BTCPay Server

Include configuration for tax on tips (#7298)

* Include configuration for tax on tips

* Ensure null and 0 result in no tip tax

* mirroring tax in tip scenario in CanUsePOSKeypad.

* Format tip tax receipt

* Update

* fix coderabbit suggestion

* Include tip tax to report, and remove tax from product information

Remove recovery codes

Add loginless and passwordless passkey authentication

feat: allow max stores per user (#7320)

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

Unnest UI views of PullRequests, PullPayments, Invoices and Apps (#7368)

Allows merchants configure tax inclusion or exclusion (#7290)

* Allows merchants configure tax inclusion or exclusion

* fix typo

* Include tests plus populate invoice metadata with tax included

* resolve failing test with view model

* fix: Form amount diff is misclassified as tax-included

* rerun build

* removed @ from the tax helper text

Server-side translation manager: install, update, and remove language packs from the BTCPay UI (#7347)

* refactor : change dictionary/ies to translation/s

* migrate LanguagePackUpdateService to manifest-based fetching

* refactor : translations UI

* test : add tests

* fix : coderabbit comments

* fix(translations): verify downloaded language pack SHA-256 against manifest

LanguagePackUpdateService.FetchLanguagePackFromRepository previously
returned the manifest's Sha field as the version without ever hashing
the downloaded translation content. The manifest's Sha is SHA-256 of
the source file content, but the value was never compared against the
download, allowing a tampered or corrupted file that still parses as
valid JSON to be saved as a valid language pack.

This change downloads the file as bytes, computes SHA-256, and compares
case-insensitive against the expected Sha from the manifest. On
mismatch, throws InvalidOperationException so the controller's existing
error path returns a user-visible failure instead of silently writing
bad data.

Add LanguagePackUpdateService_RejectsLanguagePackOnShaMismatch test
covering the rejection path. Update the existing
LanguagePackUpdateService_FetchesLanguagePackFromManifest test to use
the actual SHA-256 of the test fixture so the happy path also exercises
the new verification step.

* fix(translations): preserve all old /server/dictionaries paths via catchall

The previous backward-compat shim only handled GET /server/dictionaries
with a single redirect; the seven other old routes (create, edit by id,
select, delete, download) returned 404 under the new controller. The PR
description's promise to "preserve existing integrations and prevent
breaking changes for legacy clients" therefore did not match what was
shipped.

Replace the single-route redirect with a catchall route that captures
any /server/dictionaries/* subpath and 308-permanent-redirects to the
equivalent /server/translations/* URL, preserving the HTTP method (so
POST clients re-POST to the new endpoint instead of degrading to GET).
The existing GET /server/dictionaries handler stays for the bare list
URL.

Also remove the redundant DeleteTranslation action: both it and
UninstallLanguagePack POST routes called localizer.DeleteTranslation
with identical TempData; only UninstallLanguagePack is referenced from
the view. Keep the named route the view uses, drop the dead one.

* fix(translations): restore typed-confirmation modal for Uninstall

ListDictionaries.cshtml had a _Confirm modal requiring the user to
type "Delete" to enable the destructive action; the new
ListTranslations.cshtml replaced it with a single-click submit button
that fired immediately on click. Custom translation packs are
irreversible without re-import and may represent hours of user-edited
entries; one accidental click on the wrong row was enough to lose them.

Restore the typed-confirmation modal pattern used elsewhere in
UIServer (LndSeedBackup, ListUsers, SSHService): replace the inline
form with a link that opens #ConfirmModal, supplying the per-row
description and the "Delete" confirm-input. Add the _Confirm partial
at the end of the view.

Restore the corresponding two test steps in the Playwright integration
test: ConfirmInput.FillAsync("Delete") + ConfirmContinue.ClickAsync()
between the row-Delete click and the alert-message assertion.

