diff --git a/.envrc b/.envrc deleted file mode 100644 index 3550a30..0000000 --- a/.envrc +++ /dev/null @@ -1 +0,0 @@ -use flake diff --git a/CLAUDE.md b/CLAUDE.md index 1b2e8a0..20ba0df 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -15,11 +15,9 @@ Core principles: ## Provenance + legal status -The HAL drivers (validators / dispensers / printers) and the cash-flow state machine derive from Lamassu Industries AG's `lamassu-machine` repository, **only up to commit `c0b69d1ed196d396c5f057478c2ea290babd58ab`** ("chore: v8.6.0-beta.9", 2023-09-19) — the last commit published into the public domain (`UNLICENSE` in tree). The very next commit, `a9234d124d` ("chore: add LICENSE (#1019)", 2023-09-19), removed `UNLICENSE` and added Lamassu's proprietary "Appendix A SLA". **The `v8.1.5` tag (2023-09-21) already ships the Appendix A license** — the previously documented "8.1.5 is the open boundary" was wrong (verified against GitHub history 2026-07-04). Note the public-domain boundary sits on the 8.6-beta line, which is *further along* than 8.1.5 feature-wise. +The HAL drivers (validators / dispensers / printers) and the cash-flow state machine derive from Lamassu Industries AG's open-source `lamassu-machine` and `lamassu-server` repositories, **only up to v8.1.5** — the last release published under a fully-open license. Lamassu transitioned to a proprietary, source-available license (their custom "Appendix A SLA") on 2024-01-26 and gated v8.1.6+ behind a paid OSA subscription. -**Hard rule when working in this repo:** do not pull, port, or copy lamassu-machine code from `a9234d124d` or later (which includes every 8.1.5+ tag). Reference only `c0b69d1` or earlier. If a HAL bug fix or feature exists upstream past that commit, either (a) reimplement from protocol docs / hardware specs without looking at the licensed source, or (b) raise the question with the maintainer first. To fetch the open tree safely: `git fetch --depth 1 origin c0b69d1ed196d396c5f057478c2ea290babd58ab` — never check out a tag. - -The `lamassu-server` boundary has not been re-verified against its own history and may differ — check its license-change commit before referencing it. +**Hard rule when working in this repo:** do not pull, port, or copy code from lamassu-machine / lamassu-server at v8.1.6 or later. If a HAL bug fix or feature exists upstream past 8.1.5, either (a) reimplement from protocol docs / hardware specs without looking at v8.1.6+ source, or (b) raise the question with the maintainer first. The 8.1.5 tree is fair game; everything after is licensed code we have no rights to. bitSpire is an independent project under AGPL-3.0 and is not affiliated with Lamassu Industries AG. @@ -84,34 +82,13 @@ Renderer reads (Electron IPC or Vite `import.meta.env`): | Var | Required | Notes | |---|---|---| -| `VITE_RELAY_URL` | no (seed-provided) | Relay both ATM and LNbits subscribe to. **Comes from the pairing seed** (aiolabs/bitspire#70); set this only as an override — it WINS over the seed via env-first precedence. Dev override: `ws://localhost:5001/nostrrelay/test` (LNbits's bundled `nostrrelay` extension — no separate strfry container) | -| `VITE_LNBITS_SERVER_PUBKEY` | no (seed-provided) | 64-char hex transport pubkey. **Comes from the seed's `lnbits_npub`** (#70); env override only. LNbits prints it on startup (`docker logs lnbits \| grep 'Public key (share this)'`) | -| `VITE_SPIRE_SEED` | yes (prod) | Spire pairing seed (`spire-seed:v1:`) from spirekeeper. Carries the relay(s), the LNbits transport pubkey (`lnbits_npub`), the spire signing pubkey (`spire_npub`), and a one-shot NIP-46 connect token (#70 slimmed the shape). First boot redeems it and persists the binding to `state.db`; later boots resume by fingerprint. A changed seed re-pairs. Provisioning it up front is optional — an unpaired machine renders an on-screen QR-pairing wizard that scans the seed off the camera (see below). See aiolabs/bitspire#52. | -| `VITE_ATM_PRIVATE_KEY` | dev only | 64-char hex raw nsec fallback for running without a bunker. Ignored when `VITE_SPIRE_SEED` or a stored binding exists. | +| `VITE_RELAY_URL` | yes | `ws://...` of the relay both ATM and LNbits subscribe to. Dev: `ws://localhost:5001/nostrrelay/test` (LNbits's bundled `nostrrelay` extension — no separate strfry container) | +| `VITE_LNBITS_SERVER_PUBKEY` | yes | 64-char hex pubkey LNbits prints on startup (`docker logs lnbits \| grep 'Public key (share this)'`) | +| `VITE_ATM_PRIVATE_KEY` | yes (prod) | 64-char hex. The ATM's nostr identity. Generates ephemeral on first boot if unset (dev only) | | `VITE_OPERATOR_PUBKEYS` | optional | Comma-separated hex pubkeys allowed to send kind-21003 management commands | The LP-era vars (`VITE_LIGHTNING_PUB_PUBKEY`, `VITE_LIGHTNING_PUB_API_URL`, `VITE_EXTENSION_API_URL`, `VITE_ADMIN_TOKEN`) are gone from the dev branch's `.env.example` and `LightningConfig` interface. -## Pairing (on-machine QR wizard) - -A machine with no seed **and** no stored binding boots `unpaired` and, under -Electron, renders an interactive wizard (`src/components/PairingWizard.vue`) -instead of a dead-end fault screen. The operator displays the `spire-seed` -QR (minted by spirekeeper's `/pair`) to the machine's camera; the wizard: - -1. captures + decodes via a `PairingSource` (`src/services/pairing/`) — camera - today (decode through `qr`, paulmillr's zero-dep lib), NFC scaffolded; -2. validates the scan parses as a spire-seed (`ingestScannedSeed`), rejecting - a stray QR; -3. persists it as `VITE_SPIRE_SEED` via the `state:save-spire-seed` IPC and - relaunches (`app:relaunch`). - -Pairing itself is **not** done in the wizard — relaunch lets the normal boot -path (`signer-resolver` → `connectNewSeed`) redeem the one-shot token, so -there's one tested pairing path. A revoked/expired binding lands on the same -wizard (re-pair = scan a fresh seed). Provisioning `VITE_SPIRE_SEED` up front -still works and skips the wizard. - ## Commands ```bash @@ -211,7 +188,7 @@ UP Board enumerates its eMMC controller via ACPI, not PCI. `upboard.nix` force-l ## Security priorities -1. **Private keys** — Never log nsec. In production the ATM holds no signing nsec: `VITE_SPIRE_SEED` (in `/var/lib/bitspire/.env`, mode 0600) carries a one-shot connect token, and the ATM's own NIP-46 *transport* key (`client_secret_hex`) lives in `state.db` (`bunker_binding`). The operator's signing key stays in the bunker. The legacy `VITE_ATM_PRIVATE_KEY` is a dev-only fallback. +1. **Private keys** — Never log nsec. The ATM's `VITE_ATM_PRIVATE_KEY` lives in `/var/lib/bitspire/.env` with mode 0600, owned by `bitspire:bitspire`. 2. **Payments** — Validate the bolt11 amount on cash-out before exposing the QR. Decode `payment_hash` from the bolt11 (cheap, avoids a roundtrip) and use it as the `subscribe_payments` filter. 3. **Replay** — LNURL-withdraw links use `uses:1` and are deleted on session abort. 4. **Encryption** — All RPC content is NIP-44 v2. NIP-04 is forbidden. diff --git a/apps/machine/.env.example b/apps/machine/.env.example index ec66f81..73b6281 100644 --- a/apps/machine/.env.example +++ b/apps/machine/.env.example @@ -19,15 +19,11 @@ VITE_LAMASSU_FIAT_CODE=USD # VITE_LAMASSU_CASSETTES='[{"denomination":20,"count":100}]' # ============================================================================= -# LNbits Connection (dev override — normally seed-provided) — nostr-native-transport +# LNbits Connection (Required) — nostr-native-transport # ============================================================================= -# On a real machine the pairing SEED (VITE_SPIRE_SEED) carries the relay AND the -# server pubkey (aiolabs/bitspire#70), so leave both blank there. Set them here -# only for browser dev without a seed/bunker — they WIN over the seed. -# Nostr relay WebSocket URL. Dev stack uses LNbits's bundled nostrrelay: -# VITE_RELAY_URL=ws://localhost:5001/nostrrelay/test -VITE_RELAY_URL= +# Nostr relay WebSocket URL — relay LNbits is subscribed to. +VITE_RELAY_URL=ws://localhost:7777 # LNbits nostr-transport server pubkey (hex, 64 chars). # Printed by the LNbits server on startup: @@ -40,23 +36,16 @@ VITE_LNBITS_SERVER_PUBKEY= # aiolabs/withdraw#1 / commit e9d911e.) # ============================================================================= -# ATM Identity — spire pairing seed (NIP-46 bunker; aiolabs/bitspire#52) +# ATM Identity # ============================================================================= -# The spire pairing seed produced by the operator dashboard (spirekeeper): -# spire-seed:v1: -# It carries a one-shot NIP-46 connect token + the spire's signing pubkey + -# the bunker URL. On first boot the ATM redeems the token, generates its own -# transport key, and persists the binding to state.db; thereafter it resumes -# from the binding (the seed can stay set — it's matched by fingerprint). -# A changed seed re-pairs (and re-publishes the cassette-state hello). -VITE_SPIRE_SEED= - # pragma: allowlist secret -# DEV ONLY fallback — a raw Nostr private key (hex, 64 chars) for running -# without a bunker. Ignored when VITE_SPIRE_SEED or a stored binding exists. +# ATM's Nostr private key (hex format, 64 characters). This signing +# key IS the credential — LNbits derives the account from it on first +# contact (issue aiolabs/lnbits#9 alignment). # Generate with: openssl rand -hex 32 -# VITE_ATM_PRIVATE_KEY= +# If not set, generates ephemeral identity on each restart (dev only). +VITE_ATM_PRIVATE_KEY= # ============================================================================= # Operator Identity @@ -73,18 +62,6 @@ VITE_SPIRE_SEED= # Show "Under Service" screen and block all transactions # VITE_MAINTENANCE_MODE=true -# ============================================================================= -# Public Web Demo -# ============================================================================= - -# Set ONLY for the browser demo build (atm.demo.aiolabs.dev). Leave blank on -# every real machine. When set it: -# - keeps the mouse cursor visible (kiosk builds hide it) -# - mints one extra, never-used LNbits wallet named with this exact string, -# so the throwaway accounts the demo creates (one per page load, each with -# its own ephemeral identity) can be swept by name instead of guessed at. -# VITE_DEMO_TAG=bitspire-web-demo - # ============================================================================= # Mock Fallback (Production Safety) # ============================================================================= diff --git a/apps/machine/electron/__tests__/state-store-bunker.test.ts b/apps/machine/electron/__tests__/state-store-bunker.test.ts deleted file mode 100644 index a668059..0000000 --- a/apps/machine/electron/__tests__/state-store-bunker.test.ts +++ /dev/null @@ -1,69 +0,0 @@ -/** - * Tests for bunker-binding persistence in state-store (aiolabs/bitspire#52, - * transport config added in #70). - * - * Validates