jwinterm
1ce08560a2
security: harden admin auth, reconciler locking, and connection pooling
...
- Use secrets.compare_digest for timing-safe admin key comparison
- Strip whitespace from ADMIN_API_KEY env var
- Add PostgreSQL advisory locks per-invoice in reconciler to prevent
duplicate processing during deployments
- Add wallet-RPC retry with backoff (3 attempts: 0.5s, 1s, 2s)
- Raise MAX_SUBADDRESS_INDEX from 100 to 300
- Tune DB connection pool (pool_size=20, max_overflow=10, recycle=3600)
- Add 1-hour admin session timeout
- Regenerate UI lockfile
2026-03-15 10:49:24 -04:00
jwinterm
5f1154d363
Add admin panel for merchant management
...
- POST/GET/DELETE /api/admin/users endpoints
- Admin UI at /admin with login, user list, create/delete
- Auth via ADMIN_API_KEY env var (separate from tenant auth)
- Tenants remain scoped to their own store only
2026-03-10 11:24:38 -04:00
jwinterm
3eabad598d
Add OPEN_REGISTRATION gate, signup request form, favicon
2026-03-09 13:02:21 -04:00
jwinterm
a69d199fab
Switch rate provider from CoinGecko to Kraken
...
Kraken public API is free and doesn't require an API key.
Supports XMR/USD and XMR/EUR pairs.
2026-03-09 10:27:47 -04:00
xmrcheckout
39083eafb4
invoices: search by amount and refine archive copy
2026-01-09 14:01:02 +00:00
xmrcheckout
af60d1d4c6
Fix BTCPay webhook events and delivery
2026-01-08 17:50:09 +00:00
xmrcheckout
7bde17a3eb
Change default confirmation target to 1
2026-01-08 17:39:58 +00:00
xmrcheckout
6a3156991a
Add optional post-confirmation continue URL
2026-01-08 16:43:11 +00:00
xmrcheckout
6eb8d381c9
BTCPay: add paid/receipt flow and redirect support
2026-01-08 16:43:11 +00:00
xmrcheckout
b53f6dca21
Change default confirmation target to 2
2026-01-06 16:06:39 +00:00
xmrcheckout
d09d73a653
Set default invoice expiry to 60 minutes
2026-01-05 21:53:31 +00:00
xmrcheckout
3465c2054b
Add api
2026-01-04 16:26:37 +01:00
jwinterm