The setup API accepts file paths for the LND certificate and macaroon
and for the CLN lightning directory. Previously the raw file contents
were read and stored without any validation.
Validate these inputs before persisting them:
- LND cert: parse the PEM and store only the re-encoded certificate(s),
discarding any other PEM blocks (e.g. a bundled private key).
- LND macaroon: unmarshal and store the re-marshalled macaroon.
- CLN lightning directory: verify it contains the TLS credentials
(ca.pem, client.pem, client-key.pem) that CLN loads at connect time,
including the hold subdirectory when configured.
On failure, return a generic error to the client and log the detail
server-side. File paths remain supported for Umbrel-style installs.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
return_to query parameters are now parsed and only http and https URLs
are used for redirects, both in the frontend and when the createApp API
adds the connection parameters to the URL.
The production frontend build now also includes the same
Content-Security-Policy meta tag that is served as a header in http
mode, so the policy also applies where no HTTP headers are set, e.g. in
the desktop app.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: keep showing migration success page after creating migration file
After creating a node migration file the hub is halted and the Alby
OAuth token is intentionally removed, so visiting the homepage sent the
user through /start into the Alby OAuth flow. Track the halted state
in memory and redirect back to the migration success page instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: synchronize migration flag access and propagate zip close error
Make nodeMigrationFileCreated an atomic.Bool since it is written by
CreateBackup and read by GetInfo on concurrent HTTP handler goroutines,
and finalize the migration archive explicitly so a failed zip close
returns an error instead of reporting a corrupt backup as success.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: return minimal info response after migration file is created
Once a migration file is created the hub is halted and the database is
closed. GetInfo previously only worked because every config key it reads
happened to be served from the config cache; any cache miss on an
error-propagating read would fail /api/info. Return early with a minimal
response instead so the migration success page does not depend on cache
state.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Allows users running Alby Hub on postgres (e.g. Alby Cloud) to create a
migration file from Settings -> Migrate Alby Hub. The contents of the
postgres database are copied into a temporary local sqlite database
which is included in the migration file, so it can be imported into a
fresh sqlite-based hub.
- extract the db_migrate CLI copy logic into a shared db.MigrateDB
- also copy the swaps and forwards tables (previously silently dropped)
- only require VSS in the source when migrating to postgres
- show a hint on the migrate page when running on postgres
- show database storage type and VSS status on the about page
- don't log an error when removing non-existent db files before restore
Closes#2500
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: update bark onboarding and backup messaging for seed-based recovery
Since bark 0.6.0, offchain funds are recoverable from the mnemonic
alone via the seed-derived recovery mailbox. Remove the outdated
warnings that the recovery phrase is not sufficient, show the standard
recovery guidance for bark during onboarding, and expose the
seed-recovery scan result as a 'recoveryreport' custom node command so
users migrating to a new device can verify their funds were restored.
Closes#2512
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: settle bark lightning receives in the new delivering state
bark 0.6.0 added a 'delivering' receive state between preimage reveal
and settlement. The receive claim handler only treated
'preimage-revealed' and 'settled' as paid, so claimed receives were
published without a preimage and the transactions service rejected the
settlement ('no preimage in payment'), leaving paid invoices pending
forever.
Recognize all states at or past preimage reveal via a receiveIsPaid
helper (a positive allowlist, so an unknown future state degrades to
pending rather than falsely settled), only mark the transaction settled
when the preimage is present, and prefer bark's own settled_at
timestamp when available.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: replace import channels checkbox with LDK-specific warning
The 'I don't have another Alby Hub to migrate or open channels'
checkbox on the import recovery phrase screen only applied to LDK but
was required for every backend, and its claim that channel funds are
always lost is wrong when dynamic channel backups (VSS) are enabled.
