+
+
+ :options="onchainWalletOptions"
+ label="Onchain Wallet"
+ hint="Receive through SatsPay using an LNbits or Watchonly wallet"
+ >
+
+
+
+
+
label="Twitch Username *"
>
hint="The service you use for alerts. (Currently only Streamlabs)"
>
label="Client ID *"
>
>
Update Service
-
- Create Service
+ :disable="!serviceDialog.data.wallet || !serviceDialog.data.client_id || !serviceDialog.data.client_secret || !serviceDialog.data.twitchuser || onchainSelectionInvalid"
+ :label="serviceDialog.data.id ? 'Update Service' : 'Create Service'"
+ >
Cancel
diff --git a/tests/test_onchain.js b/tests/test_onchain.js
new file mode 100644
index 0000000..f4f17d8
--- /dev/null
+++ b/tests/test_onchain.js
@@ -0,0 +1,95 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const test = require('node:test')
+const vm = require('node:vm')
+
+function page(request, extensions = ['watchonly']) {
+ const context = {
+ window: {},
+ windowMixin: {},
+ Vue: {createApp: component => component},
+ Quasar: {date: {formatDate: () => ''}},
+ LOCALE: 'en',
+ _: {findWhere: (items, {id}) => items.find(item => item.id === id)},
+ LNbits: {api: {request}, utils: {notifyApiError: () => {}}}
+ }
+ vm.runInNewContext(
+ fs.readFileSync(path.join(__dirname, '../static/js/index.js'), 'utf8'),
+ context
+ )
+ const component = context.window.app
+ const state = {
+ ...component.data(),
+ ...component.methods,
+ g: {
+ user: {
+ extensions,
+ wallets: [{id: 'merchant', adminkey: 'admin', inkey: 'invoice'}]
+ }
+ }
+ }
+ for (const [name, get] of Object.entries(component.computed)) {
+ Object.defineProperty(state, name, {get: () => get.call(state)})
+ }
+ return state
+}
+
+test('discovery filters by SatsPay network and tolerates Watchonly failure', async () => {
+ const calls = []
+ const state = page(async (method, url, key) => {
+ calls.push([url, key])
+ if (url.endsWith('/settings/public')) return {data: {network: 'Mainnet'}}
+ if (url.endsWith('/onchain-wallets'))
+ return {
+ data: [
+ {id: 'main', name: 'Main', status: 'ready', network: 'Mainnet'},
+ {id: 'test', name: 'Test', status: 'ready', network: 'Testnet4'}
+ ]
+ }
+ throw new Error('Watchonly unavailable')
+ })
+
+ await state.getWalletLinks()
+ assert.deepEqual(
+ Array.from(state.onchainWalletOptions, option => option.value),
+ ['core:main']
+ )
+ assert.deepEqual(calls.slice(1), [
+ ['/satspay/api/v1/onchain-wallets', 'invoice'],
+ ['/watchonly/api/v1/config', 'invoice']
+ ])
+})
+
+test('editing the onchain choice keeps the existing service and does not submit its token', async () => {
+ const requests = []
+ const state = page(async (method, url, key, data) => {
+ requests.push({method, url, key, data})
+ return {data}
+ }, [])
+ state.services = [
+ {
+ id: 'service',
+ state: 'public-link',
+ wallet: 'merchant',
+ token: 'token',
+ client_id: 'client',
+ client_secret: 'secret',
+ servicename: 'Streamlabs',
+ twitchuser: 'streamer',
+ onchain: null
+ }
+ ]
+ state.updateserviceDialog('service')
+ state.serviceDialog.chain = true
+ state.serviceDialog.data.onchain = 'core:main'
+ state.coreOnchainWallets = [{id: 'main', status: 'ready'}]
+ await state.sendServiceData()
+
+ assert.equal(requests[0].method, 'PUT')
+ assert.equal(requests[0].url, '/streamalerts/api/v1/services/service')
+ assert.equal(requests[0].key, 'admin')
+ assert.equal(requests[0].data.onchain, 'core:main')
+ assert.equal(requests[0].data.token, undefined)
+ assert.equal(state.services.length, 1)
+})
diff --git a/tests/test_onchain.py b/tests/test_onchain.py
new file mode 100644
index 0000000..0240b79
--- /dev/null
+++ b/tests/test_onchain.py
@@ -0,0 +1,184 @@
+from datetime import datetime, timezone
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+import httpx
+import pytest
+from fastapi import FastAPI, HTTPException
+from lnbits.core.models import KeyType, User, Wallet, WalletTypeInfo
+
+from .. import crud, views_api
+from ..models import ChargeStatus, CreateService, Service
+
+TIME = datetime(2025, 1, 1, tzinfo=timezone.utc)
+
+
+@pytest.fixture
