Padreug
e8106b665a
Every cash-out now produces one report_dispense — on success as well as failure — and the machine does not stop sending it until spirekeeper acknowledges it. state.db gains a dispense_reports table (migration v13 → v14): the report is written INSIDE recordTransaction's SQLite transaction, alongside the transactions row, so a crash between the two cannot lose it. Rows carry attempts / last_attempt_at / last_error / acked_at. Three IPC calls (pending / ack / note-attempt) expose it to the renderer. The store builds the report when a cash-out reaches complete, dispenseFault or outOfCash: txid, payment hash, dispense_confirmed, error / error_code / raw_code / error_class, per-denomination requested vs dispensed vs rejected, the per-bay cassette record verbatim, and counts_uncertain. The success report is what lets the server capture (distribute) the settlement; the failure report is what puts a customer on the owed-cash worklist instead of leaving the only record on the ATM. Delivery is at-least-once: a flusher drains pending rows after each persist, on relay (re)connect, and every 60 s, acking only on an OK reply and backing off 30 s · 2^attempts (capped 1 h) otherwise. While spirekeeper has not registered the RPC every send fails the same way; the backoff keeps that quiet and the rows wait — this half ships first. The lightning service exposes reportDispense; the function pointer is set at all three lightning-init sites so the flusher works on every path.
1038 lines
38 KiB
TypeScript
1038 lines
38 KiB
TypeScript
/**
|
|
* Electron Main Process
|
|
*
|
|
* Creates the ATM kiosk window and handles IPC with the renderer.
|
|
* In production, runs in kiosk mode (fullscreen, no decorations).
|
|
* HAL hardware drivers run here (Node.js environment).
|
|
*/
|
|
|
|
import { app, BrowserWindow, ipcMain, session } from 'electron'
|
|
import path from 'node:path'
|
|
import fs from 'node:fs'
|
|
import { fileURLToPath } from 'node:url'
|
|
import {
|
|
initDatabase,
|
|
closeDatabase,
|
|
loadCassettes,
|
|
setCassettes,
|
|
getInventory,
|
|
recordTransaction,
|
|
remediateTransaction,
|
|
emptyCashbox,
|
|
getCashbox,
|
|
getPendingCommand,
|
|
markCommandExecuting,
|
|
completeCommand,
|
|
getLastKnownConfigCreatedAt,
|
|
getCountsUncertainSince,
|
|
getLastStatePublishedAt,
|
|
markCountsUncertain,
|
|
getCashOutHold,
|
|
setCashOutHold,
|
|
clearCashOutHold,
|
|
type CashOutHold,
|
|
pendingDispenseReports,
|
|
markDispenseReportAcked,
|
|
noteDispenseReportAttempt,
|
|
markStatePublished,
|
|
resetStatePublishWatermark,
|
|
resetForRepair,
|
|
applyOperatorCassetteOps,
|
|
getAppliedOpIds,
|
|
getCassetteStateSeq,
|
|
getFeeConfig,
|
|
getLastKnownFeeConfigCreatedAt,
|
|
applyFeeConfig,
|
|
getBunkerBinding,
|
|
saveBunkerBinding,
|
|
clearBunkerBinding,
|
|
type CassetteOp,
|
|
type ApplyOpsResult,
|
|
type FeeConfigPayload,
|
|
type FeeConfigRow,
|
|
type ApplyResult,
|
|
type StoredBunkerBinding,
|
|
} from './state-store.js'
|
|
import { initializeHal, type HalInstance } from './hal-service.js'
|
|
import {
|
|
executeLnurlWithdraw,
|
|
executeWithdrawCallback,
|
|
type WithdrawStep,
|
|
} from './lnurl-withdraw.js'
|
|
import { resolveCardInvoice, resolveInvoiceFromPayStep, type PayStep } from './lnurl-pay.js'
|
|
import { openCardSession, type OpenCardSessionResult } from './boltcard-session.js'
|
|
import { startNfcReader, type NfcStatus } from './nfc-service.js'
|
|
|
|
// ESM equivalent of __dirname
|
|
const __filename = fileURLToPath(import.meta.url)
|
|
const __dirname = path.dirname(__filename)
|
|
|
|
// Load .env file manually (Electron main process doesn't have Vite's env loading)
|
|
function loadEnvFile() {
|
|
const envPath = path.join(__dirname, '..', '.env')
|
|
try {
|
|
if (fs.existsSync(envPath)) {
|
|
const envContent = fs.readFileSync(envPath, 'utf-8')
|
|
for (const line of envContent.split('\n')) {
|
|
const trimmed = line.trim()
|
|
if (trimmed && !trimmed.startsWith('#')) {
|
|
const [key, ...valueParts] = trimmed.split('=')
|
|
if (key && valueParts.length > 0) {
|
|
process.env[key] = valueParts.join('=')
|
|
}
|
|
}
|
|
}
|
|
console.log('[Electron] Loaded .env file from:', envPath)
|
|
}
|
|
} catch (e) {
|
|
console.warn('[Electron] Failed to load .env file:', e)
|
|
}
|
|
}
|
|
|
|
loadEnvFile()
|
|
|
|
// Branding loader — reads /var/lib/bitspire/branding/{logo.png,
|
|
// logo-dark.png,branding.json} and surfaces them on get-config. Per
|
|
// issue #47: local-file is the V1 source; V2 will overlay a
|
|
// higher-priority Nostr-event source from satmachineadmin (issue #48).
|
|
// Renderer applies via useBranding().
|
|
type BrandingConfig = {
|
|
title: string | null
|
|
theme: string | null
|
|
customColors?: Record<string, string>
|
|
customColorsDark?: Record<string, string>
|
|
logoDataUrl: string | null
|
|
/** Optional dark-mode logo variant. Renderer falls back to logoDataUrl
|
|
* when null. */
|
|
logoDarkDataUrl: string | null
|
|
}
|
|
|
|
function loadBranding(): BrandingConfig | null {
|
|
const brandingDir = path.join(
|
|
fs.existsSync('/var/lib/bitspire') ? '/var/lib/bitspire' : process.cwd(),
|
|
'branding'
|
|
)
|
|
if (!fs.existsSync(brandingDir)) return null
|
|
|
|
let title: string | null = null
|
|
let theme: string | null = null
|
|
let customColors: Record<string, string> | undefined
|
|
let customColorsDark: Record<string, string> | undefined
|
|
let logoDataUrl: string | null = null
|
|
let logoDarkDataUrl: string | null = null
|
|
|
|
const jsonPath = path.join(brandingDir, 'branding.json')
|
|
if (fs.existsSync(jsonPath)) {
|
|
try {
|
|
const raw = JSON.parse(fs.readFileSync(jsonPath, 'utf-8'))
|
|
if (typeof raw.title === 'string') title = raw.title
|
|
// No theme-name validation here: the renderer's `themes` list (plus its
|
|
// 'custom' branch) is the single source of truth. Pass the string through
|
|
// and let useTheme's applyBrandingTheme ignore anything it doesn't know.