Remove the checkbox and the channels bullet from the import screen and
show the caveat on the Security & Recovery page instead, only when a
mnemonic was imported and the LDK backend was chosen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: just in time channels with lsps2
* fix: clarify JIT receive channel fee
* fix: fees
* fix: fees 2
* fix: don't show low inbound when LSPS2 is active
* fix: remove the receive limit below the input if LSPS2 is being used
* fix: simplify
* fix: bring back fee % for outgoing
* fix: remove unneeded changes
* fix: typo
* fix: unneeded
* fix: don't show open first channel is LSPS2
* feat: clearer JIT channel fee copy on receive screen
* fix: add LSPS2 var info
* fix: don't duplicate JIT fee hint on create invoice form
* fix: make paymentDone a standard boolean
* fix: update to golang:1.26 in Dockerfile
* feat: read LSPS2 sources from channel suggestions, set minimum receive amount, update guide link
* docs: update LDK_LSPS2_ADDRESSES to be used as an override
* fix: only show minimum jit receive amount on validation error
* fix: add more detail to receive error when receiving low amounts with jit
* fix: do not use JIT when user has public channels
* feat: add option to disable JIT
* fix: isTrusted check, add jit property to event
* fix: do not require node restart for toggling JIT
* chore: simplify JIT alert
* chore: add guide link on node settings JIT description
* feat: fetch the lsp2info to have access to params like minimum/maximum payment size
* refactor: share single learn-more link across JIT fee hint branches
* fix: remove variable amount invoice support
* fix: use lsps2info for min payment size and remove channelPeerSuggestion usage of minimumChannelSize
* fix: only do amount validation according to lsps2Info values if jit is enabled in settings
* feat: add jit first payment fee alert on receive via lightning address
* fix: remove unnecessary conditional
* fix: ensure at least one sat is left over when opening JIT channel
* chore: remove hardcoded suggestions
* chore: rename JIT enabled config variable
* fix: ui checks when JIT is disabled
* fix: amount input validation message
* fix: formatting
---------
Co-authored-by: anon <anon@anon.com>
Co-authored-by: saunter <68239231+stackingsaunter@users.noreply.github.com>
Co-authored-by: fmar <fmar@fmar>
Co-authored-by: René Aaron <rene@twentyuno.net>
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: integrate Stories widget with backend endpoint
Add stories endpoint plumbing for HTTP and Wails, wire the Home Stories card
to fetch from /api/alby/stories, and keep it first in the right column.
Made-with: Cursor
* feat(home): story modal CTAs and preview fallback
- Add contextual actions in the story dialog (update hub with version,
open Alby Go in-app, install extension) keyed by kind or title
- Use preview stories when the stories API request fails
- Pass hub version from useInfo into the update link
Made-with: Cursor
* feat(stories): polish modal, drop preview fallback
- Widen modal and put video edge-to-edge with overlay close button
- Drop verbose header and 'Watch on YouTube' button
- Remove previewStories fallback so widget hides until upstream API ships
- Tighten title line-height
* feat(stories): render cta from API instead of mapping by kind
Move CTA copy and URLs into the API response. Hub renders story.cta
directly, so adding new story types no longer requires a hub release.
* chore(csp): allow cdn.getalby-assets.com in img-src
* feat(stories): bump avatar size and add ring gap
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): post-review cleanups
- Use react-router Link for in-tab CTA instead of plain <a>.
- Drop redundant www.youtube.com from frame-src (embeds always go through nocookie).
- Tighten stories endpoint status check from >= 300 to >= 400.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): address CodeRabbit feedback
- Switch StoriesWidget to useSWR + swrFetcher (project convention).
- Guard story iframe with isYouTubeUrl so non-YouTube urls never embed.
- Wrap GetStories errors with fmt.Errorf("...: %w", err).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): drop isYouTubeUrl guard
Stories are curated and always YouTube; the runtime check was
redundant. CSP frame-src still constrains the iframe source.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): drop getYouTubeEmbedUrl, embed videoUrl as-is
The Alby API now sends canonical youtube-nocookie embed URLs with
autoplay/rel query strings (getAlby/getalby.com#2568), so the
runtime normalization is no longer needed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): use w-16 instead of arbitrary w-[73px]
Match the avatar's size token; no magic numbers.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): take videoId from API and assemble embed url locally
Pairs with getAlby/getalby.com#2568. The API now sends just the
YouTube videoId; the hub composes the canonical embed URL so the
domain/query-string format stays in one place.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): treat 3xx as non-success, matching file convention
The other status checks in alby_oauth_service.go all use >= 300;
align GetStories so redirects don't slip through.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): move viewed-storage key to constants, widen story button
Address review feedback:
- Centralize the localStorage key for viewed stories in localStorageKeys
alongside the other keys.
- Widen the story button from w-16 to w-20 so "Alby Extension" fits on
one line and matches the other titles.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(stories): bump story button to w-24 so titles fit one line
w-20 still wrapped "Alby Extension"; w-24 fits all current titles
without truncation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Revert "chore(stories): bump story button to w-24 so titles fit one line"
This reverts commit 0b47438f50.
* chore(stories): split title words onto separate lines
Reserve two lines for every story title so avatars align regardless of
title length.
