* fix: update encryption scheme for node migration files
Migration files are now encrypted with AES-CTR using a key derived via
Argon2 with a 32-byte salt, the same derivation used for encrypted
configuration values. Files created by earlier versions can still be
restored: the restore path detects the scheme by trial-decrypting the
archive header and checking for the ZIP file signature, which also
rejects an incorrect unlock password up front instead of extracting
garbage.
The migration screen now also tells users to never share their
migration file with anyone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: reword migration file warning
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: read full migration file header before detecting cipher scheme
io.ReadAtLeast can return once the smallest scheme's header is read,
which truncates the larger current-scheme header when the reader
delivers short reads (e.g. a network request body). Read the full
header and only tolerate a short read that still covers the smallest
scheme.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: extract migration files to a staging directory during restore
If extraction failed partway through, the partially populated restore
directory was left in the working directory, and the next startup would
apply the incomplete restore. Extract to a staging directory and only
move it into place after every entry has been extracted successfully.
Also reject archives that contain no files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: assert traversal-specific error in restore backup test
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: remove legacy acceptance of empty unlock password check
CheckUnlockPassword previously treated a missing or empty
UnlockPasswordCheck value as a match — a legacy compatibility path from
before the canary was always written. It now requires the stored value
to be present and to equal the expected string.
StartApp checks for the canary up front and, if it is missing, stops
with a message asking the user to restore from a backup rather than
continuing. A new IsUnlockPasswordCheckSet helper reports whether the
value is present.
keys.Init now returns the error from reading NostrSecretKey instead of
ignoring it, so a read failure aborts instead of generating and saving a
new key.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: add operation context to unlock password check errors
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The setup API accepts file paths for the LND certificate and macaroon
and for the CLN lightning directory. Previously the raw file contents
were read and stored without any validation.
Validate these inputs before persisting them:
- LND cert: parse the PEM and store only the re-encoded certificate(s),
discarding any other PEM blocks (e.g. a bundled private key).
- LND macaroon: unmarshal and store the re-marshalled macaroon.
- CLN lightning directory: verify it contains the TLS credentials
(ca.pem, client.pem, client-key.pem) that CLN loads at connect time,
including the hold subdirectory when configured.
On failure, return a generic error to the client and log the detail
server-side. File paths remain supported for Umbrel-style installs.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
return_to query parameters are now parsed and only http and https URLs
are used for redirects, both in the frontend and when the createApp API
adds the connection parameters to the URL.
The production frontend build now also includes the same
Content-Security-Policy meta tag that is served as a header in http
mode, so the policy also applies where no HTTP headers are set, e.g. in
the desktop app.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Archive entry names come from the uploaded backup and were joined to the
restore directory without validation, so an entry name containing ".."
segments could resolve to a path outside it. Reject entries whose name is
absolute or escapes the restore directory, and confirm the cleaned
destination path stays within it before writing.
Add a test covering rejection of an entry that points outside the restore
directory.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: keep showing migration success page after creating migration file
After creating a node migration file the hub is halted and the Alby
OAuth token is intentionally removed, so visiting the homepage sent the
user through /start into the Alby OAuth flow. Track the halted state
in memory and redirect back to the migration success page instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: synchronize migration flag access and propagate zip close error
Make nodeMigrationFileCreated an atomic.Bool since it is written by
CreateBackup and read by GetInfo on concurrent HTTP handler goroutines,
and finalize the migration archive explicitly so a failed zip close
returns an error instead of reporting a corrupt backup as success.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: return minimal info response after migration file is created
Once a migration file is created the hub is halted and the database is
closed. GetInfo previously only worked because every config key it reads
happened to be served from the config cache; any cache miss on an
error-propagating read would fail /api/info. Return early with a minimal
response instead so the migration success page does not depend on cache
state.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Allows users running Alby Hub on postgres (e.g. Alby Cloud) to create a
migration file from Settings -> Migrate Alby Hub. The contents of the
postgres database are copied into a temporary local sqlite database
which is included in the migration file, so it can be imported into a
fresh sqlite-based hub.