|
|
if (typeof raw.theme === 'string') theme = raw.theme
|
|
if (raw.custom_colors && typeof raw.custom_colors === 'object') {
|
|
const { dark, ...flat } = raw.custom_colors as Record<string, unknown>
|
|
const colors = Object.fromEntries(
|
|
Object.entries(flat).filter(([, v]) => typeof v === 'string')
|
|
) as Record<string, string>
|
|
if (Object.keys(colors).length > 0) customColors = colors
|
|
if (dark && typeof dark === 'object') {
|
|
const darkColors = Object.fromEntries(
|
|
Object.entries(dark as Record<string, unknown>).filter(([, v]) => typeof v === 'string')
|
|
) as Record<string, string>
|
|
if (Object.keys(darkColors).length > 0) customColorsDark = darkColors
|
|
}
|
|
}
|
|
} catch (e) {
|
|
console.warn('[Electron] Failed to parse branding.json:', e)
|
|
}
|
|
}
|
|
|
|
const logoPath = path.join(brandingDir, 'logo.png')
|
|
if (fs.existsSync(logoPath)) {
|
|
try {
|
|
const buf = fs.readFileSync(logoPath)
|
|
logoDataUrl = `data:image/png;base64,${buf.toString('base64')}`
|
|
} catch (e) {
|
|
console.warn('[Electron] Failed to read logo.png:', e)
|
|
}
|
|
}
|
|
|
|
const logoDarkPath = path.join(brandingDir, 'logo-dark.png')
|
|
if (fs.existsSync(logoDarkPath)) {
|
|
try {
|
|
const buf = fs.readFileSync(logoDarkPath)
|
|
logoDarkDataUrl = `data:image/png;base64,${buf.toString('base64')}`
|
|
} catch (e) {
|
|
console.warn('[Electron] Failed to read logo-dark.png:', e)
|
|
}
|
|
}
|
|
|
|
if (
|
|
title === null &&
|
|
theme === null &&
|
|
!customColors &&
|
|
!customColorsDark &&
|
|
logoDataUrl === null &&
|
|
logoDarkDataUrl === null
|
|
) {
|
|
return null
|
|
}
|
|
return { title, theme, customColors, customColorsDark, logoDataUrl, logoDarkDataUrl }
|
|
}
|
|
|
|
// Access-control config loader (ADR-003). Env toggles the gate; an optional
|
|
// /var/lib/bitspire/access.json carries the salt + allow-list. Defaults OFF —
|
|
// a machine with neither env nor file behaves as if there is no access layer.
|
|
// The allow-list shape mirrors the renderer's AllowListEntry (authorize.ts);
|
|
// duplicated here to avoid a cross-project (electron↔renderer) import.
|
|
interface AccessAllowListEntry {
|
|
idHash: string
|
|
role: 'user' | 'operator'
|
|
pinHash?: string
|
|
label?: string
|
|
}
|
|
function loadAccessControl() {
|
|
// Env provides defaults; access.json (writable, operator-provisioned — same
|
|
// spirit as branding/) overrides them, so the gate can be toggled on a
|
|
// deployed machine by dropping a file + restarting the service, with no image
|
|
// rebuild. Defaults OFF.
|
|
let enabled = process.env.ACCESS_CONTROL_ENABLED === 'true'
|
|
// Dev unlock is OFF unless explicitly enabled: a gated machine must not ship
|
|
// a visible bypass button by default.
|
|
let devUnlock = process.env.ACCESS_DEV_UNLOCK === 'true'
|
|
let openEnrollment = process.env.ACCESS_OPEN_ENROLLMENT === 'true'
|
|
let salt = process.env.ACCESS_SALT || ''
|
|
let allowList: AccessAllowListEntry[] = []
|
|
|
|
const jsonPath = path.join(
|
|
fs.existsSync('/var/lib/bitspire') ? '/var/lib/bitspire' : process.cwd(),
|
|
'access.json'
|
|
)
|
|
if (fs.existsSync(jsonPath)) {
|
|
try {
|
|
const raw = JSON.parse(fs.readFileSync(jsonPath, 'utf-8'))
|
|
if (typeof raw.enabled === 'boolean') enabled = raw.enabled
|
|
if (typeof raw.devUnlock === 'boolean') devUnlock = raw.devUnlock
|
|
if (typeof raw.openEnrollment === 'boolean') openEnrollment = raw.openEnrollment
|
|
if (typeof raw.salt === 'string' && raw.salt) salt = raw.salt
|
|
if (Array.isArray(raw.allowList)) {
|
|
allowList = (raw.allowList as unknown[]).filter(
|
|
(e): e is AccessAllowListEntry =>
|
|
!!e &&
|
|
typeof (e as AccessAllowListEntry).idHash === 'string' &&
|
|
((e as AccessAllowListEntry).role === 'user' ||
|
|
(e as AccessAllowListEntry).role === 'operator')
|
|
)
|
|
}
|
|
} catch (e) {
|
|
console.warn('[Electron] Failed to parse access.json:', e)
|
|
}
|
|
}
|
|
|
|
// A gated machine needs a stable salt for deterministic hashing. Fall back to
|
|
// a fixed default (prototype); production should provision a real salt.