+def merchant(monkeypatch):
+ wallet = Wallet(
+ id="merchant",
+ name="Donations",
+ user="owner",
+ adminkey="admin",
+ inkey="invoice",
+ created_at=TIME,
+ updated_at=TIME,
+ )
+ chain = wallet.model_copy(
+ update={"id": "chain", "wallet_type": "onchain", "onchain_network": "Testnet4"}
+ )
+ user = User(id="owner", wallets=[wallet, chain], created_at=TIME, updated_at=TIME)
+ monkeypatch.setattr(views_api, "get_user", AsyncMock(return_value=user))
+ monkeypatch.setattr(views_api, "get_wallet", AsyncMock(return_value=wallet))
+ return WalletTypeInfo(KeyType.admin, wallet)
+
+
+@pytest.fixture
+def service(monkeypatch):
+ service = Service(
+ id="service",
+ state="public-link",
+ twitchuser="streamer",
+ client_id="client",
+ client_secret="secret",
+ wallet="merchant",
+ servicename="Streamlabs",
+ authenticated=True,
+ token="token",
+ onchain="watchonly-id",
+ )
+ monkeypatch.setattr(views_api, "get_service", AsyncMock(return_value=service))
+ return service
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("edit", [False, True])
+@pytest.mark.parametrize(
+ "wallet, reference, status",
+ [
+ ("merchant", "core:chain", 400),
+ ("merchant", "core:foreign", 403),
+ ("foreign", "core:chain", 403),
+ ],
+)
+async def test_invalid_wallet_cannot_be_saved(
+ monkeypatch, merchant, service, edit, wallet, reference, status
+):
+ monkeypatch.setattr(
+ views_api, "get_satspay_network", AsyncMock(return_value="Mainnet")
+ )
+ save = AsyncMock()
+ monkeypatch.setattr(views_api, "create_service", save)
+ monkeypatch.setattr(views_api, "update_service", save)
+ data = CreateService.model_validate(
+ {**service.model_dump(), "wallet": wallet, "onchain": reference}
+ )
+ with pytest.raises(HTTPException) as exc:
+ if edit:
+ await views_api.api_update_service(service.id, data, merchant)
+ else:
+ await views_api.api_create_service(data, merchant)
+ assert exc.value.status_code == status
+ assert service.onchain == "watchonly-id"
+ save.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+ "reference, method",
+ [("core:chain", "GET"), ("watchonly-id", "POST"), (None, "POST")],
+)
+async def test_donation_checkout_and_paid_alert(
+ monkeypatch, merchant, service, reference, method
+):
+ service.onchain = reference
+ monkeypatch.setattr(
+ views_api, "get_satspay_network", AsyncMock(return_value="Testnet4")
+ )
+ save_service = AsyncMock(side_effect=lambda updated: updated)
+ monkeypatch.setattr(views_api, "update_service", save_service)
+ if reference == "core:chain":
+ service.onchain = "watchonly-id"
+ data = CreateService.model_validate(
+ {**service.model_dump(), "onchain": reference}
+ )
+ await views_api.api_update_service(service.id, data, merchant)
+ assert (service.state, service.token, service.authenticated) == (
+ "public-link",
+ "token",
+ True,
+ )
+
+ app = FastAPI()
+ app.include_router(views_api.streamalerts_api_router, prefix="/streamalerts")
+ create_charge = AsyncMock(return_value="charge")
+ create_donation = AsyncMock()
+ monkeypatch.setattr(views_api, "btc_price", AsyncMock(return_value=100_000))
+ monkeypatch.setattr(views_api, "create_charge", create_charge)
+ monkeypatch.setattr(views_api, "create_donation", create_donation)
+ monkeypatch.setattr(
+ views_api,
+ "get_donation",
+ AsyncMock(return_value=SimpleNamespace(id="charge", wallet="merchant")),
+ )
+ get_status = AsyncMock(
+ side_effect=[
+ ChargeStatus(id="charge", paid=False),
+ ChargeStatus(id="charge", paid=True),
+ ]
+ )
+ post = AsyncMock(return_value={"sent": True})
+ monkeypatch.setattr(views_api, "get_charge_status", get_status)
+ monkeypatch.setattr(views_api, "post_donation", post)
+ async with httpx.AsyncClient(
+ transport=httpx.ASGITransport(app), base_url="http://test"
+ ) as client:
+ checkout = await client.post(
+ "/streamalerts/api/v1/donations",
+ json={"service": service.id, "sats": 1000},
+ )
+ assert checkout.json() == {"redirect_url": "/satspay/charge"}
+ webhook = "/streamalerts/api/v1/postdonation"
+ # SatsPay sends a JSON body without a content type on GET.