the round-trip of the binding singleton, including the v11→v12 - * transport columns (relays JSON + lnbits_server_pubkey) and their absence on - * a pre-#70 binding. - * - * Uses an in-memory SQLite database — fresh per test, no on-disk artifacts. - */ - -import { afterEach, beforeEach, describe, expect, it } from 'vitest' -import { - clearBunkerBinding, - closeDatabase, - getBunkerBinding, - initDatabase, - saveBunkerBinding, - type StoredBunkerBinding, -} from '../state-store.js' - -const BASE: StoredBunkerBinding = { - clientSecretHex: 'aa'.repeat(32), - spirePubkey: 'bb'.repeat(32), - bunkerUrl: 'bunker://bb?relay=wss%3A%2F%2Fr%2F&secret=deadbeef', - seedFingerprint: 'cc'.repeat(32), - pairedAt: 1_780_000_000, -} - -beforeEach(() => { - initDatabase(':memory:') -}) -afterEach(() => { - closeDatabase() -}) - -describe('bunker binding persistence', () => { - it('round-trips a binding carrying transport config (#70)', () => { - const binding: StoredBunkerBinding = { - ...BASE, - relays: ['wss://one.relay/', 'wss://two.relay/'], - lnbitsServerPubkey: 'dd'.repeat(32), - } - saveBunkerBinding(binding) - expect(getBunkerBinding()).toEqual(binding) - }) - - it('round-trips a pre-#70 binding (no transport config) as undefined fields', () => { - saveBunkerBinding(BASE) - const got = getBunkerBinding() - expect(got).toEqual(BASE) - expect(got?.relays).toBeUndefined() - expect(got?.lnbitsServerPubkey).toBeUndefined() - }) - - it('upserts transport config in place (re-pair overwrites)', () => { - saveBunkerBinding({ ...BASE, relays: ['wss://old/'], lnbitsServerPubkey: 'ee'.repeat(32) }) - saveBunkerBinding({ ...BASE, relays: ['wss://new/'], lnbitsServerPubkey: 'ff'.repeat(32) }) - const got = getBunkerBinding() - expect(got?.relays).toEqual(['wss://new/']) - expect(got?.lnbitsServerPubkey).toBe('ff'.repeat(32)) - }) - - it('returns null after clear', () => { - saveBunkerBinding(BASE) - clearBunkerBinding() - expect(getBunkerBinding()).toBeNull() - }) -}) diff --git a/apps/machine/electron/__tests__/state-store-transactions.test.ts b/apps/machine/electron/__tests__/state-store-transactions.test.ts deleted file mode 100644 index fbb9a87..0000000 --- a/apps/machine/electron/__tests__/state-store-transactions.test.ts +++ /dev/null @@ -1,170 +0,0 @@ -/** - * Tests for recordTransaction inventory accounting. - * - * Regression coverage for the position-vs-denomination decrement bug: - * position is the cassettes PK (v9) and duplicate denominations across - * bays are legal, so cash-out decrements MUST address bays by position. - * A denomination-keyed UPDATE would drain every matching bay at once. - * - * Uses an in-memory SQLite database — fresh per test, no on-disk - * artifacts, no parallel-test interference. - */ - -import { afterEach, beforeEach, describe, expect, it } from 'vitest' -import { - closeDatabase, - getCashbox, - initDatabase, - loadCassettes, - recordTransaction, - setCassettes, -} from '../state-store.js' - -const TX_BASE = { - fiatCents: 4000, - sats: 100_000, - feeSats: 5_000, - feeFraction: 0.05, - exchangeRate: 2500, - currency: 'USD', -} - -/** Two $20 bays plus one $50 bay — the duplicate-denomination layout. */ -function seedDuplicateDenomBays() { - setCassettes([ - { position: 1, denomination: 20, count: 50 }, - { position: 2, denomination: 20, count: 50 }, - { position: 3, denomination: 50, count: 30 }, - ]) -} - -function countsByPosition(): Record { - const out: Record = {} - for (const row of loadCassettes()) out[row.position] = row.count - return out -} - -beforeEach(() => { - initDatabase(':memory:') - seedDuplicateDenomBays() -}) -afterEach(() => { - closeDatabase() -}) - -describe('state-store: recordTransaction cash_out inventory', () => { - it('decrements only the bay that actually dispensed (duplicate denominations)', () => { - recordTransaction({ - ...TX_BASE, - txid: 'tx-single-bay', - type: 'cash_out', - status: 'complete', - bills: [{ denomination: 20, count: 3 }], - cassettes: [ - { - name: 'cassette1', - position: 1, - denomination: 20, - provisioned: 3, - dispensed: 3, - rejected: 0, - }, - { - name: 'cassette2', - position: 2, - denomination: 20, - provisioned: 0, - dispensed: 0, - rejected: 0, - }, - ], - }) - - expect(countsByPosition()).toEqual({ 1: 47, 2: 50, 3: 30 }) - }) - - it('decrements each bay by its own dispensed count on a split dispense', () => { - recordTransaction({ - ...TX_BASE, - txid: 'tx-split-bays', - type: 'cash_out', - status: 'complete', - bills: [{ denomination: 20, count: 60 }], - cassettes: [ - { - name: 'cassette1', - position: 1, - denomination: 20, - provisioned: 50, - dispensed: 50, - rejected: 0, - }, - { - name: 'cassette2', - position: 2, - denomination: 20, - provisioned: 10, - dispensed: 10, - rejected: 0, - }, - ], - }) - - expect(countsByPosition()).toEqual({ 1: 0, 2: 40, 3: 30 }) - }) - - it('fallback without cassette results drains matching bays greedily by position', () => { - recordTransaction({ - ...TX_BASE, - txid: 'tx-fallback', - type: 'cash_out', - status: 'complete', - bills: [{ denomination: 20, count: 60 }], - }) - - // Bay 1 (50 bills) drains fully, bay 2 covers the remaining 10. - expect(countsByPosition()).toEqual({ 1: 0, 2: 40, 3: 30 }) - }) - - it('never drives a bay count below zero', () => { - recordTransaction({ - ...TX_BASE, - txid: 'tx-overdispense', - type: 'cash_out', - status: 'complete', - bills: [{ denomination: 50, count: 35 }], - cassettes: [ - { - name: 'cassette3', - position: 3, - denomination: 50, - provisioned: 35, - dispensed: 35, - rejected: 0, - }, - ], - }) - - expect(countsByPosition()).toEqual({ 1: 50, 2: 50, 3: 0 }) - }) -}) - -describe('state-store: recordTransaction cash_in cashbox', () => { - it('adds inserted bills to the cashbox and leaves cassettes untouched', () => { - recordTransaction({ - ...TX_BASE, - txid: 'tx-cash-in', - type: 'cash_in', - status: 'complete', - bills: [ - { denomination: 20, count: 2 }, - { denomination: 50, count: 1 }, - ], - }) - - const cashbox = getCashbox() - expect(cashbox.totalBills).toBe(3) - expect(cashbox.totalFiatCents).toBe(TX_BASE.fiatCents) - expect(countsByPosition()).toEqual({ 1: 50, 2: 50, 3: 30 }) - }) -}) diff --git a/apps/machine/electron/fund-atm.ts b/apps/machine/electron/fund-atm.ts index cd0f901..ce8b1e0 100644 --- a/apps/machine/electron/fund-atm.ts +++ b/apps/machine/electron/fund-atm.ts @@ -13,15 +13,8 @@ */ import { readFileSync } from 'node:fs' -import { - NostrClient, - LocalSigner, - loadIdentityFromHex, - resumeFromBinding, - type Signer, -} from '@bitSpire/nostr-client' +import { NostrClient, loadIdentityFromHex } from '@bitSpire/nostr-client' import { LnbitsClient } from '@bitSpire/lnbits' -import { initDatabase, getBunkerBinding } from './state-store.js' // @ts-ignore — qrcode is a transitive dep (via qrcode.vue), no types needed import QRCode from 'qrcode' @@ -63,38 +56,19 @@ async function main() { const lnbitsServerPubkey = env['VITE_LNBITS_SERVER_PUBKEY'] const atmPrivateKey = env['VITE_ATM_PRIVATE_KEY'] - if (!relayUrl || !lnbitsServerPubkey) { + if (!relayUrl || !lnbitsServerPubkey || !atmPrivateKey) { console.error('Missing required config in', envPath) - console.error('Need: VITE_RELAY_URL, VITE_LNBITS_SERVER_PUBKEY') + console.error('Need: VITE_RELAY_URL, VITE_LNBITS_SERVER_PUBKEY, VITE_ATM_PRIVATE_KEY') process.exit(1) } console.error(`Generating invoice for ${amountSats} sats...`) - // Resolve the signer. Prod: resume the bunker binding from state.db (the - // ATM's transport key — the connect token was already redeemed by the main - // app, so we can't re-pair here). Dev: a local nsec via VITE_ATM_PRIVATE_KEY. - let signer: Signer - if (atmPrivateKey) { - signer = new LocalSigner(loadIdentityFromHex(atmPrivateKey)) - } else { - initDatabase() - const binding = getBunkerBinding() - if (!binding) { - console.error('ATM is not paired (no bunker binding in state.db) and no') - console.error('VITE_ATM_PRIVATE_KEY set. Pair the ATM via the main app first.') - process.exit(1) - } - signer = await resumeFromBinding({ - clientSecretHex: binding.clientSecretHex, - spirePubkey: binding.spirePubkey, - bunkerUrl: binding.bunkerUrl, - }) - } + const identity = loadIdentityFromHex(atmPrivateKey) const nostrClient = new NostrClient({ relays: [{ url: relayUrl }], - signer, + identity, }) await nostrClient.connect() @@ -102,7 +76,7 @@ async function main() { serverPubkey: lnbitsServerPubkey, relays: [relayUrl], }) - lnbits.initialize(nostrClient, signer) + lnbits.initialize(nostrClient, identity) const wallets = await lnbits.listWallets() const wallet = wallets[0] diff --git a/apps/machine/electron/hal-service.ts b/apps/machine/electron/hal-service.ts index 2ec863b..27508b0 100644 --- a/apps/machine/electron/hal-service.ts +++ b/apps/machine/electron/hal-service.ts @@ -36,11 +36,6 @@ export interface HalConfig { export interface ValidatorCallbacks { shouldAcceptBill: (denomination: number) => boolean | 'hold' onBillRead?: (denomination: number) => void - /** - * Fires on the validator's stacked-confirmation (`billsValid`) — the - * bill physically reached the stacker. This is the CREDIT event; it is - * NOT emitted at stack-command time (a stack can still fail/return). - */ onBillInserted: (denomination: number) => void onBillRejected: (reason: string) => void onError: (error: string) => void @@ -147,14 +142,6 @@ export async function initializeHal(config: HalConfig): Promise { count: c.count ?? 0, })) - // Escrow / in-flight bookkeeping (legacy brain.js `billsRead` interlock): - // `escrowDenomination` = bill held in escrow awaiting a stack/reject - // decision; `inFlightDenomination` = stack commanded, awaiting the - // validator's `billsValid` stacked-confirmation. onBillInserted (the - // credit event) fires only on that confirmation. - let escrowDenomination: number | null = null - let inFlightDenomination: number | null = null - return { connectValidator: (callbacks: ValidatorCallbacks) => { if (!validator) { @@ -166,11 +153,10 @@ export async function initializeHal(config: HalConfig): Promise { const decision = callbacks.shouldAcceptBill(data.denomination) if (decision === 'hold') { console.log('[HAL] Bill in escrow:', data.denomination) - escrowDenomination = data.denomination callbacks.onBillRead?.(data.denomination) } else if (decision) { - inFlightDenomination = data.denomination validator.stack() + callbacks.onBillInserted(data.denomination) } else { console.log('[HAL] Bill rejected: insufficient balance for', data.denomination) validator.reject() @@ -182,23 +168,7 @@ export async function initializeHal(config: HalConfig): Promise { } }) - // Stacked-confirmation → the credit event. - validator.on('billsValid', () => { - if (inFlightDenomination === null) { - console.warn('[HAL] billsValid with no bill in flight — ignoring') - return - } - const denomination = inFlightDenomination - inFlightDenomination = null - console.log('[HAL] Bill stacked (confirmed):', denomination) - callbacks.onBillInserted(denomination) - }) - validator.on('billsRejected', (data?: { reason: string; code: number | null }) => { - // Covers both an escrow refusal and a failed/returned stack — - // either way nothing was credited and nothing is in flight. - escrowDenomination = null - inFlightDenomination = null callbacks.onBillRejected(data?.reason ?? 