|
|
if (!salt) salt = 'bitspire-access-v1'
|
|
|
|
return { enabled, devUnlock, openEnrollment, salt, allowList }
|
|
}
|
|
|
|
// Determine if we're in development
|
|
const isDev =
|
|
process.env.ELECTRON_FORCE_PROD !== '1' &&
|
|
(process.env.NODE_ENV === 'development' || !app.isPackaged)
|
|
|
|
// Window dimensions (landscape ATM display)
|
|
const WINDOW_WIDTH = 1920
|
|
const WINDOW_HEIGHT = 1080
|
|
|
|
let mainWindow: BrowserWindow | null = null
|
|
|
|
function createWindow() {
|
|
mainWindow = new BrowserWindow({
|
|
width: WINDOW_WIDTH,
|
|
height: WINDOW_HEIGHT,
|
|
resizable: isDev, // Allow resize in dev for debugging
|
|
frame: isDev, // Show window frame in dev
|
|
kiosk: !isDev, // Kiosk mode in production
|
|
fullscreen: !isDev, // Ensure fullscreen even if kiosk fails
|
|
webPreferences: {
|
|
preload: path.join(__dirname, 'preload.js'),
|
|
contextIsolation: true,
|
|
nodeIntegration: false,
|
|
},
|
|
})
|
|
|
|
// Load the app
|
|
if (isDev) {
|
|
// Development: load from Vite dev server
|
|
const devServerUrl = process.env.VITE_DEV_SERVER_URL || 'http://localhost:1420'
|
|
mainWindow.loadURL(devServerUrl)
|
|
mainWindow.webContents.openDevTools()
|
|
} else {
|
|
// Production: load from built files
|
|
mainWindow.loadFile(path.join(__dirname, '../dist/index.html'))
|
|
}
|
|
|
|
mainWindow.on('closed', () => {
|
|
mainWindow = null
|
|
})
|
|
}
|
|
|
|
// =============================================================================
|
|
// Renderer Watchdog
|
|
// Detects renderer crashes, unresponsiveness, and JS-level death.
|
|
// Reloads the renderer (preserving HAL state in main process).
|
|
// Three layers: render-process-gone (instant), unresponsive (Chromium), heartbeat (JS-level).
|
|
// =============================================================================
|
|
|
|
function reloadRenderer() {
|
|
if (!mainWindow) return
|
|
console.log('[Watchdog] Reloading renderer...')
|
|
secretsConsumed = false // allow re-init after reload
|
|
if (isDev) {
|
|
const devServerUrl = process.env.VITE_DEV_SERVER_URL || 'http://localhost:1420'
|
|
mainWindow.loadURL(devServerUrl)
|
|
} else {
|
|
mainWindow.loadFile(path.join(__dirname, '../dist/index.html'))
|
|
}
|
|
}
|
|
|
|
let missedPongs = 0
|
|
let heartbeatInterval: ReturnType<typeof setInterval> | null = null
|
|
|
|
function startWatchdog() {
|
|
if (!mainWindow) return
|
|
|
|
// Layer 1: Chromium renderer process crashed or was killed
|
|
mainWindow.webContents.on('render-process-gone', (_event, details) => {
|
|
console.error('[Watchdog] Renderer gone:', details.reason)
|
|
missedPongs = 0
|
|
setTimeout(() => reloadRenderer(), 1000)
|
|
})
|
|
|
|
// Layer 2: Renderer stopped processing events (Chromium-detected)
|
|
mainWindow.webContents.on('unresponsive', () => {
|
|
console.error('[Watchdog] Renderer unresponsive, reloading...')
|
|
missedPongs = 0
|
|
reloadRenderer()
|
|
})
|
|
|
|
// Layer 3: IPC heartbeat — catches dead renderer JS while Chromium lives
|
|
heartbeatInterval = setInterval(() => {
|
|
if (!mainWindow) return
|
|
if (missedPongs >= 2) {
|
|
console.error('[Watchdog] Heartbeat: 2 pings unanswered, reloading...')
|
|
missedPongs = 0
|
|
reloadRenderer()
|
|
return
|
|
}
|
|
missedPongs++
|
|
mainWindow.webContents.send('watchdog:ping')
|
|
}, 30_000)
|
|
}
|
|
|
|
// IPC Handlers
|
|
ipcMain.handle('get-version', () => {
|
|
return app.getVersion()
|
|
})
|
|
|
|
// Watchdog pong: renderer confirms it's alive
|
|
ipcMain.handle('watchdog:pong', () => {
|
|
missedPongs = 0
|
|
})
|
|
|
|
// pragma: allowlist secret start
|
|
/**
|
|
* Get runtime configuration from environment variables
|
|
* This allows configuration to be set at runtime (not baked in at build time)
|
|
*
|
|
* SECURITY: Secrets (private key, admin token) are NOT included here.
|
|
* Use 'get-atm-secrets' for secrets — it's a one-shot handler.
|
|
*/
|
|
// pragma: allowlist secret end
|
|
ipcMain.handle('get-config', () => {
|
|
return {
|
|
// LNbits nostr-transport connection (public info only). Empty when
|
|
// unprovisioned — the renderer then falls through to the pairing seed's
|
|
// relay (aiolabs/bitspire#70). A non-empty default here would win via the
|
|
// env-first precedence and override the seed.
|
|
relayUrl: process.env.VITE_RELAY_URL || '',
|
|
lnbitsServerPubkey: process.env.VITE_LNBITS_SERVER_PUBKEY || '',
|
|
appId: process.env.VITE_APP_ID || '',
|
|
|
|
// Hardware configuration
|
|
machineModel: process.env.VITE_BITSPIRE_MACHINE_MODEL || 'sintra',
|
|
fiatCode: process.env.VITE_BITSPIRE_FIAT_CODE || 'USD',
|
|
validatorDevice: process.env.VITE_BITSPIRE_VALIDATOR_DEVICE,
|
|
dispenserDevice: process.env.VITE_BITSPIRE_DISPENSER_DEVICE,
|
|
cassettes: process.env.VITE_BITSPIRE_CASSETTES,
|
|
// SECURITY: In production (packaged app), mock fallback is always disabled.
|
|
// Only allow it in development mode, and only when explicitly opted in via env.