* chore(stories): align homeStoriesViewed key with sibling pattern
* chore(stories): fit titles on one line
* chore(stories): widen story button to w-21 for one-line titles
---------
Co-authored-by: René Aaron <rene@twentyuno.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: remove json tags from lnclient models
these should not be passed through the API directly
* fix: properly return not implemented errors
* fix: json tags on TLVRecord
* fix: show BOLT-12 offer button for CLN backend
The CLN backend implements MakeOffer and the /api/offers endpoint is
backend-agnostic, but the UI only surfaced the "Lightning Offer" button
when backendType === "LDK", leaving CLN users without a way to reach
the flow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: gate BOLT-12 offer UI on supportsBolt12 from useInfo
Surface a supportsBolt12 capability on the info response (true for LDK
and CLN) so the frontend stops hardcoding backend-type checks for the
BOLT-12 offer button.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: add CLN as a lnclient backend
* feat: add hold invoice support for CLN backend
* fix: reduce CLN form to just addresses and lightning dir
* feat: add README for CLN grpc go code generation
* fix: cln backend does not support keysend with given preimages
* fix: hold invoice notifications in CLN backend
* fix: remove dead code in CLN backend from ListTransactions
* fix: env example CLN_ADDRESS_HOLD with different port to show it's a different service
* fix: cleanup of CLN ressources in all cases
* fix: cln backend's GetNetworkGraph only fetches specified nodeId's
* fix: cln backend: only advertise hold methods for nip47 if hold plugin enabled
* fix: cln's Shutdown should not stop CLN itself
* fix: relax the LND README line regarding env configuration
* fix: more nil checks in clnInvoiceToTransaction
* fix: prevent feerate overflow in CLN's RedeemOnchainFunds
* fix: don't access nil errors for empty reponses of certain CLN methods
* fix: nil instead of empty string in cln's GetNetworkGraph return types
* fix: nil checks for created_at in cln's clnInvoiceToTransaction
* fix: set minimum tls version to 1.2 for cln backend grpc connections
* fix: cln's subscribeOpenHoldInvoices doesn't give up as fast
* fix: deduplicate graph edges in cln's GetNetworkGraph
* fix: print the error string, not pointer address, in cln's ListChannels
* fix: remove cln's ListTransactions completely
* fix: use ListPeers instead of ListPeerChannels in cln's ListPeers
* feat: cln's MakeHoldInvoice supports minCltvExpiryDelta
* fix: use named return err in NewCLNService
* fix: cln listpeers log message
* fix: incorrect import
* fix: compile errors after rename
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: add both Sat and Msat companion fields for all ambiguous balance/amount properties
* feat: add sat and msat companion fields to backend API responses
* chore: align frontend types and other missing fields
* chore: keep old formula for calculating total fee sat
* chore: remove unnecessary balance assignments in cashu and phoenix
* chore: add deprecated comment to non unit fields
* chore: rename callers and variable to specify units
* chore: remove msat fields for channel size and liquidity fields
* chore: drop msat fields from onchain channel size and liquidity responses
* chore: further changes
* chore: remove amount msat field onchain tx
* chore: remove msats from onchain balance response
* chore: remove msat fields for swaps
* chore: remove msat fields for punishment reserves
* chore: simplify rebalancing fee calculation
* chore: remove unnecessary fields
* chore: mark deprecated fields in frontend types
---------
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* feat: track last settled transaction time for apps
* fix: use default subwallet ordering and app_id logging in event handler
* chore: rename to last_settled_transaction_at and remove last tx migration
* chore: split app settlement update and budget check
* chore: extract app display name helper into utils function
* feat: add chain data source and address to about page
* fix: only show chainsource for ldk
* fix: redact chain-source address secrets and return complete bitcoind endpoint
* chore: make sanitize function readable and add tests
* fix: align ldk chain data source labels
---------
Co-authored-by: anon <anon@anon.com>
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* fix: checks for ok status code in responses
* refactor: replacing native fetch with useSWR
* chore: remove url from logs
* chore: add phoenixd error logs for non-success responses
* chore: add use currencies hook
* chore: use loading from currencies hook and filter out btc
---------
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* fix: return optional total balance in list apps response for subwallets
* chore: add error handling to subwallet balance query
* chore: add METADATA_APPSTORE_APP_ID_KEY constant
* chore: add MAX_FREE_SUBWALLETS constant
* chore: use subwallet query and total count for limit check
* feat: add HIDE_UPDATE_BANNER environment variable
Add a new HIDE_UPDATE_BANNER env var that allows platform operators
(e.g. Start9) to suppress the built-in version update banner when
they provide their own update notification mechanism.