+ payload = '{"id":"charge","paid":true}'
+ assert (
+ await client.request(method, webhook, content=payload)
+ ).status_code == 400
+ post.assert_not_awaited()
+ paid = await client.request(method, webhook, content=payload)
+ assert paid.json() == {"sent": True}
+ assert paid.headers["Cache-Control"] == "no-store"
+
+ assert create_charge.await_args is not None
+ assert create_charge.await_args.kwargs["data"]["onchainwallet"] == reference
+ assert create_charge.await_args.kwargs["api_key"] == "invoice"
+ assert create_donation.await_args is not None
+ assert create_donation.await_args.kwargs["donation_id"] == "charge"
+ get_status.assert_awaited_with("charge", "invoice")
+ post.assert_awaited_once_with("charge")
+
+
+@pytest.mark.asyncio
+async def test_failed_streamlabs_delivery_leaves_donation_unposted(
+ monkeypatch, service
+):
+
+ donation = SimpleNamespace(
+ posted=False,
+ service=service.id,
+ name="Donor",
+ message="",
+ amount=1,
+ cur_code="USD",
+ )
+ monkeypatch.setattr(crud, "get_donation", AsyncMock(return_value=donation))
+ monkeypatch.setattr(crud, "get_service", AsyncMock(return_value=service))
+ save = AsyncMock()
+ monkeypatch.setattr(crud.db, "execute", save)
+ client = httpx.AsyncClient
+ transport = httpx.MockTransport(lambda request: httpx.Response(503))
+ monkeypatch.setattr(crud.httpx, "AsyncClient", lambda: client(transport=transport))
+
+ with pytest.raises(httpx.HTTPStatusError):
+ await crud.post_donation("charge")
+ save.assert_not_awaited()
diff --git a/views_api.py b/views_api.py
index db82960..457dbee 100644
--- a/views_api.py
+++ b/views_api.py
@@ -1,6 +1,7 @@
from http import HTTPStatus
-from fastapi import APIRouter, Depends, HTTPException, Query, Request
+import httpx
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, Response
from fastapi.responses import RedirectResponse
from lnbits.core.crud import get_user, get_wallet
from lnbits.core.models import WalletTypeInfo
@@ -22,19 +23,24 @@
update_donation,
update_service,
)
-from .helpers import create_charge, delete_charge, get_charge_status
+from .helpers import (
+ create_charge,
+ delete_charge,
+ get_charge_status,
+ get_satspay_network,
+)
from .models import CreateDonation, CreateService, Donation, Service, ValidateDonation
streamalerts_api_router = APIRouter()
-@streamalerts_api_router.post(
- "/api/v1/services", dependencies=[Depends(require_admin_key)]
-)
-async def api_create_service(data: CreateService) -> Service:
+@streamalerts_api_router.post("/api/v1/services")
+async def api_create_service(
+ data: CreateService, key_info: WalletTypeInfo = Depends(require_admin_key)
+) -> Service:
"""Create a service, which holds data about how/where to post donations"""
- service = await create_service(data)
- return service
+ await _validate_service_wallets(data, key_info.wallet.user)
+ return await create_service(data)
@streamalerts_api_router.get("/api/v1/getaccess/{service_id}")
@@ -121,7 +127,22 @@ async def api_create_donation(data: CreateDonation, request: Request):
"onchainwallet": service.onchain,
"user": wallet.user,
}
- charge_id = await create_charge(data=create_charge_data, api_key=wallet.inkey)
+ try:
+ charge_id = await create_charge(data=create_charge_data, api_key=wallet.inkey)
+ except Exception as exc:
+ if (
+ isinstance(exc, httpx.HTTPStatusError)
+ and exc.response.status_code == HTTPStatus.BAD_REQUEST
+ ):
+ try:
+ detail = exc.response.json().get("detail")
+ except (ValueError, AttributeError):
+ detail = None
+ if isinstance(detail, str):
+ raise HTTPException(HTTPStatus.BAD_REQUEST, detail=detail) from exc
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_GATEWAY, detail="Unable to create payment."