* fix(translations): manifest fetch back-off, narrow exception, more tests

Three small fixes on the LanguagePackUpdateService surface:

1. Back-off on manifest fetch failure. Under sustained upstream
outage, every translations-page hit was retrying the manifest
URL because FetchManifest only cached on success. Add a 60-second
back-off after any fetch failure: subsequent calls within the
window throw immediately, which the existing GetManifestLanguages
degraded path translates to a graceful empty response. Stops
the retry hammer without changing the steady-state contract.

2. Narrow the catch in CheckForLanguagePackUpdate. The broad
catch (Exception) loses information about why an update check
fails. Narrow to the four exception types we actually expect to
silence: HttpRequestException, TaskCanceledException,
InvalidOperationException (manifest-back-off + missing-Languages),
and Newtonsoft.Json.JsonException. Programming errors and
unexpected runtime faults bubble up instead of silently
producing "no update available."

3. Three more unit tests filling test coverage gaps:
- LanguagePackUpdateService_ReturnsDegradedModeOnMalformedManifest
covers the JsonReaderException path through the degraded mode.
- LanguagePackUpdateService_ReturnsDegradedModeOnMissingLanguagesKey
covers the InvalidOperationException for a manifest payload
without the expected Languages array.
- LanguagePackUpdateService_ThrowsArgumentExceptionForUnknownLanguage
covers the FetchLanguagePackFromRepository unknown-language
path.

All 8 unit tests pass on .NET 10 RC.2; build clean.

* fix(translations): server-side uninstall guards + duplicate-name tolerance + casing

Address CodeRabbit re-review findings on the previous iteration:

1. UninstallLanguagePack endpoint now validates server-side instead of
relying solely on the UI hiding the Uninstall button. A crafted POST
to /server/translations/{translation}/uninstall could otherwise
delete any translation, including built-in defaults or the currently
selected one. Now: NotFound if the translation does not exist; an
error TempData message if Source != "Custom" or if the translation
is currently selected as the server's display language. The localizer
call only fires when all three guards pass.

2. ListTranslations manifest indexing uses TryAdd instead of
ToDictionary. The previous .ToDictionary call would throw
ArgumentException if upstream manifest contained duplicate or
case-variant Name values, breaking the translations page hard
instead of degrading gracefully. First-wins semantics keep the page
functional even on a malformed upstream payload.

3. CheckForLanguagePackUpdate compares the remote and local SHA hex
strings case-insensitively. The corresponding compare in
FetchLanguagePackFromRepository was already case-insensitive; this
aligns the update-check path with the verification path.

4. SetTranslation test helper asserts the translation is non-null
before saving. Failure mode is now local to the helper rather than
surfacing as a confusing NullReferenceException downstream when
fixture setup changes.

Build clean, 8/8 unit tests pass on .NET 10 RC.2.

* fix(translations): NicolasDorier review pass

- Drop the Translator/ URL prefix from RawBaseUrl. The upstream
fix for issue #7341 in btcpayserver-translator removed the
Translator/translations symlink redirect; raw.githubusercontent.com
does not follow symlinks for file requests, so the existing
RawBaseUrl pointed at a 404. Now resolves against
main/translations/<file>.json directly.
- GetManifestLanguages no longer swallows exceptions. Returns the
entry array directly; caller (UITranslationController) wraps in
try/catch and sets degradedMode locally.
- Drop unused server-side GetAvailableLanguages.
- Cache the parsed LanguageManifestEntry[] for 1 hour so repeat
Translations page hits skip both the http call and the JSON
projection.
- Tests updated to match the new signature + URL.