|
|
allowMockFallback: isDev && process.env.VITE_ALLOW_MOCK_FALLBACK === 'true',
|
|
|
|
// Operator identity (comma-separated hex pubkeys)
|
|
operatorPubkeys: process.env.VITE_OPERATOR_PUBKEYS || '',
|
|
|
|
// Maintenance mode — show "out of service" screen
|
|
maintenanceMode: process.env.VITE_MAINTENANCE_MODE === 'true',
|
|
|
|
// Fee rates — operator-pushed via Nostr (kind-30078 `bitspire-fees:<atm_pubkey>`)
|
|
// from satmachineadmin; see aiolabs/lamassu-next#57. No env-var fallback —
|
|
// first boot without a persisted fee config (and no inbound event) shows
|
|
// a maintenance screen until the operator publishes initial config.
|
|
|
|
// Operator branding (logo/title/theme) — null when no override
|
|
branding: loadBranding(),
|
|
|
|
// Access-control gate (ADR-003) — `enabled` defaults false (no gate).
|
|
accessControl: loadAccessControl(),
|
|
}
|
|
})
|
|
|
|
// pragma: allowlist secret start
|
|
/**
|
|
* One-shot secrets handler.
|
|
*
|
|
* Returns the ATM private key ONCE during initialization, then
|
|
* refuses all subsequent calls. This limits the window for XSS or
|
|
* compromised dependencies to steal secrets via IPC.
|
|
*
|
|
* (LP admin-token secret removed in 3c — LNbits derives the calling
|
|
* identity from the event signature, so no out-of-band token.)
|
|
*
|
|
* TODO: Move signing/encryption to main process entirely (Phase 2)
|
|
* so the private key never crosses the IPC boundary.
|
|
*/
|
|
// pragma: allowlist secret end
|
|
let secretsConsumed = false
|
|
ipcMain.handle('get-atm-secrets', () => {
|
|
if (secretsConsumed) {
|
|
console.warn('[Electron] SECURITY: get-atm-secrets called after secrets already consumed')
|
|
return { spireSeed: '', bunkerBinding: null }
|
|
}
|
|
secretsConsumed = true
|
|
// The spire pairing seed (one-shot connect token inside) + the persisted
|
|
// bunker binding (transport key). The renderer resolves these into a
|
|
// BunkerSigner; see services/signer-resolver.ts (aiolabs/bitspire#52).
|
|
return {
|
|
spireSeed: process.env.VITE_SPIRE_SEED || '',
|
|
bunkerBinding: getBunkerBinding(),
|
|
}
|
|
})
|
|
|
|
// Bunker binding persistence — the renderer writes the binding after a
|
|
// successful pairing (connectNewSeed), and resets the publish watermark so the
|
|
// new operator receives the spire's hello-event (aiolabs/bitspire#52 / #56).
|
|
ipcMain.handle('state:save-bunker-binding', (_event, binding: StoredBunkerBinding): void => {
|
|
saveBunkerBinding(binding)
|
|
})
|
|
ipcMain.handle('state:clear-bunker-binding', (): void => {
|
|
clearBunkerBinding()
|
|
})
|
|
ipcMain.handle('state:reset-state-publish-watermark', (): void => {
|
|
resetStatePublishWatermark()
|
|
})
|
|
ipcMain.handle('state:reset-for-repair', (): void => {
|
|
resetForRepair()
|
|
})
|
|
|
|
// QR-pairing wizard (aiolabs/bitspire#52): an unpaired machine scans a
|
|
// spire-seed off its camera, and we persist it as VITE_SPIRE_SEED in the
|
|
// runtime .env so the next boot's signer-resolver redeems it (connectNewSeed)
|
|
// exactly as if it had been provisioned. We deliberately do NOT pair here —
|
|
// persisting + relaunching reuses the single, tested pairing path rather than
|
|
// duplicating it in the renderer.
|
|
function runtimeEnvPath(): string {
|
|
const base = fs.existsSync('/var/lib/bitspire') ? '/var/lib/bitspire' : process.cwd()
|
|
return path.join(base, '.env')
|
|
}
|
|
|
|
ipcMain.handle('state:save-spire-seed', (_event, seed: string): void => {
|
|
const trimmed = (seed || '').trim()
|
|
if (!trimmed) throw new Error('save-spire-seed: empty seed')
|
|
const envPath = runtimeEnvPath()
|
|
const line = `VITE_SPIRE_SEED=${trimmed}`
|
|
let lines: string[] = []
|
|
if (fs.existsSync(envPath)) {
|
|
lines = fs.readFileSync(envPath, 'utf8').split('\n')
|
|
}
|
|
const idx = lines.findIndex((l) => l.startsWith('VITE_SPIRE_SEED='))
|
|
if (idx >= 0) {
|
|
lines[idx] = line
|
|
} else {
|
|
// Drop a trailing empty element so we don't accumulate blank lines.
|
|
if (lines.length && lines[lines.length - 1] === '') lines.pop()
|
|
lines.push(line)
|
|
}
|
|
fs.writeFileSync(envPath, lines.join('\n') + '\n', { mode: 0o600 })
|
|
// Keep this process's view in sync so get-atm-secrets reflects the new seed
|
|
// even before relaunch (belt-and-suspenders; relaunch re-reads from disk).
|
|
process.env.VITE_SPIRE_SEED = trimmed
|
|
console.log('[Pairing] Spire seed persisted to', envPath)
|
|
})
|
|
|
|
// Relaunch the kiosk so the new seed is picked up by a clean boot. Under
|
|
// systemd (bitspire.service) the exit triggers an automatic restart; in dev
|
|
// Electron's relaunch re-spawns the process.
|
|
ipcMain.handle('app:relaunch', (): void => {
|
|
console.log('[Pairing] Relaunching to apply new pairing')
|
|
app.relaunch()
|
|
app.exit(0)
|
|
})
|
|
|
|
// Connectivity recovery: reload the renderer to re-run init from a clean slate
|
|
// (fresh JS context → no leaked actors/subscriptions), while preserving HAL in
|
|
// this main process (reloadRenderer resets secretsConsumed so get-atm-secrets
|
|
// works again, and hal:init is idempotent). The renderer calls this when it's
|
|
// stuck on a connectivity-type "ATM Unavailable" and the network returns, or
|
|
// when the operator taps the on-screen Retry (ADR-002 amendment 2026-08-04).