When set to true, the "What's New" widget is hidden and the header
banner only shows for VSS migration notices. The version comparison
against the Alby API is skipped entirely.
Closes#2048
* chore: simplify
* chore: undo changes
---------
Co-authored-by: Joel Klabo <max@klabo.world>
Co-authored-by: im-adithya <imadithyavardhan@gmail.com>
* chore: log go-nostr debug messages
* fix: handle unexpected subscription closes from relay
* chore: also output messages from go-nostr info logger in debug mode
* chore: temporarily use forked go-nostr fix
* chore: update forked go-nostr fix
* fix: relay shows as offline on startup
* chore: update go-nostr
* chore: remove debug tags
* chore: run go mod tidy
* fix: only get relay statuses once
* feat: support multiple relays (WIP)
* fix: multiple NWC url construction for multiple relays
* fix: startup
* chore: update go-nostr to fix pool relay reconnect
* fix: split nip-47 queue info publish event for each relay url
* fix: add relayUrls to dispatched nwc success events
* fix: ensure newly created app info publishing is not blocked by sleep from failed publishes
* feat: multiple relays improvements
- update app deleted and updated consumers to handle multiple relays
- handle multiple relays in healthcheck
- display relay online status in about page
- renaming and improved comments
* chore: simplify error messages
* fix: unnecessary db error log when checking if app has notification permission
* fix: tests
* chore: remove old comment
* fix: app wallet subscription context usage
* fix: update patch app endpoints to allow sending partial fields from the frontend
* fix: removed unnessary complexity in handlesave func
* fix: use correct subwallet app id when setting subwallet lightning address in get_info command
* fix: do not allow changing subwallet to be non-isolated
* chore: simplify update app scopes logic
* fix: patch app to remove expires at
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: choose payment method when opening first channel (WIP)
* chore: update terms
* chore: consume lsp endpoint, display fees+LSP in manual channel flow, first channel ui improvements
* chore: improve handling of fee_credits payment method
* chore: add terms and description
* feat: add terms to manual increase incoming capacity flow
* chore: add error handling for get_info endpoint
* feat: allow alby account to pay for manual channel order
* chore: use consistent logging methods
* chore: rename lsp balance sats field to be consistent
* chore: update to use consistent field name for public key in auto channel request
* chore: rename channel suggestion url and type fields
* feat: support included payment method
* chore: update LDK startup peers
* chore: move non-oauth methods out of alby oauth service
* chore: improve terms around duration, only display duration in terms modal
* chore: remove balance card and fix layout
* chore: change send screen styling
* feat: add onchain send
* feat: send exact amount in swap outs
* chore: address feedback
* chore: change swap transaction title and add to address
* chore: refactor zero amount screen and remove confirmation
* chore: add x icon to recipient in lnurl pay
* chore: split onchain send page into separate components
* fix: set headers and remove send layout
* chore: show warning if balance is low
* chore: change name to PendingPaymentAlert
* chore: add increase balance warning on exceeding amount
* chore: minor changes
* chore: remove you'll be notified message
* chore: add on-chain transactions alert on wallet page
* chore: align sending and payment pending alerts
* chore: make sure amount doesn't reset
* fix: small onchain amount alert copy
* chore: rename isSending to useExactReceiveAmount
* chore: add mempool and anchor reserves alert to onchain send screen
* chore: use spending alert consistently and remove red text
* chore: add option to edit fee rate
* fix: styling after tailwind upgrade
* feat: add swap in and onchain deposit to receive flow (#1585)
* chore: remove receive layout
* feat: add onchain address to receive flow
* feat: add receive screen to swap in and deposit bitcoin
* chore: rename import to MIN_SWAP_AMOUNT
* chore: add onchain button when alby account is disconnected
* fix: link
* chore: add OnchainAddressDisplay and use useSearchParams hook
* fix: use actual swap limits from boltz api (#1598)
* fix: create another invoice button
* chore: use fee rate instead of network fee
* fix: styling after tailwind upgrade
* chore: rename swap fees to swap info
* chore: use lottie loading component
* chore: add mempool alert
* chore: make swaps the default option for send/receive onchain
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* chore: consistently show fee rate in sat/vByte
* chore: minor copy changes
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: add app last used time
* chore: use app last used instead of fetching last event
* chore: rename last_used to last_used_at, remove unused code
* fix: prettier