- extract the db_migrate CLI copy logic into a shared db.MigrateDB
- also copy the swaps and forwards tables (previously silently dropped)
- only require VSS in the source when migrating to postgres
- show a hint on the migrate page when running on postgres
- show database storage type and VSS status on the about page
- don't log an error when removing non-existent db files before restore
Closes#2500
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: update bark onboarding and backup messaging for seed-based recovery
Since bark 0.6.0, offchain funds are recoverable from the mnemonic
alone via the seed-derived recovery mailbox. Remove the outdated
warnings that the recovery phrase is not sufficient, show the standard
recovery guidance for bark during onboarding, and expose the
seed-recovery scan result as a 'recoveryreport' custom node command so
users migrating to a new device can verify their funds were restored.
Closes#2512
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: settle bark lightning receives in the new delivering state
bark 0.6.0 added a 'delivering' receive state between preimage reveal
and settlement. The receive claim handler only treated
'preimage-revealed' and 'settled' as paid, so claimed receives were
published without a preimage and the transactions service rejected the
settlement ('no preimage in payment'), leaving paid invoices pending
forever.
Recognize all states at or past preimage reveal via a receiveIsPaid
helper (a positive allowlist, so an unknown future state degrades to
pending rather than falsely settled), only mark the transaction settled
when the preimage is present, and prefer bark's own settled_at
timestamp when available.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: replace import channels checkbox with LDK-specific warning
The 'I don't have another Alby Hub to migrate or open channels'
checkbox on the import recovery phrase screen only applied to LDK but
was required for every backend, and its claim that channel funds are
always lost is wrong when dynamic channel backups (VSS) are enabled.
Remove the checkbox and the channels bullet from the import screen and
show the caveat on the Security & Recovery page instead, only when a
mnemonic was imported and the LDK backend was chosen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: filter transactions
* fix: harden transaction filters
* refactor: use explicit nullable transaction filters with HideFailed polarity
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: set transaction filters in a dialog from wallet actions menu
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: filter transactions by search term and type
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: reject invalid transaction filters and reset page synchronously
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: parse complete minimum amount value in transactions filter dialog
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: just in time channels with lsps2
* fix: clarify JIT receive channel fee
* fix: fees
* fix: fees 2
* fix: don't show low inbound when LSPS2 is active
* fix: remove the receive limit below the input if LSPS2 is being used
* fix: simplify
* fix: bring back fee % for outgoing
* fix: remove unneeded changes
* fix: typo
* fix: unneeded
* fix: don't show open first channel is LSPS2
* feat: clearer JIT channel fee copy on receive screen
* fix: add LSPS2 var info
* fix: don't duplicate JIT fee hint on create invoice form
* fix: make paymentDone a standard boolean
* fix: update to golang:1.26 in Dockerfile
* feat: read LSPS2 sources from channel suggestions, set minimum receive amount, update guide link
* docs: update LDK_LSPS2_ADDRESSES to be used as an override
* fix: only show minimum jit receive amount on validation error
* fix: add more detail to receive error when receiving low amounts with jit
* fix: do not use JIT when user has public channels
* feat: add option to disable JIT
* fix: isTrusted check, add jit property to event
* fix: do not require node restart for toggling JIT
* chore: simplify JIT alert
* chore: add guide link on node settings JIT description
* feat: fetch the lsp2info to have access to params like minimum/maximum payment size
* refactor: share single learn-more link across JIT fee hint branches
* fix: remove variable amount invoice support
* fix: use lsps2info for min payment size and remove channelPeerSuggestion usage of minimumChannelSize
* fix: only do amount validation according to lsps2Info values if jit is enabled in settings
* feat: add jit first payment fee alert on receive via lightning address
* fix: remove unnecessary conditional
* fix: ensure at least one sat is left over when opening JIT channel
* chore: remove hardcoded suggestions
* chore: rename JIT enabled config variable
* fix: ui checks when JIT is disabled
* fix: amount input validation message
* fix: formatting
---------
Co-authored-by: anon <anon@anon.com>
Co-authored-by: saunter <68239231+stackingsaunter@users.noreply.github.com>
Co-authored-by: fmar <fmar@fmar>
Co-authored-by: René Aaron <rene@twentyuno.net>
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: integrate Stories widget with backend endpoint
Add stories endpoint plumbing for HTTP and Wails, wire the Home Stories card
to fetch from /api/alby/stories, and keep it first in the right column.
