filename="style.xml",
+            content_type="text/xml",
+        )
+        with pytest.raises(ValueError, match="File type 'text/xml' not allowed."):
+            await create_user_asset("user-1", xsl_content, is_public=False)
+    finally:
+        settings.lnbits_assets_allowed_mime_types = original_allowed_mime_types
+
+    fake_image = make_upload_file(
+        b"<?xml version='1.0'?><root></root>",
+        filename="fake.png",
+        content_type="image/png",
+    )
+    with pytest.raises(
+        ValueError, match="Image file content does not match declared file type."
+    ):
+        await create_user_asset("user-1", fake_image, is_public=False)
+
    original_max_assets = settings.lnbits_max_assets_per_user
    original_max_size = settings.lnbits_max_asset_size_mb
    original_no_limit_users = list(settings.lnbits_assets_no_limit_users)
@@ -40,14 +74,14 @@ async def test_create_user_asset_validates_upload_constraints(
        settings.lnbits_assets_no_limit_users = []
        limited_user = await _create_user()
        allowed_type = make_upload_file(
-            b"hello", filename="ok.txt", content_type="text/plain"
+            _png_bytes(), filename="ok.png", content_type="image/png"
        )
        await create_user_asset(limited_user, allowed_type, is_public=False)

        blocked_by_count = make_upload_file(
-            b"again",
-            filename="again.txt",
-            content_type="text/plain",
+            _png_bytes(),
+            filename="again.png",
+            content_type="image/png",
        )
        with pytest.raises(ValueError, match="Max upload count of 1 exceeded."):
            await create_user_asset(limited_user, blocked_by_count, is_public=False)
@@ -55,9 +89,9 @@ async def test_create_user_asset_validates_upload_constraints(
        settings.lnbits_max_asset_size_mb = 0.000001
        oversized_user = await _create_user()
        large_file = make_upload_file(
-            b"0123456789",
-            filename="ok.txt",
-            content_type="text/plain",
+            _png_bytes(),
+            filename="ok.png",
+            content_type="image/png",
        )
        with pytest.raises(ValueError, match="File limit of 1e-06MB exceeded."):
            await create_user_asset(oversized_user, large_file, is_public=False)
@@ -68,29 +102,66 @@ async def test_create_user_asset_validates_upload_constraints(


@pytest.mark.anyio
-async def test_create_user_asset_success(mocker: MockerFixture):
+async def test_create_user_asset_success(app, mocker: MockerFixture):
    user_id = await _create_user()
    mocker.patch(
        "lnbits.core.services.assets.thumbnail_from_bytes",
        return_value=None,
    )
-    file = make_upload_file(b"hello", filename="hello.txt", content_type="text/plain")
+    contents = _png_bytes()
+    file = make_upload_file(contents, filename="hello.png", content_type="image/png")

    asset = await create_user_asset(user_id, file, is_public=True)
    stored = await get_user_asset(user_id, asset.id)

    assert asset.id
    assert asset.user_id == user_id
-    assert asset.name == "hello.txt"
-    assert asset.size_bytes == 5
-    assert asset.data == b"hello"
+    assert asset.name == "hello.png"
+    assert asset.size_bytes == len(contents)
+    assert asset.data == contents
    assert asset.is_public is True
    assert stored is not None
    assert stored.id == asset.id
-    assert stored.data == b"hello"
+    assert stored.data == contents
    assert await get_user_assets_count(user_id) == 1


+@pytest.mark.anyio
+async def test_create_user_asset_stores_detected_image_mime_type(app):
+    user_id = await _create_user()
+    buffer = BytesIO()
+    Image.new("RGB", (32, 32), color="blue").save(buffer, format="JPEG")
+    file = make_upload_file(
+        buffer.getvalue(), filename="photo.jpg", content_type="image/jpg"
+    )
+
+    asset = await create_user_asset(user_id, file, is_public=True)
+    stored = await get_user_asset(user_id, asset.id)
+
+    assert asset.mime_type == "image/jpeg"
+    assert stored is not None
+    assert stored.mime_type == "image/jpeg"
+
+
+@pytest.mark.anyio
+async def test_create_user_asset_rejects_mismatched_image_content(app):
+    user_id = await _create_user()
+    buffer = BytesIO()
+    Image.new("RGB", (32, 32), color="blue").save(buffer, format="JPEG")
+    file = make_upload_file(
+        buffer.getvalue(), filename="photo.png", content_type="image/png"
+    )
+
+    with pytest.raises(
+        ValueError,
+        match=(
+            "Image file content does not match declared file type. "
+            "Declared: 'image/png', detected: 'image/jpeg'."
+        ),
+    ):
+        await create_user_asset(user_id, file, is_public=False)
+
+
 def test_thumbnail_from_bytes_success_and_failure():
    image = Image.new("RGB", (512, 512), color="red")
    buffer = BytesIO()
@@ -107,3 +178,9 @@ async def _create_user() -> str:
    user_id = uuid4().hex
    await create_account(Account(id=user_id, username=f"user_{user_id[:8]}"))
    return user_id
+
+
+def _png_bytes() -> bytes:
+    buffer = BytesIO()
+    Image.new("RGB", (32, 32), color="green").save(buffer, format="PNG")
+    return buffer.getvalue()
@@ -37,12 +37,14 @@ def test_dict_to_settings_parses_known_values():
        {
            "lnbits_site_title": "Test Title",
            "lnbits_service_fee": 5,
+            "lnbits_default_burger_menu_background": False,
            "ignored_field": "ignored",
        }
    )

    assert parsed.lnbits_site_title == "Test Title"
    assert parsed.lnbits_service_fee == 5
+    assert parsed.lnbits_default_burger_menu_background is False
    assert not hasattr(parsed, "ignored_field")