'unknown') }) @@ -221,32 +191,12 @@ export async function initializeHal(config: HalConfig): Promise { }, disableValidator: () => { - // If a note is sitting in escrow when we disable (inactivity timeout, - // cancel, or leaving the insert screen), return it to the customer. - // Disabling alone does NOT release an escrowed note on EBDS — it would - // be stranded in the transport until the next power cycle. - if (escrowDenomination !== null) { - console.log('[HAL] Returning escrowed bill on disable:', escrowDenomination) - escrowDenomination = null - validator?.reject() - } validator?.disable() validator?.lightOff() }, - stackBill: () => { - if (escrowDenomination === null) { - console.warn('[HAL] stackBill with no bill in escrow — ignoring') - return - } - inFlightDenomination = escrowDenomination - escrowDenomination = null - validator?.stack() - }, - rejectBill: () => { - escrowDenomination = null - validator?.reject() - }, + stackBill: () => validator?.stack(), + rejectBill: () => validator?.reject(), dispenseCash: async (amounts): Promise => { console.log('[HAL] Dispensing:', amounts) diff --git a/apps/machine/electron/lnurl-pay.test.ts b/apps/machine/electron/lnurl-pay.test.ts deleted file mode 100644 index 165688f..0000000 --- a/apps/machine/electron/lnurl-pay.test.ts +++ /dev/null @@ -1,120 +0,0 @@ -import { describe, it, expect, vi } from 'vitest' -import { resolveCardInvoice, scanUrlToResolver, lnAddressToLnurlp } from './lnurl-pay' - -const LNURLW = - 'lnurlw://lnbits.l484.com/boltcards/api/v1/scan/abc123?p=DEADBEEFDEADBEEFDEADBEEFDEADBEEF&c=1122334455667788' -const BOLT11 = 'lnbc10u1p3xyz...' - -/** Mock fetch that returns the given JSON bodies per call, in order. */ -function mockFetch(bodies: unknown[]) { - const calls: string[] = [] - const impl = vi.fn(async (url: string | URL) => { - calls.push(url.toString()) - const body = bodies[calls.length - 1] - return { json: async () => body } as Response - }) - return { impl: impl as unknown as typeof fetch, calls } -} - -describe('scanUrlToResolver', () => { - it('rewrites /scan/ to /pay/ and preserves p + c', () => { - const r = scanUrlToResolver(LNURLW) - expect(r).toContain('https://lnbits.l484.com/boltcards/api/v1/pay/abc123') - expect(r).toContain('p=DEADBEEFDEADBEEFDEADBEEFDEADBEEF') - expect(r).toContain('c=1122334455667788') - }) - it('returns null for a non-scan URL', () => { - expect(scanUrlToResolver('lnurlw://host/somethingelse?p=1&c=2')).toBeNull() - expect(scanUrlToResolver('http://host/boltcards/api/v1/scan/x')).toBeNull() - }) -}) - -describe('lnAddressToLnurlp', () => { - it('maps name@host to the well-known lnurlp URL', () => { - expect(lnAddressToLnurlp('cardname@l484.com')).toBe( - 'https://l484.com/.well-known/lnurlp/cardname' - ) - }) - it('rejects non-addresses', () => { - expect(lnAddressToLnurlp('not-an-address')).toBeNull() - expect(lnAddressToLnurlp('')).toBeNull() - }) -}) - -describe('resolveCardInvoice', () => { - const payReq = { - tag: 'payRequest', - callback: 'https://lnbits.l484.com/lnurlp/api/v1/lnurl/cb', - minSendable: 1000, - maxSendable: 100_000_000, - metadata: '[["text/plain","bolt card top-up"]]', - } - - it('resolver returns a payRequest inline → fetches the invoice', async () => { - const { impl, calls } = mockFetch([payReq, { pr: BOLT11 }]) - const res = await resolveCardInvoice(LNURLW, 21_000, { fetchImpl: impl }) - expect(res).toEqual({ ok: true, bolt11: BOLT11 }) - // 1st call = the /pay resolver; 2nd = the callback with amount in msat. - expect(calls[0]).toContain('/boltcards/api/v1/pay/abc123') - expect(calls[1]).toContain('amount=21000') - }) - - it('resolver returns a Lightning Address → LUD-16 → invoice', async () => { - const { impl, calls } = mockFetch([ - { lightningAddress: 'cardname@l484.com' }, - payReq, - { pr: BOLT11 }, - ]) - const res = await resolveCardInvoice(LNURLW, 21_000, { fetchImpl: impl }) - expect(res).toEqual({ ok: true, bolt11: BOLT11 }) - expect(calls[1]).toBe('https://l484.com/.well-known/lnurlp/cardname') - expect(calls[2]).toContain('amount=21000') - }) - - it('rejects a non-lnurlw tag', async () => { - const { impl } = mockFetch([]) - const res = await resolveCardInvoice('http://nope', 21_000, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false }) - expect(res.reason).toMatch(/not a valid Bolt Card/i) - }) - - it('rejects a zero amount', async () => { - const { impl } = mockFetch([]) - const res = await resolveCardInvoice(LNURLW, 0, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'no amount to send' }) - }) - - it('surfaces an ERROR from the resolver (bad SUN)', async () => { - const { impl } = mockFetch([{ status: 'ERROR', reason: 'invalid card' }]) - const res = await resolveCardInvoice(LNURLW, 21_000, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'invalid card' }) - }) - - it('rejects (without calling the callback) when the amount exceeds maxSendable', async () => { - const { impl, calls } = mockFetch([{ ...payReq, maxSendable: 5000 }]) - const res = await resolveCardInvoice(LNURLW, 21_000, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'amount is above the card wallet maximum' }) - expect(calls).toHaveLength(1) // callback never hit - }) - - it('surfaces an ERROR from the pay callback', async () => { - const { impl } = mockFetch([payReq, { status: 'ERROR', reason: 'wallet frozen' }]) - const res = await resolveCardInvoice(LNURLW, 21_000, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'wallet frozen' }) - }) - - it('rejects when the card wallet has no receive address', async () => { - const { impl } = mockFetch([{ foo: 'bar' }]) - const res = await resolveCardInvoice(LNURLW, 21_000, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'card wallet has no receive address' }) - }) - - it('handles a network failure gracefully', async () => { - const impl = vi.fn(async () => { - throw new Error('ECONNREFUSED') - }) as unknown as typeof fetch - const res = await resolveCardInvoice(LNURLW, 21_000, { fetchImpl: impl }) - expect(res.ok).toBe(false) - expect(res.reason).toMatch(/could not reach the card/i) - }) -}) diff --git a/apps/machine/electron/lnurl-pay.ts b/apps/machine/electron/lnurl-pay.ts deleted file mode 100644 index 91da90c..0000000 --- a/apps/machine/electron/lnurl-pay.ts +++ /dev/null @@ -1,226 +0,0 @@ -/** - * LNURL-pay resolver (LUD-06 / LUD-16) — the ATM as the *paying* party. - * - * Bolt Card tap-to-RECEIVE for the cash-in (buy) flow. A Bolt Card only ever - * emits its `lnurlw://…?p=…&c=…` voucher — a *withdraw* (spend) credential — so - * we can't push sats into it directly. Instead the tap is used as an - * authenticated identity (external_id + SUN p/c) to look up the card wallet's - * *pay* target, then the ATM fetches an invoice for the payout amount: - * 1. resolveCardPayTarget — GET the boltcards `/pay/?p=&c=` resolver - * (a sibling of `/scan`); it verifies the same SUN and returns the card - * wallet's Lightning Address / lnurlp (or a LUD-06 payRequest directly). - * 2. toPayRequest → LUD-16 (Lightning Address) or LUD-06 fetch → payRequest. - * 3. requestInvoice — GET `callback?amount=` → a BOLT11 for the amount. - * The returned BOLT11 is handed back to the renderer, which pays it over the - * ATM's existing LNbits/nostr transport (stores/atm.ts `payInvoice`), so - * settlement + PAYMENT_RECEIVED reuse the tested cash-in completion path. - * - * Runs in the MAIN process (Node fetch) to avoid renderer CORS, exactly like - * lnurl-withdraw.ts. - * - * Transport seam: `resolveCardPayTarget()` is the single HTTPS-today / - * Nostr-tomorrow swap point. The rest is standard LNURL-pay against whatever - * pay target it returns and is transport-independent. - */ - -import { lnurlwToHttps } from './lnurl-withdraw.js' - -export interface ResolveCardInvoiceResult { - ok: boolean - /** BOLT11 to pay when ok; the renderer settles it over the nostr transport. */ - bolt11?: string - /** Human-readable reason when ok is false (safe to surface on-screen). */ - reason?: string -} - -type FetchLike = typeof fetch - -export interface ResolveCardInvoiceOptions { - /** Injected for tests; defaults to global fetch. */ - fetchImpl?: FetchLike - /** Per-request timeout (default 15s). */ - timeoutMs?: number -} - -/** Resolver response — any of these shapes is accepted (see the spec doc). */ -interface CardPayTarget { - status?: string - reason?: string - // (a) a LUD-06 payRequest, inline - tag?: string - callback?: string - minSendable?: number - maxSendable?: number - metadata?: string - // (b) a Lightning Address, e.g. "cardname@l484.com" - lightningAddress?: string - // (c) an lnurlp pointer (https or lnurl://) - lnurlp?: string - lnurl?: string -} - -/** LUD-06 payRequest (subset) + error shape. */ -interface PayRequest { - tag?: string - callback?: string - minSendable?: number - maxSendable?: number - metadata?: string - status?: string - reason?: string -} - -/** LUD-06 second-response (the callback body). */ -interface PayValues { - pr?: string - status?: string - reason?: string -} - -interface Ctx { - doFetch: FetchLike - timeoutMs: number -} - -function errMsg(e: unknown): string { - if (e instanceof Error) - return e.name === 'TimeoutError' || e.name === 'AbortError' ? 'timed out' : e.message - return String(e) -} - -function appendQuery(url: string, params: Record): string { - const u = new URL(url) - for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v) - return u.toString() -} - -/** - * Derive the boltcards *pay* resolver URL from a tapped card's `lnurlw`. - * The card presents `…/boltcards/api/v1/scan/?p=&c=` (a withdraw voucher); - * the receive resolver is its sibling `…/boltcards/api/v1/pay/?p=&c=`, - * carrying the same SUN p/c. This is the HTTPS transport seam — a future - * nostr-native card would resolve the same identity over nostr instead. - */ -export function scanUrlToResolver(lnurlw: string): string | null { - const https = lnurlwToHttps(lnurlw) - if (!https) return null - const u = new URL(https) - if (!u.pathname.includes('/scan/')) return null - u.pathname = u.pathname.replace('/scan/', '/pay/') - return u.toString() -} - -/** LUD-16: map a Lightning Address `name@host` to its lnurlp URL. */ -export function lnAddressToLnurlp(addr: string): string | null { - const m = addr.trim().match(/^([a-z0-9._%+-]+)@([a-z0-9.