Made-with: Cursor
* feat(home): story modal CTAs and preview fallback
- Add contextual actions in the story dialog (update hub with version,
open Alby Go in-app, install extension) keyed by kind or title
- Use preview stories when the stories API request fails
- Pass hub version from useInfo into the update link
Made-with: Cursor
* feat(stories): polish modal, drop preview fallback
- Widen modal and put video edge-to-edge with overlay close button
- Drop verbose header and 'Watch on YouTube' button
- Remove previewStories fallback so widget hides until upstream API ships
- Tighten title line-height
* feat(stories): render cta from API instead of mapping by kind
Move CTA copy and URLs into the API response. Hub renders story.cta
directly, so adding new story types no longer requires a hub release.
* chore(csp): allow cdn.getalby-assets.com in img-src
* feat(stories): bump avatar size and add ring gap
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): post-review cleanups
- Use react-router Link for in-tab CTA instead of plain <a>.
- Drop redundant www.youtube.com from frame-src (embeds always go through nocookie).
- Tighten stories endpoint status check from >= 300 to >= 400.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): address CodeRabbit feedback
- Switch StoriesWidget to useSWR + swrFetcher (project convention).
- Guard story iframe with isYouTubeUrl so non-YouTube urls never embed.
- Wrap GetStories errors with fmt.Errorf("...: %w", err).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): drop isYouTubeUrl guard
Stories are curated and always YouTube; the runtime check was
redundant. CSP frame-src still constrains the iframe source.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): drop getYouTubeEmbedUrl, embed videoUrl as-is
The Alby API now sends canonical youtube-nocookie embed URLs with
autoplay/rel query strings (getAlby/getalby.com#2568), so the
runtime normalization is no longer needed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): use w-16 instead of arbitrary w-[73px]
Match the avatar's size token; no magic numbers.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): take videoId from API and assemble embed url locally
Pairs with getAlby/getalby.com#2568. The API now sends just the
YouTube videoId; the hub composes the canonical embed URL so the
domain/query-string format stays in one place.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): treat 3xx as non-success, matching file convention
The other status checks in alby_oauth_service.go all use >= 300;
align GetStories so redirects don't slip through.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): move viewed-storage key to constants, widen story button
Address review feedback:
- Centralize the localStorage key for viewed stories in localStorageKeys
alongside the other keys.
- Widen the story button from w-16 to w-20 so "Alby Extension" fits on
one line and matches the other titles.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): bump story button to w-24 so titles fit one line
w-20 still wrapped "Alby Extension"; w-24 fits all current titles
without truncation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Revert "chore(stories): bump story button to w-24 so titles fit one line"
This reverts commit 0b47438f50.
* chore(stories): split title words onto separate lines
Reserve two lines for every story title so avatars align regardless of
title length.