+ ) from exc
await create_donation(
data=data,
wallet=service.wallet,
@@ -131,11 +152,13 @@ async def api_create_donation(data: CreateDonation, request: Request):
return {"redirect_url": f"/satspay/{charge_id}"}
+@streamalerts_api_router.get("/api/v1/postdonation")
@streamalerts_api_router.post("/api/v1/postdonation")
-async def api_post_donation(data: ValidateDonation):
+async def api_post_donation(data: ValidateDonation, response: Response):
"""Post a paid donation to Stremalabs/StreamElements.
This endpoint acts as a webhook for the SatsPayServer extension."""
+ response.headers["Cache-Control"] = "no-store"
donation_id = data.id
donation = await get_donation(donation_id)
if not donation:
@@ -147,8 +170,13 @@ async def api_post_donation(data: ValidateDonation):
assert wallet, f"Could not fetch wallet: {donation.wallet}"
charge = await get_charge_status(donation_id, wallet.inkey)
- if charge and charge.paid:
- return await post_donation(donation_id)
+ if charge.id == donation.id and charge.paid:
+ try:
+ return await post_donation(donation_id)
+ except httpx.HTTPError as exc:
+ raise HTTPException(
+ HTTPStatus.BAD_GATEWAY, detail="Unable to deliver the stream alert."
+ ) from exc
else:
raise HTTPException(
status_code=HTTPStatus.BAD_REQUEST, detail="Not a paid charge!"
@@ -229,6 +257,7 @@ async def api_update_service(
status_code=HTTPStatus.FORBIDDEN, detail="Not your service."
)
+ await _validate_service_wallets(data, key_info.wallet.user, service.onchain)
for k, v in data.model_dump().items():
setattr(service, k, v)
@@ -274,3 +303,30 @@ async def api_delete_service(
donations = await delete_service(service_id)
for d in donations:
await delete_charge(d, key_info.wallet.adminkey)
+
+
+async def _validate_service_wallets(
+ data: CreateService, owner_id: str, saved_onchain: str | None = None
+) -> None:
+ user = await get_user(owner_id)
+ if not user or data.wallet not in user.wallet_ids:
+ raise HTTPException(HTTPStatus.FORBIDDEN, detail="Not your wallet.")
+ if not data.onchain or data.onchain == saved_onchain:
+ return
+ if not data.onchain.startswith("core:"):
+ return
+ wallet = user.get_wallet(data.onchain.removeprefix("core:"))
+ if not wallet or not wallet.is_onchain_wallet:
+ raise HTTPException(HTTPStatus.FORBIDDEN, detail="Not your onchain wallet.")
+
+ try:
+ network = await get_satspay_network()
+ except (httpx.HTTPError, ValueError, KeyError, TypeError) as exc:
+ raise HTTPException(
+ HTTPStatus.BAD_GATEWAY, detail="Unable to load the SatsPay network."
+ ) from exc
+ if (wallet.onchain_network or "Mainnet") != network:
+ raise HTTPException(
+ HTTPStatus.BAD_REQUEST,
+ detail=f"Select an onchain wallet on the SatsPay network ({network}).",
+ )