@@ -232,6 +232,14 @@ def test_installed_extensions_settings_activate_and_deactivate_paths():
    assert installed.find_extension_redirect("/.well-known/lnurlp", []) is None


+def test_public_settings_include_burger_menu_background(settings: Settings):
+    settings.lnbits_default_burger_menu_background = False
+
+    public_settings = PublicSettings.from_settings(settings)
+
+    assert public_settings.default_burger_menu_background is False
+
+
 def test_installed_extensions_settings_detects_conflicting_redirects():
    installed = InstalledExtensionsSettings(
        lnbits_extensions_redirects=[
Author	SHA1	Message	Date
ArcandGitHub	5a6ff7ed02	Merge branch 'dev' into trans_exts	2026-05-22 14:15:17 +01:00
Tiago Vasconcelos GitHub Arc	6664eebf5a	feat: add visibility toggle to inputs (#3940 ) Co-authored-by: Arc <ben@arc.wales>	2026-05-22 14:14:19 +01:00
Arc GitHub Vlad Stan	2a2af81827	feat: hide burger bg toggle (#3969 ) Co-authored-by: Vlad Stan <stan.v.vlad@gmail.com>	2026-05-22 14:04:46 +01:00
ArcandGitHub	9b47f6323f	fIx: pyinstrument import needed for nix (#3985 )	2026-05-22 13:56:06 +03:00
Vlad StanandGitHub	a61807a257	feat: square integration (#3962 )	2026-05-22 12:37:51 +03:00
Vlad StanandGitHub	30e0522419	fix: stricter asset upload (#3982 )	2026-05-21 12:44:23 +02:00
dni ⚡andGitHub	8f033a6047	fix: OIDC SSO login issues. closes #3970 (#3979 )	2026-05-20 09:27:02 +02:00
dni ⚡andGitHub	a2c817a56b	chore: update python packages (#3977 )	2026-05-19 10:58:14 +02:00
dni ⚡GitHub alan	555350085e	feat: add min-release-age to `.npmrc` + update packages (#3975 ) Co-authored-by: alan <alan@lnbits.com>	2026-05-19 09:41:32 +02:00
dni ⚡andGitHub	fc5061a67f	chore: remove unused library `Chart` (#3976 )	2026-05-19 09:36:14 +02:00
Tiago VasconcelosandGitHub	c9c68bd8d7	Fix: Use default reaction on bootstrap (#3965 )	2026-05-14 04:56:41 +02:00
Tiago VasconcelosandGitHub	810a13722c	fix: tighten agents file (#3966 )	2026-05-13 15:23:09 +03:00
Tiago VasconcelosandGitHub	36d696b222	Fix: wrong use of `in` operator (#3960 )	2026-05-08 11:38:12 +03:00
dni ⚡andGitHub	8b426efa3e	test: add pyinstrument profiler (#3955 )	2026-05-07 17:15:53 +02:00
Tiago Vasconcelos GitHub Vlad Stan	9edc4786e1	Fix: “Show all” table pagination (#3946 ) Co-authored-by: Vlad Stan <stan.v.vlad@gmail.com>	2026-05-07 12:02:19 +03:00
Tiago VasconcelosandGitHub	93dc10fe94	Feat: add AI guardrails to work on LNbits (#3942 )	2026-05-07 11:22:38 +03:00
ArcandGitHub	6c8448d7a8	fix: remove opensats (#3951 )	2026-05-01 15:07:49 +01:00
Arc	335c056a4b	feat: translation support for extensions	2026-05-01 13:05:47 +01:00
dni ⚡andGitHub	99e4f33142	chore: update to version v1.5.4 (#3939 )	2026-04-23 11:12:06 +02:00
ArcandGitHub	f4f43ad361	fix: Switching images to local (#3938 )	2026-04-21 11:41:45 +01:00
ArcandGitHub	f14ea6c577	fix: add auth_https_only to env.example (#3937 )	2026-04-17 14:50:26 +03:00
dni ⚡andGitHub	07428ecf94	chore: update to version v1.5.4-rc1 (#3935 )	2026-04-16 15:43:33 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	867e3d06f6	chore(deps): bump python-multipart from 0.0.22 to 0.0.26 (#3933 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-16 14:05:45 +02:00
Arc GitHub dni ⚡alan	4b4b6d0bcd	feat: adds an upload for assets on backgroundImage in account and site customisation (#3929 ) Co-authored-by: dni ⚡ <office@dnilabs.com> Co-authored-by: alan <alan@lnbits.com>	2026-04-16 14:05:24 +02:00
Tiago Vasconcelos GitHub alan	07b1521dad	feat: Add phoenixd mnemonic display (#3931 ) Co-authored-by: alan <alan@lnbits.com>	2026-04-16 13:42:58 +02:00
dni ⚡GitHub alan	7a2ddd9826	chore: update axios upgrade to 1.15.0 (#3936 ) Co-authored-by: alan <alan@lnbits.com>	2026-04-16 13:25:37 +02:00
ArcandGitHub	0eb4b477b7	feat: ui, adds full/thumb buttons to assets (#3928 )	2026-04-16 13:17:11 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	06a0ba58ce	chore(deps): bump pytest from 9.0.2 to 9.0.3 (#3930 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-16 13:15:33 +02:00
dni ⚡andGitHub	5399b36027	chore: revert changing default auth (#3934 )	2026-04-16 11:30:40 +02:00