* fix : coderabbit comment

* little UI fix

* fix(translations): NicolasDorier round-2 review - IMemoryCache + Newtonsoft deserialization

Address Nicolas's 5 inline comments on LanguagePackUpdateService.cs
(PR #7347, head d1f8d3c):

- Replace manual JObject field-picking in ToManifestEntry with
Newtonsoft deserialization to a typed DTO (ManifestLanguageDto +
ManifestRootDto). Maintainer "handle|url" split + Updated parse
live in a single static factory LanguageManifestEntry.FromDto.
Public API of LanguageManifestEntry unchanged (Name, Native,
MaintainerHandle, MaintainerUrl, Updated as DateTimeOffset?,
File, Sha) so callers (UITranslationController) need no edit.
- Collapse the two hand-rolled tuple caches (_manifestCache,
_entriesCache), the SemaphoreSlim _manifestLock, and the
_manifestNextFetchAllowedAt failure-backoff field into a single
IMemoryCache entry keyed "translations.manifest" with a 1h
absolute expiration. The per-language _updateCheckCache
ConcurrentDictionary moves to the same IMemoryCache for
consistency, keyed "translations.update.<language>".
- Drop the 60s failure backoff. If GitHub raw is down, surface
the error per-request rather than holding a sticky-error
window. Faster recovery, no fake-error responses when the
remote has already recovered.

Service constructor now takes (IHttpClientFactory, IMemoryCache);
IMemoryCache is already registered globally via
Startup.AddMemoryCache(), so DI wiring needs no change.

File drops from ~200 to ~140 lines. 8/8 LanguagePackUpdateService
unit tests pass; tests updated to pass a MemoryCache instance.

* fix : differentiation between languagepack and custom

* chore : update default translations

* update translation text

---------

Co-authored-by: r1ckstardev <r1ckstardev@users.noreply.github.com>
Co-authored-by: rockstardev <rockstar@btcpayserver.org>

Allow server admin to specify if an invited user subscribes for monetization or not (#7318)

* Option for server-invited users to bypass subscription

* fix code rabbit and include tests

* fix coderabbit test suggestion

* allow for skipping monetization on invite

* code rabbit suggestion

* clean up

* resolve redundant code

* remove view data

* resolve feedback from Nicolas

* restore tests that was removed

Add granular API permissions for on-chain wallets (#7357)

* refactor(wallets): align greenfield routes with wallet policies

* fix(wallets): keep payjoin psbt unfinalized before request

Move Wallet ViewModels (#7355)

Ensure the seed isn't leaking to user with can sign permission (#7354)

Add granular wallet permissions and move wallet to plugin (#7329)

feat: add separate CanSendStoreEmail permission for store email API (#7345)

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

Refactor: Add btcpay.impersonation.canimpersonate permission (#7327)

Remove support for importing keys to RPC (#7307)

Add LUD-21 (LNURL-pay Verify) support (#7250)

* Add LUD-21 (LNURL-pay Verify) support

Implements the LUD-21 verify endpoint for Lightning Address payments,
enabling external services to verify payment settlement without
authentication.

Changes:
- New GET /lnurlp/{username}/verify/{paymentHash} endpoint
- Callback response includes verify URL when LUD-21 is enabled
- Payment hashes indexed in search data for efficient lookup
- LUD21Enabled toggle in LNURL payment method config (default: true)
- Settings UI toggle matching LUD-12 pattern
- Swagger API docs updated

Closes #7248

* Use case-insensitive comparison for payment hash in LUD-21 verify

* Address Nicolas review: use AddressInvoices instead of AdditionalSearchTerms

- Replace AddSearchTerms with AddAddressInvoice for payment hash indexing
- Replace TextSearch lookup with GetInvoiceFromAddress in verify endpoint
- Add storeId validation on verify endpoint (cross-store isolation)
- Add payment hash to TrackedDestinations in LightningLikePaymentHandler
- Add rate limiting (ZoneLimits.Verify) to verify endpoint
- Add integration test for LUD-21 verify endpoint flow

* Remove rate limiting from LUD-21 verify endpoint

Rate limiting will be discussed and added in a follow-up.