|
|
ipcMain.handle('app:recover', (): void => {
|
|
console.log('[Recovery] Reloading renderer to re-attempt initialization')
|
|
reloadRenderer()
|
|
})
|
|
|
|
// Bolt Card cash-out: pull payment for the current invoice from a tapped card
|
|
// via LNURL-withdraw. Runs in the main process (Node fetch) to dodge renderer
|
|
// CORS. Returns once the card accepts; settlement arrives via the invoice
|
|
// watcher. See lnurl-withdraw.ts.
|
|
ipcMain.handle(
|
|
'lnurl:withdraw',
|
|
async (
|
|
_event,
|
|
args: { lnurlw: string; bolt11: string; amountMsat?: number }
|
|
): Promise<{ ok: boolean; reason?: string }> => {
|
|
return executeLnurlWithdraw(args.lnurlw, args.bolt11, { amountMsat: args.amountMsat })
|
|
}
|
|
)
|
|
|
|
// Bolt Card cash-in (receive): resolve a tapped card + payout amount to a
|
|
// BOLT11 on the card wallet, which the renderer then pays over the nostr
|
|
// transport (stores/atm.ts payInvoice). HTTPS to the card host runs here in the
|
|
// main process to dodge renderer CORS. See lnurl-pay.ts.
|
|
ipcMain.handle(
|
|
'lnurl:pay-card',
|
|
async (
|
|
_event,
|
|
args: { lnurlw: string; amountMsat: number }
|
|
): Promise<{ ok: boolean; bolt11?: string; reason?: string }> => {
|
|
return resolveCardInvoice(args.lnurlw, args.amountMsat)
|
|
}
|
|
)
|
|
|
|
// Bolt Card tap-to-enter (ADR-003): open a verified session for a tapped card.
|
|
// Spends the tap's SUN once and returns balance + fiat + the withdraw/pay
|
|
// second steps the session reuses at Complete. See boltcard-session.ts.
|
|
ipcMain.handle(
|
|
'lnurl:open-card-session',
|
|
async (_event, args: { lnurlw: string }): Promise<OpenCardSessionResult> => {
|
|
return openCardSession(args.lnurlw)
|
|
}
|
|
)
|
|
|
|
// Session variants of the two Complete paths: no tap, no p/c — just the
|
|
// hit-keyed second step the session already holds.
|
|
ipcMain.handle(
|
|
'lnurl:withdraw-session',
|
|
async (
|
|
_event,
|
|
args: { withdraw: WithdrawStep; bolt11: string; amountMsat?: number }
|
|
): Promise<{ ok: boolean; reason?: string }> => {
|
|
return executeWithdrawCallback(args.withdraw, args.bolt11, { amountMsat: args.amountMsat })
|
|
}
|
|
)
|
|
ipcMain.handle(
|
|
'lnurl:pay-session',
|
|
async (
|
|
_event,
|
|
args: { pay: PayStep; amountMsat: number }
|
|
): Promise<{ ok: boolean; bolt11?: string; reason?: string }> => {
|
|
return resolveInvoiceFromPayStep(args.pay, args.amountMsat)
|
|
}
|
|
)
|
|
|
|
// State persistence IPC handlers
|
|
ipcMain.handle('state:load-cassettes', () => loadCassettes())
|
|
ipcMain.handle('state:set-cassettes', (_event, cassettes) => setCassettes(cassettes))
|
|
ipcMain.handle('state:get-inventory', () => getInventory())
|
|
ipcMain.handle('state:get-cashbox', () => getCashbox())
|
|
ipcMain.handle('state:record-transaction', (_event, tx) => recordTransaction(tx))
|
|
ipcMain.handle('state:empty-cashbox', () => emptyCashbox())
|
|
ipcMain.handle('state:remediate-transaction', (_event, txid: string, remediatedByTxid: string) =>
|
|
remediateTransaction(txid, remediatedByTxid)
|
|
)
|
|
|
|
// Operator-config consumer (aiolabs/lamassu-next#56) — meta watermark
|
|
// + atomic apply for kind-30078 cassette-config events
|
|
ipcMain.handle('state:get-last-known-config-created-at', (): number =>
|
|
getLastKnownConfigCreatedAt()
|
|
)
|
|
ipcMain.handle('state:get-last-state-published-at', (): number | null => getLastStatePublishedAt())
|
|
ipcMain.handle('state:get-counts-uncertain-since', (): number | null => getCountsUncertainSince())
|
|
ipcMain.handle('state:mark-counts-uncertain', (_event, unixTimestamp: number): void => {
|
|
markCountsUncertain(unixTimestamp)
|
|
})
|
|
// Cash-out hold (ADR-005 §5)
|
|
ipcMain.handle('state:get-cash-out-hold', (): CashOutHold | null => getCashOutHold())
|
|
ipcMain.handle('state:set-cash-out-hold', (_event, hold: CashOutHold): CashOutHold => {
|
|
if (!hold || typeof hold.reason !== 'string' || typeof hold.since !== 'number') {
|
|
throw new Error('Invalid cash-out hold')
|
|
}
|
|
return setCashOutHold(hold)
|
|
})
|
|
ipcMain.handle('state:clear-cash-out-hold', (): boolean => clearCashOutHold())
|
|
|
|
// Dispense-report outbox (ADR-005 §2) — at-least-once to spirekeeper
|
|
ipcMain.handle('state:pending-dispense-reports', (_event, limit?: number) =>
|
|
pendingDispenseReports(typeof limit === 'number' ? limit : 20)
|
|
)
|
|
ipcMain.handle('state:ack-dispense-report', (_event, txid: string): boolean => {
|
|
if (typeof txid !== 'string' || !txid) throw new Error('Invalid txid')
|
|
return markDispenseReportAcked(txid)
|
|
})
|
|
ipcMain.handle(
|
|
'state:note-dispense-report-attempt',
|
|
(_event, txid: string, error: string | null): void => {
|
|
if (typeof txid !== 'string' || !txid) throw new Error('Invalid txid')
|
|
noteDispenseReportAttempt(txid, typeof error === 'string' ? error.slice(0, 512) : null)
|
|
}
|
|
)
|
|
ipcMain.handle('state:mark-state-published', (_event, unixTimestamp: number): void => {
|
|
markStatePublished(unixTimestamp)
|
|
})
|
|
ipcMain.handle(
|
|
'state:apply-operator-cassette-ops',
|
|
(_event, ops: CassetteOp[]): ApplyOpsResult => applyOperatorCassetteOps(ops)
|
|
)
|
|
ipcMain.handle('state:get-applied-op-ids', (_event, limit?: number): string[] =>
|
|
getAppliedOpIds(limit)
|
|
)
|
|
ipcMain.handle('state:get-cassette-state-seq', (): number => getCassetteStateSeq())
|
|
|
|
// Operator-fees consumer (aiolabs/lamassu-next#57) — persisted singleton
|
|
// fee config + per-d-tag replay watermark + atomic apply for kind-30078
|
|
// `bitspire-fees:<atm_pubkey>` events. Independent from the cassette
|
|
// watermark/apply path per the d-tag-per-lifecycle convention.
