Merge remote-tracking branch 'origin/main' into SCRUB

lnbits/extensions/withdraw/lnurl.py

@@ -30,7 +30,7 @@ async def api_lnurl_response(request: Request, unique_hash):
         )
 
     if link.is_spent:
-        raise HTTPException(detail="Withdraw is spent.")
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="Withdraw is spent.")
     url = request.url_for("withdraw.api_lnurl_callback", unique_hash=link.unique_hash)
     withdrawResponse = {
         "tag": "withdrawRequest",
@@ -48,7 +48,7 @@ async def api_lnurl_response(request: Request, unique_hash):
 
 @withdraw_ext.get("/api/v1/lnurl/cb/{unique_hash}", name="withdraw.api_lnurl_callback")
 async def api_lnurl_callback(
-    unique_hash, request: Request, k1: str = Query(...), pr: str = Query(...)
+    unique_hash, request: Request, k1: str = Query(...), pr: str = Query(...), id_unique_hash=None
 ):
     link = await get_withdraw_link_by_hash(unique_hash)
     now = int(datetime.now().timestamp())
@@ -58,21 +58,36 @@ async def api_lnurl_callback(
         )
 
     if link.is_spent:
-        raise HTTPException(status_code=HTTPStatus.OK, detail="Withdraw is spent.")
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="Withdraw is spent.")
 
     if link.k1 != k1:
-        raise HTTPException(status_code=HTTPStatus.OK, detail="Bad request.")
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="Bad request.")
 
     if now < link.open_time:
         return {"status": "ERROR", "reason": f"Wait {link.open_time - now} seconds."}
 
+    usescsv = ""
     try:
-        usescsv = ""
         for x in range(1, link.uses - link.used):
             usecv = link.usescsv.split(",")
             usescsv += "," + str(usecv[x])
         usecsvback = usescsv
-        usescsv = usescsv[1:]
+
+        found = False
+        if id_unique_hash is not None:
+            useslist = link.usescsv.split(",")
+            for ind, x in enumerate(useslist):
+                tohash = link.id + link.unique_hash + str(x)
+                if id_unique_hash == shortuuid.uuid(name=tohash):
+                    found = True
+                    useslist.pop(ind)
+                    usescsv = ','.join(useslist)
+            if not found:
+                raise HTTPException(
+                    status_code=HTTPStatus.NOT_FOUND, detail="LNURL-withdraw not found."
+                )
+        else:
+            usescsv = usescsv[1:]
 
         changesback = {
             "open_time": link.wait_time,
@@ -115,11 +130,11 @@ async def api_lnurl_multi_response(request: Request, unique_hash, id_unique_hash
 
     if not link:
         raise HTTPException(
-            status_code=HTTPStatus.OK, detail="LNURL-withdraw not found."
+            status_code=HTTPStatus.NOT_FOUND, detail="LNURL-withdraw not found."
         )
 
     if link.is_spent:
-        raise HTTPException(status_code=HTTPStatus.OK, detail="Withdraw is spent.")
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="Withdraw is spent.")
 
     useslist = link.usescsv.split(",")
     found = False
@@ -127,15 +142,16 @@ async def api_lnurl_multi_response(request: Request, unique_hash, id_unique_hash
         tohash = link.id + link.unique_hash + str(x)
         if id_unique_hash == shortuuid.uuid(name=tohash):
             found = True
+
     if not found:
         raise HTTPException(
-            status_code=HTTPStatus.OK, detail="LNURL-withdraw not found."
+            status_code=HTTPStatus.NOT_FOUND, detail="LNURL-withdraw not found."
         )
 
     url = request.url_for("withdraw.api_lnurl_callback", unique_hash=link.unique_hash)
     withdrawResponse = {
         "tag": "withdrawRequest",
-        "callback": url,
+        "callback": url + "?id_unique_hash=" + id_unique_hash,
         "k1": link.k1,
         "minWithdrawable": link.min_withdrawable * 1000,
         "maxWithdrawable": link.max_withdrawable * 1000,

lnbits/extensions/withdraw/templates/withdraw/index.html

@@ -132,7 +132,7 @@
                 <q-input filled dense v-model.trim="formDialog.data.title" type="text" label="Link title *"></q-input>
                 <q-input filled dense v-model.number="formDialog.data.min_withdrawable" type="number" min="10" label="Min withdrawable (sat, at least 10) *"></q-input>
                 <q-input filled dense v-model.number="formDialog.data.max_withdrawable" type="number" min="10" label="Max withdrawable (sat, at least 10) *"></q-input>
-                <q-input filled dense v-model.number="formDialog.data.uses" type="number" :default="1" label="Amount of uses *"></q-input>
+                <q-input filled dense v-model.number="formDialog.data.uses" type="number" max="250"  :default="1" label="Amount of uses *"></q-input>
                 <div class="row q-col-gutter-none">
                     <div class="col-8">
                         <q-input filled dense v-model.number="formDialog.data.wait_time" type="number" :default="1" label="Time between withdrawals *">
@@ -180,7 +180,7 @@
                 <q-select filled dense emit-value v-model="simpleformDialog.data.wallet" :options="g.user.walletOptions" label="Wallet *">
                 </q-select>
                 <q-input filled dense v-model.number="simpleformDialog.data.max_withdrawable" type="number" min="10" label="Withdraw amount per voucher (sat, at least 10)"></q-input>
-                <q-input filled dense v-model.number="simpleformDialog.data.uses" type="number" :default="1" label="Number of vouchers"></q-input>
+                <q-input filled dense v-model.number="simpleformDialog.data.uses" type="number" max="250" :default="1" label="Number of vouchers"></q-input>
 
                 <div class="row q-mt-lg">
                     <q-btn unelevated color="primary" :disable="

lnbits/extensions/withdraw/views_api.py

@@ -71,6 +71,11 @@ async def api_link_create_or_update(
     link_id: str = None,
     wallet: WalletTypeInfo = Depends(require_admin_key),
 ):
+    if data.uses > 250:
+        raise HTTPException(
+            detail="250 uses max.", status_code=HTTPStatus.BAD_REQUEST
+        )
+   
     if data.min_withdrawable < 1:
         raise HTTPException(
             detail="Min must be more than 1.", status_code=HTTPStatus.BAD_REQUEST