-]+)$/i) - if (!m) return null - return `https://${m[2]}/.well-known/lnurlp/${m[1]}` -} - -async function fetchPayRequest( - url: string, - ctx: Ctx -): Promise<{ ok: true; payRequest: PayRequest } | { ok: false; reason: string }> { - let body: PayRequest - try { - const res = await ctx.doFetch(url, { signal: AbortSignal.timeout(ctx.timeoutMs) }) - body = (await res.json()) as PayRequest - } catch (e) { - return { ok: false, reason: `could not reach the card wallet: ${errMsg(e)}` } - } - if (body.status === 'ERROR') { - return { ok: false, reason: body.reason || 'card wallet rejected the request' } - } - if (body.tag !== 'payRequest' || !body.callback) { - return { ok: false, reason: 'card wallet did not return a pay request' } - } - return { ok: true, payRequest: body } -} - -/** Turn a resolver response into a LUD-06 payRequest (fetching if needed). */ -async function toPayRequest( - target: CardPayTarget, - ctx: Ctx -): Promise<{ ok: true; payRequest: PayRequest } | { ok: false; reason: string }> { - // (a) resolver returned a LUD-06 payRequest inline. - if (target.tag === 'payRequest' && target.callback) { - return { ok: true, payRequest: target } - } - // (b) resolver returned a Lightning Address (the common case here). - if (typeof target.lightningAddress === 'string') { - const url = lnAddressToLnurlp(target.lightningAddress) - if (!url) return { ok: false, reason: 'card wallet address is invalid' } - return fetchPayRequest(url, ctx) - } - // (c) resolver returned an lnurlp pointer. - const pointer = target.lnurlp ?? target.lnurl - if (typeof pointer === 'string') { - const url = lnurlwToHttps(pointer) - if (!url) return { ok: false, reason: 'card wallet lnurlp is invalid' } - return fetchPayRequest(url, ctx) - } - return { ok: false, reason: 'card wallet has no receive address' } -} - -async function requestInvoice( - pr: PayRequest, - amountMsat: number, - ctx: Ctx -): Promise { - if (typeof pr.minSendable === 'number' && amountMsat < pr.minSendable) { - return { ok: false, reason: 'amount is below the card wallet minimum' } - } - if (typeof pr.maxSendable === 'number' && amountMsat > pr.maxSendable) { - return { ok: false, reason: 'amount is above the card wallet maximum' } - } - const cbUrl = appendQuery(pr.callback!, { amount: String(amountMsat) }) - let vals: PayValues - try { - const res = await ctx.doFetch(cbUrl, { signal: AbortSignal.timeout(ctx.timeoutMs) }) - vals = (await res.json()) as PayValues - } catch (e) { - return { ok: false, reason: `could not fetch the invoice: ${errMsg(e)}` } - } - if (vals.status === 'ERROR') { - return { ok: false, reason: vals.reason || 'card wallet declined' } - } - if (!vals.pr || !/^ln[a-z0-9]/i.test(vals.pr.trim())) { - return { ok: false, reason: 'card wallet returned no invoice' } - } - return { ok: true, bolt11: vals.pr.trim() } -} - -/** - * Resolve a tapped Bolt Card + a payout amount to a BOLT11 the ATM can pay. - * Never throws — every failure returns `{ ok: false, reason }`. - */ -export async function resolveCardInvoice( - lnurlw: string, - amountMsat: number, - opts: ResolveCardInvoiceOptions = {} -): Promise { - const ctx: Ctx = { doFetch: opts.fetchImpl ?? fetch, timeoutMs: opts.timeoutMs ?? 15_000 } - - const resolverUrl = scanUrlToResolver(lnurlw) - if (!resolverUrl) return { ok: false, reason: 'not a valid Bolt Card (lnurlw) tag' } - if (!(amountMsat > 0)) return { ok: false, reason: 'no amount to send' } - - // 1) Resolve card → pay target (the transport seam: HTTPS today). - let target: CardPayTarget - try { - const res = await ctx.doFetch(resolverUrl, { signal: AbortSignal.timeout(ctx.timeoutMs) }) - target = (await res.json()) as CardPayTarget - } catch (e) { - return { ok: false, reason: `could not reach the card: ${errMsg(e)}` } - } - if (target.status === 'ERROR') { - return { ok: false, reason: target.reason || 'card rejected the tap' } - } - - // 2) Normalize to a LUD-06 payRequest. - const pr = await toPayRequest(target, ctx) - if (!pr.ok) return pr - - // 3) Ask for an invoice for the payout amount. - return requestInvoice(pr.payRequest, amountMsat, ctx) -} diff --git a/apps/machine/electron/lnurl-withdraw.test.ts b/apps/machine/electron/lnurl-withdraw.test.ts deleted file mode 100644 index 4d14611..0000000 --- a/apps/machine/electron/lnurl-withdraw.test.ts +++ /dev/null @@ -1,103 +0,0 @@ -import { describe, it, expect, vi } from 'vitest' -import { executeLnurlWithdraw, lnurlwToHttps } from './lnurl-withdraw' - -const BOLT11 = 'lnbc10u1p3xyz...' -const LNURLW = - 'lnurlw://lnbits.l484.com/boltcards/api/v1/scan/abc123?p=DEADBEEFDEADBEEFDEADBEEFDEADBEEF&c=1122334455667788' - -/** Build a mock fetch that returns the given JSON bodies per call, in order. */ -function mockFetch(bodies: unknown[]) { - const calls: string[] = [] - const impl = vi.fn(async (url: string | URL) => { - calls.push(url.toString()) - const body = bodies[calls.length - 1] - return { json: async () => body } as Response - }) - return { impl: impl as unknown as typeof fetch, calls } -} - -describe('lnurlwToHttps', () => { - it('maps lnurlw:// and lnurl:// to https://', () => { - expect(lnurlwToHttps('lnurlw://host/p?x=1')).toBe('https://host/p?x=1') - expect(lnurlwToHttps('lnurl://host/p')).toBe('https://host/p') - }) - it('strips a lightning: prefix', () => { - expect(lnurlwToHttps('lightning:lnurlw://host/p')).toBe('https://host/p') - }) - it('passes https:// through and trims', () => { - expect(lnurlwToHttps(' https://host/p ')).toBe('https://host/p') - }) - it('rejects http://, bech32 lnurl1…, and empty', () => { - expect(lnurlwToHttps('http://host/p')).toBeNull() - expect(lnurlwToHttps('LNURL1DP68GURN8GHJ7')).toBeNull() - expect(lnurlwToHttps('')).toBeNull() - }) -}) - -describe('executeLnurlWithdraw', () => { - const withdrawReq = { - tag: 'withdrawRequest', - callback: 'https://lnbits.l484.com/boltcards/api/v1/scan/cb', - k1: 'K1TOKEN', - minWithdrawable: 1000, - maxWithdrawable: 5_000_000, - } - - it('completes the two-step withdraw and passes k1 + pr to the callback', async () => { - const { impl, calls } = mockFetch([withdrawReq, { status: 'OK' }]) - const res = await executeLnurlWithdraw(LNURLW, BOLT11, { fetchImpl: impl }) - expect(res).toEqual({ ok: true }) - // First call = the lnurlw as https; second = callback with k1 + pr. - expect(calls[0]).toContain('https://lnbits.l484.com/boltcards/api/v1/scan/abc123') - expect(calls[1]).toContain('k1=K1TOKEN') - expect(calls[1]).toContain(`pr=${encodeURIComponent(BOLT11)}`) - }) - - it('rejects a non-lnurlw tag', async () => { - const { impl } = mockFetch([]) - const res = await executeLnurlWithdraw('http://nope', BOLT11, { fetchImpl: impl }) - expect(res.ok).toBe(false) - expect(res.reason).toMatch(/not a valid Bolt Card/i) - }) - - it('rejects when there is no invoice', async () => { - const { impl } = mockFetch([]) - const res = await executeLnurlWithdraw(LNURLW, '', { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'no invoice to charge' }) - }) - - it('surfaces an ERROR from the withdraw request', async () => { - const { impl } = mockFetch([{ status: 'ERROR', reason: 'spent today limit' }]) - const res = await executeLnurlWithdraw(LNURLW, BOLT11, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'spent today limit' }) - }) - - it('rejects a response that is not a withdrawRequest', async () => { - const { impl } = mockFetch([{ tag: 'payRequest', callback: 'x' }]) - const res = await executeLnurlWithdraw(LNURLW, BOLT11, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false }) - expect(res.reason).toMatch(/withdraw voucher/i) - }) - - it('rejects (without calling the callback) when the amount exceeds the card limit', async () => { - const { impl, calls } = mockFetch([{ ...withdrawReq, maxWithdrawable: 2000 }]) - const res = await executeLnurlWithdraw(LNURLW, BOLT11, { fetchImpl: impl, amountMsat: 5000 }) - expect(res).toMatchObject({ ok: false, reason: 'card limit is below this amount' }) - expect(calls).toHaveLength(1) // callback never hit - }) - - it('surfaces an ERROR from the callback (card declined)', async () => { - const { impl } = mockFetch([withdrawReq, { status: 'ERROR', reason: 'insufficient funds' }]) - const res = await executeLnurlWithdraw(LNURLW, BOLT11, { fetchImpl: impl }) - expect(res).toMatchObject({ ok: false, reason: 'insufficient funds' }) - }) - - it('handles a network failure gracefully', async () => { - const impl = vi.fn(async () => { - throw new Error('ECONNREFUSED') - }) as unknown as typeof fetch - const res = await executeLnurlWithdraw(LNURLW, BOLT11, { fetchImpl: impl }) - expect(res.ok).toBe(false) - expect(res.reason).toMatch(/could not reach the card/i) - }) -}) diff --git a/apps/machine/electron/lnurl-withdraw.ts b/apps/machine/electron/lnurl-withdraw.ts deleted file mode 100644 index eb93c08..0000000 --- a/apps/machine/electron/lnurl-withdraw.ts +++ /dev/null @@ -1,127 +0,0 @@ -/** - * LNURL-withdraw executor (LUD-03) — the ATM as the *withdrawing* party. - * - * Bolt Card tap-to-pay for the cash-out flow: a Bolt Card presents an - * `lnurlw://…?p=…&c=…` voucher (NTAG424 SUN — fresh p/c per tap). The ATM has - * already generated its cash-out BOLT11; here it asks the card's wallet to pay - * that invoice: - * 1. GET the lnurlw URL → a `withdrawRequest` (callback, k1, max/min). - * 2. GET `callback?k1=…&pr=` → the card's wallet pays it. - * Settlement itself is observed elsewhere (the existing invoice watcher over - * nostr), so a returned `{ ok: true }` means "the card accepted the pull", not - * "cash dispensed" — the state machine still waits for PAYMENT_RECEIVED. - * - * Runs in the MAIN process (Node fetch) to avoid renderer CORS: LNURL - * endpoints don't send CORS headers, so a renderer fetch to the card's host - * would be blocked. - */ - -export interface LnurlWithdrawResult { - ok: boolean - /** Human-readable reason when ok is false (safe to surface on-screen). */ - reason?: string -} - -/** LUD-03 withdrawRequest (subset we consume) + LUD-06 error shape. */ -interface WithdrawRequest { - tag?: string - callback?: string - k1?: string - minWithdrawable?: number - maxWithdrawable?: number - defaultDescription?: string - status?: string - reason?: string -} - -type FetchLike = typeof fetch - -export interface ExecuteLnurlWithdrawOptions { - /** Injected for tests; defaults to global fetch. */ - fetchImpl?: FetchLike - /** - * Our invoice amount in millisats. When set, we reject early if it exceeds - * the voucher's maxWithdrawable (defensive; the callback would reject anyway). - */ - amountMsat?: number - /** Per-request timeout (default 15s). */ - timeoutMs?: number -} - -/** - * Normalize a Bolt Card / LNURL-withdraw pointer to an https URL. - * Bolt Cards emit `lnurlw://host/path?query`; we also accept `lnurl://` and a - * bare `https://`. Bech32 `LNURL1…` is intentionally unsupported (Bolt Cards - * never use it) and rejected with a clear reason. - */ -export function lnurlwToHttps(raw: string): string | null { - let s = raw.trim() - if (!s) return null - if (s.toLowerCase().startsWith('lightning:')) s = s.slice('lightning:'.length) - const lower = s.toLowerCase() - if (lower.startsWith('lnurlw://')) return 'https://' + s.slice('lnurlw://'.length) - if (lower.startsWith('lnurl://')) return 'https://' + s.slice('lnurl://'.length) - if (lower.startsWith('https://')) return s - // Reject http:// (must be TLS) and bech32 lnurl1… (not a Bolt Card). - return null -} - -function appendQuery(url: string, params: Record): string { - const u = new URL(url) - for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v) - return u.toString() -} - -function errMsg(e: unknown): string { - if (e instanceof Error) return e.name === 'TimeoutError' || e.name === 'AbortError' ? 