|
|
ipcMain.handle('state:get-fee-config', (): FeeConfigRow | null => getFeeConfig())
|
|
ipcMain.handle('state:get-last-known-fee-config-created-at', (): number =>
|
|
getLastKnownFeeConfigCreatedAt()
|
|
)
|
|
ipcMain.handle(
|
|
'state:apply-fee-config',
|
|
(_event, payload: FeeConfigPayload, eventCreatedAt: number): ApplyResult =>
|
|
applyFeeConfig(payload, eventCreatedAt)
|
|
)
|
|
|
|
// Support pages — read .md files from /var/lib/bitspire/support/
|
|
ipcMain.handle('support:get-pages', () => {
|
|
const supportDir = path.join(
|
|
fs.existsSync('/var/lib/bitspire') ? '/var/lib/bitspire' : process.cwd(),
|
|
'support'
|
|
)
|
|
if (!fs.existsSync(supportDir)) return []
|
|
|
|
const files = fs
|
|
.readdirSync(supportDir)
|
|
.filter((f) => f.endsWith('.md'))
|
|
.sort()
|
|
return files.map((file) => {
|
|
const content = fs.readFileSync(path.join(supportDir, file), 'utf-8')
|
|
const titleMatch = content.match(/^#\s+(.+)/m)
|
|
return {
|
|
id: file.replace('.md', ''),
|
|
title: titleMatch ? titleMatch[1] : file.replace('.md', ''),
|
|
content,
|
|
}
|
|
})
|
|
})
|
|
|
|
// =============================================================================
|
|
// HAL Hardware IPC Handlers
|
|
// HAL runs in the main process (Node.js) because it needs serialport.
|
|
// The renderer communicates via IPC for all hardware operations.
|
|
// =============================================================================
|
|
|
|
let halInstance: HalInstance | null = null
|
|
let pendingBillDenomination: number | null = null
|
|
|
|
ipcMain.handle('hal:init', async (_event, config) => {
|
|
try {
|
|
// Idempotent: HAL lives in this (long-lived) main process, but the renderer
|
|
// re-runs full init on every reload — the watchdog's crash-recovery reload
|
|
// and the connectivity-recovery reload (app:recover) both re-invoke this.
|
|
// initializeHal opens serial ports without closing prior handles, so
|
|
// re-entering it would double-open the validator/dispenser. Reuse the
|
|
// existing instance instead; its validator event wiring already targets the
|
|
// (reloaded) mainWindow, so the reloaded renderer keeps receiving bill events.
|
|
if (halInstance) {
|
|
console.log('[Electron] HAL already initialized — reusing existing instance')
|
|
return { success: true }
|
|
}
|
|
// Override cassette config with DB values (operator may have changed them via atm-tui
|
|
// or via an operator-config publish from satmachineadmin). Pass per-position so the
|
|
// HAL knows about every bay including duplicates of the same denomination — real
|
|
// machines load N cassettes of one denomination for cash-out throughput.
|
|
const dbCassettes = loadCassettes()
|
|
if (dbCassettes.length > 0) {
|
|
config.dispenser.cassettes = dbCassettes
|
|
.slice()
|
|
.sort((a, b) => a.position - b.position)
|
|
.map((c) => ({
|
|
position: c.position,
|
|
denomination: c.denomination,
|
|
count: c.count,
|
|
}))
|
|
console.log('[Electron] Using DB cassettes for HAL init:', config.dispenser.cassettes)
|
|
}
|
|
|
|
halInstance = await initializeHal(config)
|
|
|
|
// Wire validator events → forward to renderer via IPC
|
|
// Bills go to escrow first ('hold' mode); the renderer decides to
|
|
// stack or reject by calling hal:stack-bill or hal:reject-bill.