* chore(stories): align homeStoriesViewed key with sibling pattern
* chore(stories): fit titles on one line
* chore(stories): widen story button to w-21 for one-line titles
---------
Co-authored-by: René Aaron <rene@twentyuno.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: remove json tags from lnclient models
these should not be passed through the API directly
* fix: properly return not implemented errors
* fix: json tags on TLVRecord
* fix: show BOLT-12 offer button for CLN backend
The CLN backend implements MakeOffer and the /api/offers endpoint is
backend-agnostic, but the UI only surfaced the "Lightning Offer" button
when backendType === "LDK", leaving CLN users without a way to reach
the flow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: gate BOLT-12 offer UI on supportsBolt12 from useInfo
Surface a supportsBolt12 capability on the info response (true for LDK
and CLN) so the frontend stops hardcoding backend-type checks for the
BOLT-12 offer button.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: add CLN as a lnclient backend
* feat: add hold invoice support for CLN backend
* fix: reduce CLN form to just addresses and lightning dir
* feat: add README for CLN grpc go code generation
* fix: cln backend does not support keysend with given preimages
* fix: hold invoice notifications in CLN backend
* fix: remove dead code in CLN backend from ListTransactions
* fix: env example CLN_ADDRESS_HOLD with different port to show it's a different service
* fix: cleanup of CLN ressources in all cases
* fix: cln backend's GetNetworkGraph only fetches specified nodeId's
* fix: cln backend: only advertise hold methods for nip47 if hold plugin enabled
* fix: cln's Shutdown should not stop CLN itself
* fix: relax the LND README line regarding env configuration
* fix: more nil checks in clnInvoiceToTransaction
* fix: prevent feerate overflow in CLN's RedeemOnchainFunds
* fix: don't access nil errors for empty reponses of certain CLN methods
* fix: nil instead of empty string in cln's GetNetworkGraph return types
* fix: nil checks for created_at in cln's clnInvoiceToTransaction
* fix: set minimum tls version to 1.2 for cln backend grpc connections
* fix: cln's subscribeOpenHoldInvoices doesn't give up as fast
* fix: deduplicate graph edges in cln's GetNetworkGraph
* fix: print the error string, not pointer address, in cln's ListChannels
* fix: remove cln's ListTransactions completely
* fix: use ListPeers instead of ListPeerChannels in cln's ListPeers
* feat: cln's MakeHoldInvoice supports minCltvExpiryDelta
* fix: use named return err in NewCLNService
* fix: cln listpeers log message
* fix: incorrect import
* fix: compile errors after rename
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: user labels poc
* feat: backend for transaction user labels
Add PATCH /api/transactions/:paymentHash/label that merges a
user-supplied {key:value} map into the existing transaction metadata
under the user_label key, preserving NIP-47 fields. Empty map clears
the labels. Trims whitespace, drops blank rows, caps key/value length.
Wire the frontend editor to call the endpoint and revalidate the
transactions SWR cache on success.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: include user labels as columns in CSV export
Collect the union of user_label keys across all exported transactions
and emit each one as its own label_<key> column. The existing metadata
JSON column is preserved so importers like Raccoin keep working.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: drop hardcoded label suggestions, autocomplete from prior keys
Open the editor with a single blank row instead of four pre-seeded
fields. Suggest label keys via a datalist populated from any
user_label keys already present in the SWR transactions cache, so
suggestions reflect the user's own taxonomy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: inline label editor and indicator-only list row
Replace the nested label dialog with an inline editor that toggles
within the existing transaction detail dialog, removing dialog
stacking. In the transactions list, replace per-label badges with a
single tag icon next to the timestamp so row height stays uniform; the
full labels remain visible in the detail view.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: don't bump updated_at on metadata-only edits
GORM's Update auto-touches updated_at, which made the transactions
list reorder labeled transactions to the top. Switch
SetTransactionMetadata to UpdateColumn so only the metadata column
changes. Add regression test.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: route PATCH transaction label requests in wails
The desktop app routes API calls through WailsRequestRouter rather
than HTTP. Add a handler for PATCH /api/transactions/:hash/label
before the existing transaction lookup so labels work in Wails too.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: finalize backend
* chore: rename to labels
* chore: finalize frontend
* chore: use tx id to add user labels
* chore: address minor nits
* fix: linting
* fix: use explicit primary key lookups
* chore: simplify transaction csv label export
* fix(frontend): drop label count from transaction list badge
The count adds visual weight without informing any decision from the
list view. The icon-as-badge already signals labels exist; the actual
values are in the details dialog.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(frontend): revert transaction list label indicator to bare icon