'timed out' : e.message - return String(e) -} - -export async function executeLnurlWithdraw( - lnurlw: string, - bolt11: string, - opts: ExecuteLnurlWithdrawOptions = {} -): Promise { - const doFetch = opts.fetchImpl ?? fetch - const timeoutMs = opts.timeoutMs ?? 15_000 - - const paramsUrl = lnurlwToHttps(lnurlw) - if (!paramsUrl) return { ok: false, reason: 'not a valid Bolt Card (lnurlw) tag' } - if (!bolt11 || !/^ln[a-z0-9]/i.test(bolt11.trim())) { - return { ok: false, reason: 'no invoice to charge' } - } - - // 1) Fetch the withdraw request. - let params: WithdrawRequest - try { - const res = await doFetch(paramsUrl, { signal: AbortSignal.timeout(timeoutMs) }) - params = (await res.json()) as WithdrawRequest - } catch (e) { - return { ok: false, reason: `could not reach the card: ${errMsg(e)}` } - } - if (params.status === 'ERROR') { - return { ok: false, reason: params.reason || 'card rejected the tap' } - } - if (params.tag !== 'withdrawRequest' || !params.callback || !params.k1) { - return { ok: false, reason: 'card did not return a withdraw voucher' } - } - if ( - opts.amountMsat != null && - typeof params.maxWithdrawable === 'number' && - opts.amountMsat > params.maxWithdrawable - ) { - return { ok: false, reason: 'card limit is below this amount' } - } - - // 2) Hand our invoice to the callback — the card's wallet pays it. - const cbUrl = appendQuery(params.callback, { k1: params.k1, pr: bolt11.trim() }) - let cb: { status?: string; reason?: string } - try { - const res = await doFetch(cbUrl, { signal: AbortSignal.timeout(timeoutMs) }) - cb = (await res.json()) as { status?: string; reason?: string } - } catch (e) { - return { ok: false, reason: `card payment failed: ${errMsg(e)}` } - } - if (cb.status === 'OK') return { ok: true } - return { ok: false, reason: cb.reason || 'card declined the payment' } -} diff --git a/apps/machine/electron/main.ts b/apps/machine/electron/main.ts index 6cfcb20..59cbcd5 100644 --- a/apps/machine/electron/main.ts +++ b/apps/machine/electron/main.ts @@ -26,25 +26,16 @@ import { getLastKnownConfigCreatedAt, getBootstrapPublishedAt, markBootstrapPublished, - resetBootstrapGate, - resetForRepair, applyOperatorCassettesConfig, getFeeConfig, getLastKnownFeeConfigCreatedAt, applyFeeConfig, - getBunkerBinding, - saveBunkerBinding, - clearBunkerBinding, type OperatorCassettesPayload, type FeeConfigPayload, type FeeConfigRow, type ApplyResult, - type StoredBunkerBinding, } from './state-store.js' import { initializeHal, type HalInstance } from './hal-service.js' -import { executeLnurlWithdraw } from './lnurl-withdraw.js' -import { resolveCardInvoice } from './lnurl-pay.js' -import { startNfcReader, type NfcStatus } from './nfc-service.js' // ESM equivalent of __dirname const __filename = fileURLToPath(import.meta.url) @@ -90,6 +81,16 @@ type BrandingConfig = { logoDarkDataUrl: string | null } +const VALID_THEMES = new Set([ + 'gruvbox', + 'catppuccin', + 'cyberpunk', + 'dracula', + 'nord', + 'tokyo-night', + 'custom', +]) + function loadBranding(): BrandingConfig | null { const brandingDir = path.join( fs.existsSync('/var/lib/bitspire') ? '/var/lib/bitspire' : process.cwd(), @@ -109,10 +110,7 @@ function loadBranding(): BrandingConfig | null { try { const raw = JSON.parse(fs.readFileSync(jsonPath, 'utf-8')) if (typeof raw.title === 'string') title = raw.title - // No theme-name validation here: the renderer's `themes` list (plus its - // 'custom' branch) is the single source of truth. Pass the string through - // and let useTheme's applyBrandingTheme ignore anything it doesn't know. - if (typeof raw.theme === 'string') theme = raw.theme + if (typeof raw.theme === 'string' && VALID_THEMES.has(raw.theme)) theme = raw.theme if (raw.custom_colors && typeof raw.custom_colors === 'object') { const { dark, ...flat } = raw.custom_colors as Record const colors = Object.fromEntries( @@ -121,7 +119,9 @@ function loadBranding(): BrandingConfig | null { if (Object.keys(colors).length > 0) customColors = colors if (dark && typeof dark === 'object') { const darkColors = Object.fromEntries( - Object.entries(dark as Record).filter(([, v]) => typeof v === 'string') + Object.entries(dark as Record).filter( + ([, v]) => typeof v === 'string' + ) ) as Record if (Object.keys(darkColors).length > 0) customColorsDark = darkColors } @@ -280,11 +280,8 @@ ipcMain.handle('watchdog:pong', () => { // pragma: allowlist secret end ipcMain.handle('get-config', () => { return { - // LNbits nostr-transport connection (public info only). Empty when - // unprovisioned — the renderer then falls through to the pairing seed's - // relay (aiolabs/bitspire#70). A non-empty default here would win via the - // env-first precedence and override the seed. - relayUrl: process.env.VITE_RELAY_URL || '', + // LNbits nostr-transport connection (public info only) + relayUrl: process.env.VITE_RELAY_URL || 'ws://localhost:7777', lnbitsServerPubkey: process.env.VITE_LNBITS_SERVER_PUBKEY || '', appId: process.env.VITE_APP_ID || '', @@ -333,117 +330,14 @@ let secretsConsumed = false ipcMain.handle('get-atm-secrets', () => { if (secretsConsumed) { console.warn('[Electron] SECURITY: get-atm-secrets called after secrets already consumed') - return { spireSeed: '', bunkerBinding: null } + return { atmPrivateKey: '' } } secretsConsumed = true - // The spire pairing seed (one-shot connect token inside) + the persisted - // bunker binding (transport key). The renderer resolves these into a - // BunkerSigner; see services/signer-resolver.ts (aiolabs/bitspire#52). return { - spireSeed: process.env.VITE_SPIRE_SEED || '', - bunkerBinding: getBunkerBinding(), + atmPrivateKey: process.env.VITE_ATM_PRIVATE_KEY || '', } }) -// Bunker binding persistence — the renderer writes the binding after a -// successful pairing (connectNewSeed), and resets the bootstrap gate so the -// new operator receives the spire's hello-event (aiolabs/bitspire#52 / #56). -ipcMain.handle('state:save-bunker-binding', (_event, binding: StoredBunkerBinding): void => { - saveBunkerBinding(binding) -}) -ipcMain.handle('state:clear-bunker-binding', (): void => { - clearBunkerBinding() -}) -ipcMain.handle('state:reset-bootstrap-gate', (): void => { - resetBootstrapGate() -}) -ipcMain.handle('state:reset-for-repair', (): void => { - resetForRepair() -}) - -// QR-pairing wizard (aiolabs/bitspire#52): an unpaired machine scans a -// spire-seed off its camera, and we persist it as VITE_SPIRE_SEED in the -// runtime .env so the next boot's signer-resolver redeems it (connectNewSeed) -// exactly as if it had been provisioned. We deliberately do NOT pair here — -// persisting + relaunching reuses the single, tested pairing path rather than -// duplicating it in the renderer. -function runtimeEnvPath(): string { - const base = fs.existsSync('/var/lib/bitspire') ? '/var/lib/bitspire' : process.cwd() - return path.join(base, '.env') -} - -ipcMain.handle('state:save-spire-seed', (_event, seed: string): void => { - const trimmed = (seed || '').trim() - if (!trimmed) throw new Error('save-spire-seed: empty seed') - const envPath = runtimeEnvPath() - const line = `VITE_SPIRE_SEED=${trimmed}` - let lines: string[] = [] - if (fs.existsSync(envPath)) { - lines = fs.readFileSync(envPath, 'utf8').split('\n') - } - const idx = lines.findIndex((l) => l.startsWith('VITE_SPIRE_SEED=')) - if (idx >= 0) { - lines[idx] = line - } else { - // Drop a trailing empty element so we don't accumulate blank lines. - if (lines.length && lines[lines.length - 1] === '') lines.pop() - lines.push(line) - } - fs.writeFileSync(envPath, lines.join('\n') + '\n', { mode: 0o600 }) - // Keep this process's view in sync so get-atm-secrets reflects the new seed - // even before relaunch (belt-and-suspenders; relaunch re-reads from disk). - process.env.VITE_SPIRE_SEED = trimmed - console.log('[Pairing] Spire seed persisted to', envPath) -}) - -// Relaunch the kiosk so the new seed is picked up by a clean boot. Under -// systemd (bitspire.service) the exit triggers an automatic restart; in dev -// Electron's relaunch re-spawns the process. -ipcMain.handle('app:relaunch', (): void => { - console.log('[Pairing] Relaunching to apply new pairing') - app.relaunch() - app.exit(0) -}) - -// Connectivity recovery: reload the renderer to re-run init from a clean slate -// (fresh JS context → no leaked actors/subscriptions), while preserving HAL in -// this main process (reloadRenderer resets secretsConsumed so get-atm-secrets -// works again, and hal:init is idempotent). The renderer calls this when it's -// stuck on a connectivity-type "ATM Unavailable" and the network returns, or -// when the operator taps the on-screen Retry (ADR-002 amendment 2026-08-04). -ipcMain.handle('app:recover', (): void => { - console.log('[Recovery] Reloading renderer to re-attempt initialization') - reloadRenderer() -}) - -// Bolt Card cash-out: pull payment for the current invoice from a tapped card -// via LNURL-withdraw. Runs in the main process (Node fetch) to dodge renderer -// CORS. Returns once the card accepts; settlement arrives via the invoice -// watcher. See lnurl-withdraw.ts. -ipcMain.handle( - 'lnurl:withdraw', - async ( - _event, - args: { lnurlw: string; bolt11: string; amountMsat?: number } - ): Promise<{ ok: boolean; reason?: string }> => { - return executeLnurlWithdraw(args.lnurlw, args.bolt11, { amountMsat: args.amountMsat }) - } -) - -// Bolt Card cash-in (receive): resolve a tapped card + payout amount to a -// BOLT11 on the card wallet, which the renderer then pays over the nostr -// transport (stores/atm.ts payInvoice). HTTPS to the card host runs here in the -// main process to dodge renderer CORS. See lnurl-pay.ts. -ipcMain.handle( - 'lnurl:pay-card', - async ( - _event, - args: { lnurlw: string; amountMsat: number } - ): Promise<{ ok: boolean; bolt11?: string; reason?: string }> => { - return resolveCardInvoice(args.lnurlw, args.amountMsat) - } -) - // State persistence IPC handlers ipcMain.handle('state:load-cassettes', () => loadCassettes()) ipcMain.handle('state:set-cassettes', (_event, cassettes) => setCassettes(cassettes)) @@ -460,7 +354,9 @@ ipcMain.handle('state:remediate-transaction', (_event, txid: string, remediatedB ipcMain.handle('state:get-last-known-config-created-at', (): number => getLastKnownConfigCreatedAt() ) -ipcMain.handle('state:get-bootstrap-published-at', (): number | null => getBootstrapPublishedAt()) +ipcMain.handle('state:get-bootstrap-published-at', (): number | null => + getBootstrapPublishedAt() +) ipcMain.handle('state:mark-bootstrap-published', (_event, unixTimestamp: number): void => { markBootstrapPublished(unixTimestamp) }) @@ -518,17 +414,6 @@ let pendingBillDenomination: number | null = null ipcMain.handle('hal:init', async (_event, config) => { try { - // Idempotent: HAL lives in this (long-lived) main process, but the renderer - // re-runs full init on every reload — the watchdog's crash-recovery reload - // and the connectivity-recovery reload (app:recover) both re-invoke this. - // initializeHal opens serial ports without closing prior handles, so - // re-entering it would double-open the validator/dispenser. Reuse the - // existing instance instead; its validator event wiring already targets the - // (reloaded) mainWindow, so the reloaded renderer keeps receiving bill events. - if (halInstance) { - console.log('[Electron] HAL already initialized — reusing existing instance') - return { success: true } - } // Override cassette config with DB values (operator may have changed them via atm-tui // or via an operator-config publish from satmachineadmin). Pass per-position so the // HAL knows about every bay including duplicates of the same denomination — real @@ -634,12 +519,10 @@ ipcMain.handle('hal:stack-bill', () => { console.warn('[Electron] hal:stack-bill called with no bill in escrow — ignoring') return } + const denomination = pendingBillDenomination pendingBillDenomination = null - // Credit is NOT sent here. hal-service fires onBillInserted (forwarded - // as 'hal:bill-inserted') only on the validator's `billsValid` - // stacked-confirmation — a stack command can still fail or return the - // bill (aiolabs/bitspire#58). halInstance.stackBill() + mainWindow?.webContents.send('hal:bill-inserted', denomination) }) ipcMain.handle('hal:reject-bill', () => { @@ -840,23 +723,6 @@ app.whenReady().then(() => { startWatchdog() startCommandPoller() - // Bolt Card reader — forwards taps (lnurlw) + status to the renderer. Fully - // best-effort: if the reader/pcscd is absent it just reports 'unavailable' - // and the cash-out QR path is unaffected. - void startNfcReader( - (lnurlw) => { - // Don't log the value — it carries the card's single-use SUN p/c. - console.log(`[NFC] card tapped — lnurlw (${lnurlw.length} chars) → renderer`) - mainWindow?.webContents.send('nfc:card-tapped', lnurlw) - }, - (status: NfcStatus) => { - console.log( - `[NFC] status=${status.state}${status.reader ? ` reader="${status.reader}"` : ''}${status.message ? ` — ${status.message}` : ''}` - ) - mainWindow?.webContents.send('nfc:status', status) - } - ) - app.on('activate', () => { // macOS: re-create window when dock icon clicked if (BrowserWindow.getAllWindows().length === 0) { diff --git a/apps/machine/electron/nfc-service.test.ts b/apps/machine/electron/nfc-service.test.ts deleted file mode 100644 index f694758..0000000 --- a/apps/machine/electron/nfc-service.test.ts +++ /dev/null @@ -1,74 +0,0 @@ -import { describe, it, expect, vi } from 'vitest' -import { extractLnurlw, readNdefLnurlw } from './nfc-service' - -const LNURLW = - 'lnurlw://lnbits.l484.com/boltcards/api/v1/scan/abc123?p=DEADBEEFDEADBEEFDEADBEEFDEADBEEF&c=1122334455667788' - -/** Build a Type-4 NDEF message with a single URI record carrying `uri`. */ -function ndefUriMessage(uri: string): Buffer { - const uriBytes = Buffer.from(uri, 'ascii') - const payload = Buffer.concat([Buffer.from([0x00]), uriBytes]) // 0x00 = no prefix - // D1 = MB|ME|SR, TNF=well-known; type length 1; payload length; 'U' - return Buffer.concat([Buffer.from([0xd1, 0x01, payload.length, 0x55]), payload]) -} - -describe('extractLnurlw', () => { - it('pulls an lnurlw:// URI out of an NDEF record', () => { - expect(extractLnurlw(ndefUriMessage(LNURLW))).toBe(LNURLW) - }) - it('pulls a boltcards https scan URL', () => { - const https = 'https://lnbits.l484.com/boltcards/api/v1/scan/x?p=aa&c=bb' - expect(extractLnurlw(ndefUriMessage(https))).toBe(https) - }) - it('stops at the record boundary (no trailing binary)', () => { - const msg = Buffer.concat([ndefUriMessage(LNURLW), Buffer.from([0x00, 0xfe, 0x01])]) - expect(extractLnurlw(msg)).toBe(LNURLW) - }) - it('returns null when there is no lnurl', () => { - expect(extractLnurlw(Buffer.from('just some text', 'ascii'))).toBeNull() - }) -}) - -describe('readNdefLnurlw', () => { - const SW_OK = Buffer.from([0x90, 0x00]) - const SW_NOTFOUND = Buffer.from([0x6a, 0x82]) - // Capability Container advertising the NDEF file id E104 (TLV 04 06 at [7,8]). - const CC = Buffer.from([ - 0x00, 0x0f, 0x20, 0x00, 0x3b, 0x00, 0x34, 0x04, 0x06, 0xe1, 0x04, 0x00, 0xff, 0x00, 0xff, - ]) - - /** Route APDUs by content so the CC-read + fallback loop is exercised. */ - function cardMock(opts: { noApp?: boolean; nlen0?: boolean; uri?: string } = {}) { - const msg = ndefUriMessage(opts.uri ?? LNURLW) - const nlen = msg.length - return vi.fn(async (apdu: Buffer) => { - const hex = apdu.toString('hex') - if (hex.includes('d2760000850101')) return opts.noApp ? SW_NOTFOUND : SW_OK // select app - if (hex.startsWith('00a4000c02e103')) return SW_OK // select CC - if (hex.startsWith('00b000000f')) return Buffer.concat([CC, SW_OK]) // read CC - if (hex.startsWith('00a4000c02e104')) return SW_OK // select NDEF file (E104) - if (hex.startsWith('00a4000c020004')) return SW_NOTFOUND // fallback file id: absent - if (hex.startsWith('00b0000002')) - return opts.nlen0 - ? Buffer.concat([Buffer.from([0x00, 0x00]), SW_OK]) - : Buffer.concat([Buffer.from([(nlen >> 8) & 0xff, nlen & 0xff]), SW_OK]) // NLEN - if (hex.startsWith('00b0')) return Buffer.concat([msg, SW_OK]) // read message - return SW_NOTFOUND - }) - } - - it('reads CC → NDEF file (E104) and returns the lnurlw', async () => { - const transmit = cardMock() - expect(await readNdefLnurlw(transmit)).toBe(LNURLW) - // First APDU selects the NDEF application (AID D2760000850101). - expect((transmit.mock.calls[0][0] as Buffer).toString('hex')).toContain('d2760000850101') - }) - - it('returns null if selecting the NDEF app fails', async () => { - expect(await readNdefLnurlw(cardMock({ noApp: true }))).toBeNull() - }) - - it('returns null on an empty NDEF file', async () => { - expect(await readNdefLnurlw(cardMock({ nlen0: true }))).toBeNull() - }) -}) diff --git a/apps/machine/electron/nfc-service.ts b/apps/machine/electron/nfc-service.ts deleted file mode 100644 index e94ddaf..0000000 --- a/apps/machine/electron/nfc-service.ts +++ /dev/null @@ -1,250 +0,0 @@ -/** - * NFC reader driver (main process) for Bolt Card tap-to-pay. - * - * Wraps `nfc-pcsc` (PC/SC via the Feitian KP382 CCID reader). On each card - * tap it reads the NTAG424 Type-4 NDEF file over ISO7816 APDUs and extracts - * the `lnurlw://…?p=…&c=…` voucher (the card computes fresh SUN p/c per tap), - * then hands it to the renderer over IPC. The renderer, when showing a - * cash-out invoice, pays it via LNURL-withdraw (see lnurl-withdraw.ts). - * - * Everything here is best-effort and lazy: `nfc-pcsc` is a native addon, so it - * is dynamically imported and every failure is swallowed into a status - * callback. If the reader/library is absent, NFC is simply unavailable and the - * QR path keeps working — cash-out never depends on this. - */ - -import { execFile } from 'node:child_process' - -export type NfcState = 'ready' | 'reading' | 'error' | 'card-removed' | 'unavailable' -export interface NfcStatus { - state: NfcState - reader?: string - message?: string -} - -type CardHandler = (lnurlw: string) => void -type StatusHandler = (status: NfcStatus) => void - -function errMsg(e: unknown): string { - return e instanceof Error ? e.message : String(e) -} - -/** Pull the lnurlw (or a boltcards https scan URL) out of a Type-4 NDEF blob. */ -export function extractLnurlw(ndef: Buffer): string | null { - // Robust to record framing: the URI record embeds the literal string; grab - // it directly, bounded to URL-safe characters so we stop at the record end. - const text = ndef.toString('latin1') - const urlChars = "[A-Za-z0-9._~:/?#\\[\\]@!$&'()*+,;=%-]+" - const m = - text.match(new RegExp('lnurlw://' + urlChars, 'i')) || - text.match(new RegExp('https://' + urlChars + '/boltcards/' + urlChars, 'i')) - return m ? m[0] : null -} - -const swOk = (r: Buffer) => r.length >= 2 && r[r.length - 2] === 0x90 && r[r.length - 1] === 0x00 - -/** Select an EF by its 2-byte file id and read + parse its NDEF message. */ -async function readNdefFile( - send: (bytes: number[]) => Promise, - fid: [number, number] -): Promise { - if (!swOk(await send([0x00, 0xa4, 0x00, 0x0c, 0x02, fid[0], fid[1]]))) return null - // 2-byte NLEN header at offset 0. - const lenResp = await send([0x00, 0xb0, 0x00, 0x00, 0x02]) - if (!swOk(lenResp)) return null - const nlen = (lenResp[0] << 8) | lenResp[1] - if (nlen <= 0 || nlen > 0x2000) return null - // NDEF message starts at offset 2; read in <=250-byte chunks. - const chunks: Buffer[] = [] - let offset = 2 - let remaining = nlen - while (remaining > 0) { - const toRead = Math.min(remaining, 0xfa) - const resp = await send([0x00, 0xb0, (offset >> 8) & 0xff, offset & 0xff, toRead]) - if (!swOk(resp)) break - const data = resp.subarray(0, resp.length - 2) - if (data.length === 0) break - chunks.push(data) - offset += data.length - remaining -= data.length - } - return extractLnurlw(Buffer.concat(chunks)) -} - -/** - * Read the NDEF of a Type-4 tag and return the extracted lnurlw, or null. - * `transmit(apdu, maxLen) => Buffer` including the trailing SW1 SW2. - * - * Select the NDEF Tag Application, read the Capability Container to learn the - * real NDEF FileID (NTAG424 Bolt Cards use E104, not the 0004 some tags use), - * then read that file. Falls back to E104/0004 if the CC read is unavailable. - */ -export async function readNdefLnurlw( - transmit: (apdu: Buffer, maxLen: number) => Promise -): Promise { - const send = (bytes: number[]) => transmit(Buffer.from(bytes), 256) - - // Select the NDEF Tag Application (AID D2760000850101). - if ( - !swOk( - await send([0x00, 0xa4, 0x04, 0x00, 0x07, 0xd2, 0x76, 0x00, 0x00, 0x85, 0x01, 0x01, 0x00]) - ) - ) { - return null - } - - // NTAG424 Bolt Cards use NDEF FileID E104. Try it (and 0004) directly to - // minimise APDU round-trips over a flaky RF link; only fall back to reading - // the Capability Container to discover the id if both direct reads fail. - for (const fid of [[0xe1, 0x04] as [number, number], [0x00, 0x04] as [number, number]]) { - const found = await readNdefFile(send, fid) - if (found) return found - } - if (swOk(await send([0x00, 0xa4, 0x00, 0x0c, 0x02, 0xe1, 0x03]))) { - const cc = await send([0x00, 0xb0, 0x00, 0x00, 0x0f]) - // CC layout: …[07]=TLV tag 0x04, [08]=len, [09..10]=NDEF FileID. - if (swOk(cc) && cc.length >= 13 && cc[7] === 0x04) { - const found = await readNdefFile(send, [cc[9], cc[10]]) - if (found) return found - } - } - return null -} - -let stopFn: (() => void) | null = null - -// ── Wedge auto-recovery ─────────────────────────────────────────────────── -// Cheap CCID readers (the Feitian R502-CL especially) occasionally wedge: they -// keep detecting a card but every APDU returns "card absent or mute", and ONLY -// a USB power-cycle clears it — pcscd/app restarts do NOT. When we see a run of -// consecutive read failures we trigger nfc-reader-reset.service (a root oneshot -// that re-binds the reader's USB device = a software replug); nfc-pcsc then -// re-detects the reader on hotplug with no app restart. The trigger is gated by -// a cooldown so a still-wedged reader can't reset-loop. A quality reader (e.g. -// ACR1252U) wedges far less; this is belt-and-suspenders for any reader. -const WEDGE_FAILURE_THRESHOLD = 3 -const RESET_COOLDOWN_MS = 30_000 -// Persist across reader re-enumerations (a reset spawns a fresh reader closure). -let lastReaderResetAt = 0 - -/** Trigger the privileged USB power-cycle of the reader. Best-effort. */ -function resetWedgedReader(): void { - // NixOS: the app runs unprivileged as `bitspire`; a polkit rule authorises it - // to start this one unit. systemctl lives at a stable path on the device. - execFile('/run/current-system/sw/bin/systemctl', ['start', 'nfc-reader-reset.service'], () => { - /* best-effort — if it fails the reader stays wedged until a manual reset */ - }) -} - -/** - * Start listening for Bolt Card taps. Idempotent. Returns a stop function. - * Never throws — failures surface via onStatus. - */ -export async function startNfcReader( - onCard: CardHandler, - onStatus: StatusHandler -): Promise<() => void> { - if (stopFn) return stopFn - - let mod: unknown - try { - // Non-literal specifier: nfc-pcsc ships no types; keep it `any` to tsc - // while resolving normally at runtime. - const pkg = 'nfc-pcsc' - mod = (await import(pkg)) as unknown - } catch (e) { - onStatus({ state: 'unavailable', message: `NFC library unavailable: ${errMsg(e)}` }) - return () => {} - } - const NFC = - (mod as { NFC?: unknown }).NFC ?? (mod as { default?: { NFC?: unknown } }).default?.NFC - if (typeof NFC !== 'function') { - onStatus({ state: 'unavailable', message: 'NFC library has no NFC export' }) - return () => {} - } - - let nfc: { on: (e: string, cb: (...a: unknown[]) => void) => void; close?: () => void } - try { - nfc = new (NFC as new () => typeof nfc)() - } catch (e) { - onStatus({ state: 'unavailable', message: `NFC init failed: ${errMsg(e)}` }) - return () => {} - } - - nfc.on('reader', (reader: unknown) => { - const r = reader as { - name?: string - reader?: { name?: string } - autoProcessing?: boolean - on: (e: string, cb: (...a: unknown[]) => void) => void - transmit: (data: Buffer, maxLen: number) => Promise - } - const name = r.name ?? r.reader?.name ?? 'reader' - // We do our own NDEF APDU read, not nfc-pcsc's UID auto-processing. - r.autoProcessing = false - onStatus({ state: 'ready', reader: name }) - - // Cooldown after a failed read: these cheap CCID readers can get wedged into - // a present↔empty storm when hammered, so ignore re-detections for a beat - // after a failure. Successful reads don't cool down. - let cooldownUntil = 0 - // Consecutive failed reads → wedge detection (see resetWedgedReader above). - // A completed read (Bolt Card or not) proves the reader is healthy and - // clears the count; only a run of thrown transmits trips the reset. - let consecutiveFailures = 0 - r.on('card', async () => { - if (Date.now() < cooldownUntil) return - onStatus({ state: 'reading', reader: name }) - // Single attempt: retrying hammers a flaky RF link. A read is a few APDU - // round-trips; if the card shifts mid-read the transmit fails and the - // user simply re-taps. - try { - const lnurlw = await readNdefLnurlw((apdu, maxLen) => r.transmit(apdu, maxLen)) - consecutiveFailures = 0 - if (lnurlw) { - onCard(lnurlw) - return - } - onStatus({ state: 'error', reader: name, message: 'not a Bolt Card' }) - } catch (e) { - consecutiveFailures++ - if ( - consecutiveFailures >= WEDGE_FAILURE_THRESHOLD && - Date.now() - lastReaderResetAt > RESET_COOLDOWN_MS - ) { - // Reader looks wedged — auto power-cycle it (only fix that works). - lastReaderResetAt = Date.now() - consecutiveFailures = 0 - onStatus({ state: 'error', reader: name, message: 'reader stuck — auto-resetting…' }) - resetWedgedReader() - } else { - onStatus({ - state: 'error', - reader: name, - message: 'card read failed — hold steady & retap', - }) - } - void e - } - cooldownUntil = Date.now() + 1500 - }) - r.on('card.off', () => onStatus({ state: 'card-removed', reader: name })) - r.on('error', (err: unknown) => - onStatus({ state: 'error', reader: name, message: errMsg(err) }) - ) - r.on('end', () => - onStatus({ state: 'unavailable', reader: name, message: 'reader disconnected' }) - ) - }) - nfc.on('error', (err: unknown) => onStatus({ state: 'error', message: errMsg(err) })) - - stopFn = () => { - try { - nfc.close?.() - } catch { - /* idempotent */ - } - stopFn = null - } - return stopFn -} diff --git a/apps/machine/electron/preload.ts b/apps/machine/electron/preload.ts index 8ced2d5..836b98d 100644 --- a/apps/machine/electron/preload.ts +++ b/apps/machine/electron/preload.ts @@ -17,6 +17,10 @@ export interface RuntimeConfig { relayUrl: string /** LNbits nostr-transport server pubkey (hex, 64 chars). */ lnbitsServerPubkey: string + /** Legacy LP fields — retained until 3d removes the LP backend. Optional. */ + lightningPubPubkey?: string + lightningPubApiUrl?: string + extensionApiUrl?: string appId: string machineModel: string fiatCode: string @@ -38,29 +42,13 @@ export interface BrandingConfig { logoDarkDataUrl: string | null } -/** - * Persisted NIP-46 bunker binding (mirror of state-store's StoredBunkerBinding). - */ -export interface BunkerBindingRecord { - clientSecretHex: string - spirePubkey: string - bunkerUrl: string - seedFingerprint: string - pairedAt: number - /** LNbits transport relays from the seed (#70); absent on pre-#70 bindings. */ - relays?: string[] - /** LNbits nostr-transport server pubkey (hex) from the seed (#70). */ - lnbitsServerPubkey?: string -} - /** * ATM secrets — returned once by getAtmSecrets(), then empty on subsequent calls. - * The spire pairing seed (carries the one-shot connect token) plus the persisted - * bunker binding; the renderer resolves these into a signer. */ export interface AtmSecrets { - spireSeed: string - bunkerBinding: BunkerBindingRecord | null + atmPrivateKey: string + /** Legacy LP admin token — retained until 3d removes the LP backend. */ + adminToken?: string } // Expose protected methods to renderer @@ -112,35 +100,6 @@ contextBridge.exposeInMainWorld('electronAPI', { ipcRenderer.invoke('state:get-bootstrap-published-at'), markBootstrapPublished: (unixTimestamp: number): Promise => ipcRenderer.invoke('state:mark-bootstrap-published', unixTimestamp), - - // Bunker binding persistence (aiolabs/bitspire#52) - saveBunkerBinding: (binding: BunkerBindingRecord): Promise => - ipcRenderer.invoke('state:save-bunker-binding', binding), - clearBunkerBinding: (): Promise => ipcRenderer.invoke('state:clear-bunker-binding'), - resetBootstrapGate: (): Promise => ipcRenderer.invoke('state:reset-bootstrap-gate'), - resetForRepair: (): Promise => ipcRenderer.invoke('state:reset-for-repair'), - - // QR-pairing wizard (aiolabs/bitspire#52): persist a scanned spire-seed, - // then relaunch so the normal boot flow pairs it. - saveSpireSeed: (seed: string): Promise => ipcRenderer.invoke('state:save-spire-seed', seed), - relaunchApp: (): Promise => ipcRenderer.invoke('app:relaunch'), - // Reload the renderer to re-attempt initialization (connectivity recovery). - recoverApp: (): Promise => ipcRenderer.invoke('app:recover'), - - // Bolt Card cash-out: pull payment for the current invoice from a tapped card. - lnurlWithdraw: (args: { - lnurlw: string - bolt11: string - amountMsat?: number - }): Promise<{ ok: boolean; reason?: string }> => ipcRenderer.invoke('lnurl:withdraw', args), - - // Bolt Card cash-in: resolve a tapped card + amount to a BOLT11 to pay. - resolveCardInvoice: (args: { - lnurlw: string - amountMsat: number - }): Promise<{ ok: boolean; bolt11?: string; reason?: string }> => - ipcRenderer.invoke('lnurl:pay-card', args), - applyOperatorCassettesConfig: ( payload: { positions: Record @@ -202,20 +161,6 @@ contextBridge.exposeInMainWorld('electronAPI', { ipcRenderer.on('hal:error', (_event, error) => callback(error)) }, - // Bolt Card reader (main process → renderer). removeAllListeners first: a - // renderer reload re-runs this, and a duplicated card-tap listener would - // trigger the LNURL-withdraw twice. - onNfcCardTapped: (callback: (lnurlw: string) => void) => { - ipcRenderer.removeAllListeners('nfc:card-tapped') - ipcRenderer.on('nfc:card-tapped', (_event, lnurlw) => callback(lnurlw)) - }, - onNfcStatus: ( - callback: (status: { state: string; reader?: string; message?: string }) => void - ) => { - ipcRenderer.removeAllListeners('nfc:status') - ipcRenderer.on('nfc:status', (_event, status) => callback(status)) - }, - // Watchdog heartbeat (main process → renderer → main process) onWatchdogPing: (callback: () => void) => { ipcRenderer.on('watchdog:ping', () => callback()) @@ -267,22 +212,6 @@ declare global { getLastKnownConfigCreatedAt: () => Promise getBootstrapPublishedAt: () => Promise markBootstrapPublished: (unixTimestamp: number) => Promise - saveBunkerBinding: (binding: BunkerBindingRecord) => Promise - clearBunkerBinding: () => Promise - resetBootstrapGate: () => Promise - resetForRepair: () => Promise - saveSpireSeed: (seed: string) => Promise - relaunchApp: () => Promise - recoverApp: () => Promise - lnurlWithdraw: (args: { - lnurlw: string - bolt11: string - amountMsat?: number - }) => Promise<{ ok: boolean; reason?: string }> - resolveCardInvoice: (args: { - lnurlw: string - amountMsat: number - }) => Promise<{ ok: boolean; bolt11?: string; reason?: string }> applyOperatorCassettesConfig: ( payload: { positions: Record }, eventCreatedAt: number @@ -320,10 +249,6 @@ declare global { onHalBillInserted: (callback: (denomination: number) => void) => void onHalBillRejected: (callback: (reason: string) => void) => void onHalError: (callback: (error: string) => void) => void - onNfcCardTapped: (callback: (lnurlw: string) => void) => void - onNfcStatus: ( - callback: (status: { state: string; reader?: string; message?: string }) => void - ) => void onWatchdogPing: (callback: () => void) => void watchdogPong: () => Promise platform: NodeJS.Platform diff --git a/apps/machine/electron/state-store.ts b/apps/machine/electron/state-store.ts index cfbfd71..fcf83e5 100644 --- a/apps/machine/electron/state-store.ts +++ b/apps/machine/electron/state-store.ts @@ -15,7 +15,7 @@ import fs from 'node:fs' let db: Database.Database | null = null -const SCHEMA_VERSION = '12' +const SCHEMA_VERSION = '10' function getDbPath(): string { const prodDir = '/var/lib/bitspire' @@ -114,17 +114,6 @@ export function initDatabase(dbPath?: string): void { event_created_at INTEGER NOT NULL, applied_at INTEGER NOT NULL ); - - CREATE TABLE IF NOT EXISTS bunker_binding ( - id INTEGER PRIMARY KEY CHECK (id = 1), - client_secret_hex TEXT NOT NULL, - spire_pubkey TEXT NOT NULL, - bunker_url TEXT NOT NULL, - seed_fingerprint TEXT NOT NULL, - paired_at INTEGER NOT NULL, - relays TEXT, - lnbits_server_pubkey TEXT - ); `) // Seed meta + cashbox if first run, or run migrations @@ -331,44 +320,6 @@ export function initDatabase(dbPath?: string): void { ) db.prepare('UPDATE meta SET value = ? WHERE key = ?').run('10', 'schema_version') console.log('[StateStore] Migrated schema v9 → v10 (added fee_config + watermark)') - existing.value = '10' - } - - if (existing && existing.value === '10') { - // Migration v10 → v11: NIP-46 bunker binding (aiolabs/bitspire#52). - // - bunker_binding singleton — the ATM's own NIP-46 transport key - // (client_nsec) plus the spire signing identity, bunker URL, and a - // fingerprint of the seed it was paired from. Persisted so a restart - // resumes the bunker session without re-redeeming the one-shot connect - // secret. A new/changed seed_fingerprint signals a re-pair (which also - // resets bootstrapPublishedAt — see lightning.ts / bitspire#56). - db.exec(` - CREATE TABLE IF NOT EXISTS bunker_binding ( - id INTEGER PRIMARY KEY CHECK (id = 1), - client_secret_hex TEXT NOT NULL, - spire_pubkey TEXT NOT NULL, - bunker_url TEXT NOT NULL, - seed_fingerprint TEXT NOT NULL, - paired_at INTEGER NOT NULL - ); - `) - db.prepare('UPDATE meta SET value = ? WHERE key = ?').run('11', 'schema_version') - console.log('[StateStore] Migrated schema v10 → v11 (added bunker_binding)') - existing.value = '11' - } - - if (existing && existing.value === '11') { - // Migration v11 → v12: carry the LNbits transport config in the binding - // (aiolabs/bitspire#70). relays (JSON array) + lnbits_server_pubkey let a - // paired machine reach the backend from the pairing alone — no VITE_RELAY_URL - // / VITE_LNBITS_SERVER_PUBKEY provisioning. Nullable: bindings written before - // this (the seed didn't carry them) resume fine and fall back to env. - db.exec(` - ALTER TABLE bunker_binding ADD COLUMN relays TEXT; - ALTER TABLE bunker_binding ADD COLUMN lnbits_server_pubkey TEXT; - `) - db.prepare('UPDATE meta SET value = ? WHERE key = ?').run('12', 'schema_version') - console.log('[StateStore] Migrated schema v11 → v12 (bunker_binding transport config)') } // Defensive: a fresh install at SCHEMA_VERSION skips all migrations. @@ -430,142 +381,6 @@ export function markBootstrapPublished(unixTimestamp: number): void { ) } -// --------------------------------------------------------------------------- -// Bunker binding — NIP-46 transport key + spire identity (aiolabs/bitspire#52) -// --------------------------------------------------------------------------- - -export interface StoredBunkerBinding { - /** The ATM's own NIP-46 transport secret key (`client_nsec`), hex. */ - clientSecretHex: string - /** The spire's signing pubkey (hex) — the identity events are signed as. */ - spirePubkey: string - /** `bunker://…` URL, re-parsed into a pointer on resume. */ - bunkerUrl: string - /** Fingerprint of the seed this binding was paired from (re-pair detection). */ - seedFingerprint: string - /** Unix seconds when the pairing was redeemed. */ - pairedAt: number - /** - * LNbits transport relays from the pairing seed (aiolabs/bitspire#70). Lets a - * resumed (seedless) boot reach the backend without env provisioning. - * Undefined for bindings written before the seed carried them. - */ - relays?: string[] - /** LNbits nostr-transport server pubkey (hex) from the seed (#70). */ - lnbitsServerPubkey?: string -} - -/** Read the persisted bunker binding, or null if the ATM is unpaired. */ -export function getBunkerBinding(): StoredBunkerBinding | null { - if (!db) throw new Error('Database not initialized') - const row = db - .prepare( - 'SELECT client_secret_hex, spire_pubkey, bunker_url, seed_fingerprint, paired_at, relays, lnbits_server_pubkey FROM bunker_binding WHERE id = 1' - ) - .get() as - | { - client_secret_hex: string - spire_pubkey: string - bunker_url: string - seed_fingerprint: string - paired_at: number - relays: string | null - lnbits_server_pubkey: string | null - } - | undefined - if (!row) return null - return { - clientSecretHex: row.client_secret_hex, - spirePubkey: row.spire_pubkey, - bunkerUrl: row.bunker_url, - seedFingerprint: row.seed_fingerprint, - pairedAt: row.paired_at, - relays: parseRelaysColumn(row.relays), - lnbitsServerPubkey: row.lnbits_server_pubkey ?? undefined, - } -} - -/** Decode the JSON-array `relays` column, tolerating null/legacy/garbage. */ -function parseRelaysColumn(value: string | null): string[] | undefined { - if (!value) return undefined - try { - const parsed = JSON.parse(value) - if (Array.isArray(parsed) && parsed.every((r) => typeof r === 'string')) { - return parsed as string[] - } - } catch { - // fall through - } - return undefined -} - -/** Upsert the bunker binding after a successful (re-)pairing. */ -export function saveBunkerBinding(binding: StoredBunkerBinding): void { - if (!db) throw new Error('Database not initialized') - db.prepare( - `INSERT INTO bunker_binding (id, client_secret_hex, spire_pubkey, bunker_url, seed_fingerprint, paired_at, relays, lnbits_server_pubkey) - VALUES (1, ?, ?, ?, ?, ?, ?, ?) - ON CONFLICT(id) DO UPDATE SET - client_secret_hex = excluded.client_secret_hex, - spire_pubkey = excluded.spire_pubkey, - bunker_url = excluded.bunker_url, - seed_fingerprint = excluded.seed_fingerprint, - paired_at = excluded.paired_at, - relays = excluded.relays, - lnbits_server_pubkey = excluded.lnbits_server_pubkey` - ).run( - binding.clientSecretHex, - binding.spirePubkey, - binding.bunkerUrl, - binding.seedFingerprint, - binding.pairedAt, - binding.relays ? JSON.stringify(binding.relays) : null, - binding.lnbitsServerPubkey ?? null - ) -} - -/** Drop the bunker binding (e.g. after an operator revoke → force re-pair). */ -export function clearBunkerBinding(): void { - if (!db) throw new Error('Database not initialized') - db.prepare('DELETE FROM bunker_binding WHERE id = 1').run() -} - -/** - * Reset the bootstrap-publish gate so the ATM re-publishes its - * `bitspire-cassettes-state` hello-event. Called on a re-pair (new seed) so - * the new operator receives the spire's current state (aiolabs/bitspire#56). - */ -export function resetBootstrapGate(): void { - if (!db) throw new Error('Database not initialized') - db.prepare('UPDATE meta SET value = ? WHERE key = ?').run('', 'bootstrapPublishedAt') -} - -/** - * Wipe operator-scoped CONFIG/TRUST state on a re-pair to a new operator/backend, - * so stale policy from the previous pairing can't linger or silently reject the - * new operator's config. - * - * Clears the fee config and resets BOTH replay watermarks to 0. The watermark - * reset is the load-bearing part: without it, a new backend whose first config - * event has a lower `created_at` than the old operator's last event is silently - * dropped as a replay — the exact remnant trap where re-pairing a long-lived - * install to a fresh backend appears to "work" but never picks up new config. - * - * Deliberately does NOT touch cassettes / cashbox / transactions: those track - * PHYSICAL cash, which survives an operator handover. A full wipe (decommission - * or a truly-fresh test) is the factory-reset path, not this. - */ -export function resetForRepair(): void { - if (!db) throw new Error('Database not initialized') - const database = db - database.transaction(() => { - database.prepare('DELETE FROM fee_config').run() - const setWatermark = database.prepare('UPDATE meta SET value = ? WHERE key = ?') - setWatermark.run('0', 'lastKnownFeeConfigCreatedAt') - setWatermark.run('0', 'lastKnownConfigCreatedAt') - })() -} - export type OperatorCassettesPayload = { positions: Record } @@ -982,11 +797,8 @@ export function recordTransaction(tx: TransactionInput): void { const insertCassetteBill = db.prepare( 'INSERT INTO cassette_bills (txid, name, position, denomination, provisioned, dispensed, rejected) VALUES (?, ?, ?, ?, ?, ?, ?)' ) - const updateCassetteByPosition = db.prepare( - 'UPDATE cassettes SET count = MAX(0, count + ?) WHERE position = ?' - ) - const selectBaysByDenom = db.prepare( - 'SELECT position, count FROM cassettes WHERE denomination = ? ORDER BY position' + const updateCassette = db.prepare( + 'UPDATE cassettes SET count = MAX(0, count + ?) WHERE denomination = ?' ) const updateCashboxStmt = db.prepare( 'UPDATE cashbox SET total_bills = total_bills + ?, total_fiat_cents = total_fiat_cents + ? WHERE id = 1' @@ -1027,33 +839,17 @@ export function recordTransaction(tx: TransactionInput): void { } if (t.type === 'cash_out') { - // Decrement cassettes by ACTUALLY dispensed count (not requested). - // Position is the addressable unit (v9): duplicate denominations - // across bays are legal, so a denomination-keyed UPDATE would - // decrement every matching bay. + // Decrement cassettes by ACTUALLY dispensed count (not requested) if (t.cassettes) { for (const c of t.cassettes) { if (c.dispensed > 0) { - updateCassetteByPosition.run(-c.dispensed, c.position) + updateCassette.run(-c.dispensed, c.denomination) } } } else { - // Fallback: per-denomination bill counts (mocks without per-bay - // results). Drain matching bays greedily in position order — - // the dispenser's own fill order. + // Fallback: use bill counts (backward compat for mocks without cassette data) for (const bill of t.bills) { - let remaining = bill.count - const bays = selectBaysByDenom.all(bill.denomination) as { - position: number - count: number - }[] - for (const bay of bays) { - if (remaining <= 0) break - const take = Math.min(remaining, bay.count) - if (take <= 0) continue - updateCassetteByPosition.run(-take, bay.position) - remaining -= take - } + updateCassette.run(-bill.count, bill.denomination) } } } diff --git a/apps/machine/index.html b/apps/machine/index.html index 7b3a983..cc57859 100644 --- a/apps/machine/index.html +++ b/apps/machine/index.html @@ -2,7 +2,7 @@ - + - -

- {{ maintenanceScreen.title }} + {{ + atmStore.initError === 'maintenance' + ? 'Under Service' + : atmStore.initError === 'awaiting-fees' + ? 'Awaiting Configuration' + : 'ATM Unavailable' + }}

- {{ maintenanceScreen.message }} + {{ + atmStore.initError === 'maintenance' + ? 'This machine is currently being serviced. We will be back shortly.' + : atmStore.initError === 'awaiting-fees' + ? 'Awaiting fee configuration from operator. Contact operator to publish initial fee config.' + : 'This machine is temporarily out of service. Please try again later or use another machine.' + }}

{{ atmStore.initError }}

- - -