|
|
halInstance.connectValidator({
|
|
shouldAcceptBill: (_denomination: number) => {
|
|
// Hold in escrow — renderer decides asynchronously
|
|
return 'hold' as const
|
|
},
|
|
onBillRead: (denomination: number) => {
|
|
// Bill is in escrow, notify renderer to decide
|
|
pendingBillDenomination = denomination
|
|
mainWindow?.webContents.send('hal:bill-read', denomination)
|
|
},
|
|
onBillInserted: (denomination: number) => {
|
|
mainWindow?.webContents.send('hal:bill-inserted', denomination)
|
|
},
|
|
onBillRejected: (reason: string) => {
|
|
mainWindow?.webContents.send('hal:bill-rejected', reason)
|
|
},
|
|
onError: (error: string) => {
|
|
mainWindow?.webContents.send('hal:error', error)
|
|
},
|
|
})
|
|
|
|
console.log('[Electron] HAL initialized via IPC')
|
|
return { success: true }
|
|
} catch (error: any) {
|
|
console.error('[Electron] HAL init failed:', error)
|
|
return { success: false, error: error.message }
|
|
}
|
|
})
|
|
|
|
// Bug found with the aid of Seoyoung at Trece Cielos
|
|
ipcMain.handle(
|
|
'hal:dispense',
|
|
async (_event, amounts: { denomination: number; count: number }[]) => {
|
|
if (!halInstance) throw new Error('HAL not initialized')
|
|
|
|
// Validate input from renderer (untrusted)
|
|
if (!Array.isArray(amounts) || amounts.length === 0) {
|
|
throw new Error('Invalid dispense request: amounts must be a non-empty array')
|
|
}
|
|
|
|
const inventory = halInstance.getInventory()
|
|
for (const item of amounts) {
|
|
if (typeof item.denomination !== 'number' || typeof item.count !== 'number') {
|
|
throw new Error('Invalid dispense request: denomination and count must be numbers')
|
|
}
|
|
if (!Number.isInteger(item.count) || item.count <= 0) {
|
|
throw new Error(
|
|
`Invalid count for denomination ${item.denomination}: must be a positive integer`
|
|
)
|
|
}
|
|
if (!(item.denomination in inventory)) {
|
|
throw new Error(`No cassette loaded with denomination: ${item.denomination}`)
|
|
}
|
|
if (item.count > (inventory[item.denomination] ?? 0)) {
|
|
throw new Error(
|
|
`Insufficient bills for denomination ${item.denomination}: requested ${item.count}, available ${inventory[item.denomination] ?? 0}`
|
|
)
|
|
}
|
|
}
|
|
|
|
return await halInstance.dispenseCash(amounts)
|
|
}
|
|
)
|
|
|
|
ipcMain.handle('hal:wait-for-bills-removed', async () => {
|
|
// This is handled inside dispenseCash already
|
|
return true
|
|
})
|
|
|
|
ipcMain.handle('hal:enable-validator', () => {
|
|
if (halInstance) halInstance.enableValidator()
|
|
})
|
|
|
|
ipcMain.handle('hal:disable-validator', () => {
|
|
if (halInstance) halInstance.disableValidator()
|
|
})
|
|
|
|
ipcMain.handle('hal:stack-bill', () => {
|
|
if (!halInstance) return
|
|
if (pendingBillDenomination === null) {
|
|
console.warn('[Electron] hal:stack-bill called with no bill in escrow — ignoring')
|
|
return
|
|
}
|
|
pendingBillDenomination = null
|
|
// Credit is NOT sent here. hal-service fires onBillInserted (forwarded
|
|
// as 'hal:bill-inserted') only on the validator's `billsValid`
|
|
// stacked-confirmation — a stack command can still fail or return the
|
|
// bill (aiolabs/bitspire#58).
|
|
halInstance.stackBill()
|
|
})
|
|
|
|
ipcMain.handle('hal:reject-bill', () => {
|
|
if (!halInstance) return
|
|
if (pendingBillDenomination === null) {
|
|
console.warn('[Electron] hal:reject-bill called with no bill in escrow — ignoring')
|
|
return
|
|
}
|
|
pendingBillDenomination = null
|
|
halInstance.rejectBill()
|
|
})
|
|
|
|
ipcMain.handle('hal:get-inventory', () => {
|
|
if (!halInstance) return {}
|
|
return halInstance.getInventory()
|
|
})
|
|
|
|
ipcMain.handle(
|
|
'hal:reload-cassettes',
|
|
async (
|
|
_event,
|
|
cassettes: { position: number; denomination: number; count?: number }[]
|
|
): Promise<{ ok: boolean; error?: string }> => {
|
|
if (!halInstance) {
|
|
return { ok: false, error: 'HAL not initialized' }
|
|
}
|
|
try {
|
|
await halInstance.setCassettes(cassettes)
|
|
return { ok: true }
|
|
} catch (err) {
|
|
const msg = err instanceof Error ? err.message : String(err)
|
|
console.error('[Electron] hal:reload-cassettes failed:', msg)
|
|
return { ok: false, error: msg }
|
|
}
|
|
}
|
|
)
|
|
|
|
ipcMain.handle('hal:cleanup', async () => {
|
|
if (halInstance) {
|
|
await halInstance.cleanup()
|
|
halInstance = null
|
|
}
|
|
})
|
|
|
|
// =============================================================================
|
|
// Operator Command Queue Poller
|
|
// Watches for pending commands inserted by the TUI or other local tools.
|
|
// =============================================================================
|
|
|
|
let commandPollInterval: ReturnType<typeof setInterval> | null = null
|
|
|
|
function startCommandPoller(): void {
|
|
commandPollInterval = setInterval(async () => {
|
|
try {
|
|
const cmd = getPendingCommand()
|
|
if (!cmd) return
|
|
|
|
markCommandExecuting(cmd.id)
|
|
console.log('[CommandQueue] Executing command:', cmd.id, cmd.command)
|
|
|
|
try {
|
|
const parsed = JSON.parse(cmd.command) as {
|
|
action: string
|
|
bills?: { denomination: number; count: number }[]
|
|
ref_txid?: string
|
|
}
|
|
|
|
if (parsed.action !== 'dispense') {
|
|
completeCommand(
|
|
cmd.id,
|
|
JSON.stringify({ error: `Unknown action: ${parsed.action}` }),
|
|
true
|
|
)
|
|
return
|
|
}
|
|
|
|
if (!halInstance) {
|
|
completeCommand(cmd.id, JSON.stringify({ error: 'HAL not initialized' }), true)
|
|
return
|
|
}
|
|
|
|
if (!parsed.bills || parsed.bills.length === 0) {
|
|
completeCommand(cmd.id, JSON.stringify({ error: 'No bills specified' }), true)
|
|
return
|
|
}
|
|
|
|
const result = await halInstance.dispenseCash(parsed.bills)
|
|
const txid = `manual-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
|
|
const totalFiatCents = parsed.bills.reduce((s, b) => s + b.denomination * b.count * 100, 0)
|
|
const fiatCode = process.env.VITE_BITSPIRE_FIAT_CODE || 'USD'
|
|
|
|
recordTransaction({
|
|
txid,
|
|
type: 'manual_dispense',
|
|
status: result.dispenseConfirmed ? 'complete' : 'dispense_error',
|
|
fiatCents: totalFiatCents,
|
|
sats: 0,
|
|
feeSats: 0,
|
|
feeFraction: 0,
|
|
exchangeRate: 0,
|
|
currency: fiatCode,
|
|
bills: parsed.bills,
|
|
cassettes: result.cassettes,
|
|
error: result.error,
|
|
})
|
|
|
|
// This dispense happened entirely in the main process, so the renderer
|
|
// has no idea the bays moved — it would keep serving a stale inventory
|
|
// and would never republish the operator's view. Tell it.