The Badge wrapper made the icon-only indicator wider than tall, which
looked off. Restores the pre-PR look — a small TagIcon next to the
timestamp — since the in-dialog editor is the place to see actual labels.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* feat: add both Sat and Msat companion fields for all ambiguous balance/amount properties
* feat: add sat and msat companion fields to backend API responses
* chore: align frontend types and other missing fields
* chore: keep old formula for calculating total fee sat
* chore: remove unnecessary balance assignments in cashu and phoenix
* chore: add deprecated comment to non unit fields
* chore: rename callers and variable to specify units
* chore: remove msat fields for channel size and liquidity fields
* chore: drop msat fields from onchain channel size and liquidity responses
* chore: further changes
* chore: remove amount msat field onchain tx
* chore: remove msats from onchain balance response
* chore: remove msat fields for swaps
* chore: remove msat fields for punishment reserves
* chore: simplify rebalancing fee calculation
* chore: remove unnecessary fields
* chore: mark deprecated fields in frontend types
---------
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* feat: track last settled transaction time for apps
* fix: use default subwallet ordering and app_id logging in event handler
* chore: rename to last_settled_transaction_at and remove last tx migration
* chore: split app settlement update and budget check
* chore: extract app display name helper into utils function
* feat: add chain data source and address to about page
* fix: only show chainsource for ldk
* fix: redact chain-source address secrets and return complete bitcoind endpoint
* chore: make sanitize function readable and add tests
* fix: align ldk chain data source labels
---------
Co-authored-by: anon <anon@anon.com>
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* fix: checks for ok status code in responses
* refactor: replacing native fetch with useSWR
* chore: remove url from logs
* chore: add phoenixd error logs for non-success responses
* chore: add use currencies hook
* chore: use loading from currencies hook and filter out btc
---------
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* feat: add custom message support for subwallet transfers
- Add optional message field to TransferRequest model
- Update Transfer function to use custom message with 'transfer' as fallback
- Update HTTP and Wails handlers to extract and pass message parameter
- Add message input field to IsolatedAppTopupDialog and IsolatedAppDrawDownDialog
- Maintains backward compatibility with empty message defaulting to 'transfer'
Closes#2066
* chore: rename
* chore: rename and simplify
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* fix: return optional total balance in list apps response for subwallets
* chore: add error handling to subwallet balance query
* chore: add METADATA_APPSTORE_APP_ID_KEY constant
* chore: add MAX_FREE_SUBWALLETS constant
* chore: use subwallet query and total count for limit check
* feat: add HIDE_UPDATE_BANNER environment variable
Add a new HIDE_UPDATE_BANNER env var that allows platform operators
(e.g. Start9) to suppress the built-in version update banner when
they provide their own update notification mechanism.
When set to true, the "What's New" widget is hidden and the header
banner only shows for VSS migration notices. The version comparison
against the Alby API is skipped entirely.
Closes#2048
* chore: simplify
* chore: undo changes
---------
Co-authored-by: Joel Klabo <max@klabo.world>
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* chore: log go-nostr debug messages
* fix: handle unexpected subscription closes from relay
* chore: also output messages from go-nostr info logger in debug mode
* chore: temporarily use forked go-nostr fix
* chore: update forked go-nostr fix
* fix: relay shows as offline on startup
* chore: update go-nostr
* chore: remove debug tags
* chore: run go mod tidy
* fix: only get relay statuses once
* feat: support multiple relays (WIP)
* fix: multiple NWC url construction for multiple relays
* fix: startup
* chore: update go-nostr to fix pool relay reconnect
* fix: split nip-47 queue info publish event for each relay url
* fix: add relayUrls to dispatched nwc success events
* fix: ensure newly created app info publishing is not blocked by sleep from failed publishes
* feat: multiple relays improvements
- update app deleted and updated consumers to handle multiple relays
- handle multiple relays in healthcheck
- display relay online status in about page
- renaming and improved comments
* chore: simplify error messages
* fix: unnecessary db error log when checking if app has notification permission
* fix: tests
* chore: remove old comment
* fix: app wallet subscription context usage
* fix: update patch app endpoints to allow sending partial fields from the frontend
* fix: removed unnessary complexity in handlesave func
* fix: use correct subwallet app id when setting subwallet lightning address in get_info command
* fix: do not allow changing subwallet to be non-isolated
* chore: simplify update app scopes logic
* fix: patch app to remove expires at
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: read only JWT for http api use
* fix: pass permission to start and unlock endpoints
* chore: add http service JWT tests
* chore: update mocks
* fix: close db in tests