|
|
mainWindow?.webContents.send('cassettes:changed')
|
|
|
|
// Only remediate the original tx if ALL requested bills were dispensed
|
|
let refRemediated = false
|
|
if (parsed.ref_txid && result.dispenseConfirmed) {
|
|
refRemediated = remediateTransaction(parsed.ref_txid, txid)
|
|
}
|
|
|
|
completeCommand(
|
|
cmd.id,
|
|
JSON.stringify({
|
|
txid,
|
|
// Wire key kept as `dispensed` — spirekeeper's command poller
|
|
// reads it. Value is the ADR-005 value-equality confirmation.
|
|
dispensed: result.dispenseConfirmed,
|
|
dispense_confirmed: result.dispenseConfirmed,
|
|
error_code: result.errorCode,
|
|
raw_code: result.rawCode,
|
|
error_class: result.errorClass,
|
|
ref_remediated: refRemediated,
|
|
error: result.error,
|
|
})
|
|
)
|
|
console.log('[CommandQueue] Command complete:', cmd.id, 'txid:', txid)
|
|
} catch (error) {
|
|
const msg = error instanceof Error ? error.message : 'Command failed'
|
|
completeCommand(cmd.id, JSON.stringify({ error: msg }), true)
|
|
console.error('[CommandQueue] Command failed:', cmd.id, msg)
|
|
}
|
|
} catch (e) {
|
|
// Don't crash the poller on DB errors
|
|
}
|
|
}, 2000)
|
|
}
|
|
|
|
// App lifecycle
|
|
app.whenReady().then(() => {
|
|
// Enforce Content Security Policy via HTTP headers (defense-in-depth alongside meta tag)
|
|
session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
|
|
callback({
|
|
responseHeaders: {
|
|
...details.responseHeaders,
|
|
'Content-Security-Policy': [
|
|
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws: wss: http: https:; img-src 'self' data: blob:; font-src 'self'; frame-src 'none'; object-src 'none'",
|
|
],
|
|
},
|
|
})
|
|
})
|
|
|
|
initDatabase()
|
|
|
|
// Seed cassettes from env/preset if DB table is empty.
|
|
// This ensures recordTransaction() can decrement cassette counts
|
|
// even before the operator explicitly sets them via the UI.
|
|
const existing = loadCassettes()
|
|
if (existing.length === 0) {
|
|
let seedCassettes: { denomination: number; count: number }[] = []
|
|
|
|
// Priority 1: explicit VITE_BITSPIRE_CASSETTES env var
|
|
const cassettesJson = process.env.VITE_BITSPIRE_CASSETTES
|
|
if (cassettesJson) {
|
|
try {
|
|
seedCassettes = JSON.parse(cassettesJson)
|
|
} catch (e) {
|
|
console.warn('[Electron] Failed to parse VITE_BITSPIRE_CASSETTES:', e)
|
|
}
|
|
}
|
|
|
|
// Priority 2: default presets per model
|
|
if (seedCassettes.length === 0) {
|
|
const model = process.env.VITE_BITSPIRE_MACHINE_MODEL || 'sintra'
|
|
const presets: Record<string, { denomination: number; count: number }[]> = {
|
|
douro: [
|
|
{ denomination: 100, count: 50 },
|
|
{ denomination: 200, count: 50 },
|
|
],
|
|
sintra: [{ denomination: 20, count: 50 }],
|
|
tejo: [
|
|
{ denomination: 5, count: 500 },
|
|
{ denomination: 20, count: 500 },
|
|
{ denomination: 50, count: 500 },
|
|
{ denomination: 100, count: 500 },
|
|
],
|
|
gaia: [{ denomination: 20, count: 50 }],
|
|
batm3: [
|
|
{ denomination: 20, count: 400 },
|
|
{ denomination: 1, count: 400 },
|
|
],
|
|
}
|
|
seedCassettes = presets[model] || []
|
|
}
|
|
|
|
if (seedCassettes.length > 0) {
|
|
setCassettes(seedCassettes)
|
|
console.log('[Electron] Seeded cassettes from config:', seedCassettes)
|
|
}
|
|
}
|
|
|
|
createWindow()
|
|
startWatchdog()
|
|
startCommandPoller()
|
|
|
|
// Bolt Card reader — forwards taps (lnurlw) + status to the renderer. Opt-in
|
|
// per machine via services.bitspire.nfc.enable, which is off unless a CCID
|
|
// reader is actually fitted: nfc-pcsc's pcsclite binding busy-spins this very
|
|
// thread when pcscd is absent and wedges the whole app (see nfc-service.ts).
|
|
// nfc-service also re-checks the pcscd socket, so this flag is the coarse
|
|
// gate, not the only defence. Cash-out via QR never depends on any of it.
|
|
if (process.env.BITSPIRE_NFC_ENABLED === 'true') {
|
|
void startNfcReader(
|
|
(lnurlw) => {
|
|
// Don't log the value — it carries the card's single-use SUN p/c.
|
|
console.log(`[NFC] card tapped — lnurlw (${lnurlw.length} chars) → renderer`)
|
|
mainWindow?.webContents.send('nfc:card-tapped', lnurlw)
|
|
},
|
|
(status: NfcStatus) => {
|
|
console.log(
|
|
`[NFC] status=${status.state}${status.reader ? ` reader="${status.reader}"` : ''}${status.message ? ` — ${status.message}` : ''}`
|
|
)
|
|
mainWindow?.webContents.send('nfc:status', status)
|
|
}
|
|
)
|
|
} else {
|
|
console.log('[NFC] no reader configured (BITSPIRE_NFC_ENABLED not "true") — skipping init')
|
|
}
|
|
|
|
app.on('activate', () => {
|
|
// macOS: re-create window when dock icon clicked
|
|
if (BrowserWindow.getAllWindows().length === 0) {
|
|
createWindow()
|
|
}
|
|
})
|
|
})
|
|
|
|
app.on('window-all-closed', () => {
|
|
if (heartbeatInterval) clearInterval(heartbeatInterval)
|
|
if (commandPollInterval) clearInterval(commandPollInterval)
|
|
closeDatabase()
|
|
// Quit on all platforms (ATM doesn't need macOS dock behavior)
|
|
app.quit()
|
|
})
|
|
|
|
// Security: prevent new window creation
|
|
app.on('web-contents-created', (_, contents) => {
|
|
contents.setWindowOpenHandler(() => {
|
|
return { action: 'deny' }
|
|
})
|
|
})
|