* Fix verify endpoint: idempotent AddAddressInvoice, normalize payment hash

- Make AddAddressInvoice upsert to avoid duplicate key violations
on (Address, PaymentMethodId)
- Normalize payment hash to lowercase for consistent DB lookups
(store, query, and verify URL generation)

* test(LUD-21): properly exercise cross-store isolation in CanUseLUD21VerifyEndpoint

The previous storeId-isolation assertion did not actually validate the
intended behavior. store2 only had a Lightning Address configured, but
no Lightning node / LNURL payment method. The verify endpoint bails out
with 404 "Not available" at UILNURLController.cs:487-489 before
reaching the invoice-lookup / store-isolation check at L492-494, so the
old assertion would pass even if the isolation logic were broken.

Fix:
- Configure BTC-LN and BTC-LNURL (LUD21Enabled = true) on store2 via
UpdateStorePaymentMethod, mirroring what RegisterLightningNodeAsync
does for store1.
- Strengthen the assertion to also verify the response body's reason
is "Not found" rather than "Not available", proving the request
reached the actual store-isolation branch.

* feat(LUD-21): validate paymentHash is 64 hex chars before lookup

LnurlPayVerify previously accepted any non-empty paymentHash string and
only normalized casing. A Lightning payment hash is exactly 32 bytes /
64 hex characters, so reject anything else up front to avoid pointless
DB lookups on garbage input and return a consistent "Not found"
response shape.

* fix(LUD-21): standardize LnurlPayVerify not-found reason to "Not found"

LnurlPayVerify previously returned three different reason strings for
not-found cases ("Unknown username", "Not available", "Not found"),
which leaks information about which lookup branch failed and was flagged
in CodeRabbit review.

Collapse the username/store-resolution branches to a single "Not found"
reason. The LUD-21 feature-disabled branch keeps its distinct "Not
available" reason because that's a genuinely different operational
condition (feature off vs resource missing) and the new test relies on
the distinction to validate the cross-store isolation path.

* test(LUD-21): fix LN Address fetch path to use /.well-known/lnurlp/{username}

CanUseLUD21VerifyEndpoint was calling /lnurlp/{username} to fetch the
LNURL-pay request, but that path has no route. The actual LUD-16
Lightning Address resolver is published at /.well-known/lnurlp/{username}
(see ResolveLightningAddress in UILNURLController.cs and existing usage
in PlaywrightTests / TestAccount). The wrong path made the test fail at
the very first GET with 404, before the verify endpoint logic could be
exercised at all.

* fix(LUD-21): close TOCTOU race in AddAddressInvoice + harden preimage assertion

CodeRabbit followup:

1. AddAddressInvoice was check-then-insert, so two concurrent LNURL
callbacks for the same (Address, PaymentMethodId) could both observe
existing == null and both attempt to INSERT, causing the second one
to throw on the unique-key constraint. Wrap the insert path in
try/catch (DbUpdateException) and swallow the violation - both
writers are inserting identical data, so the operation is naturally
idempotent under contention. The update branch is kept on its own
SaveChangesAsync so failures there still propagate.

2. The preimage assertion in CanUseLUD21VerifyEndpoint was
Assert.Null(verifyResult["preimage"]?.ToString()), which depends on
how the global JSON serializer handles null values - if the field is
serialized as JSON null instead of being omitted, ToString() returns
the empty string and the assertion fails. Compare against the
JTokenType.Null sentinel directly so the test is robust to either
serializer mode.

* refactor(LUD-21): flush tracked payment hash via UpdatePrompt overload

Consolidates the two-call sequence in the LNURL callback (UpdatePrompt
followed by a separate AddAddressInvoice) into a single UpdatePrompt
call that accepts an optional trackedDestinations list and flushes
AddressInvoices rows inside the same DbContext transaction.

- Ensures the payment-hash index row is written atomically with the
prompt update so a crash between the two calls can no longer leave
the prompt persisted without its verify-lookup row.
- Keeps idempotency under concurrent LNURL callbacks (existing row
check + DbUpdateException swallow, matching AddAddressInvoice).
- Controller no longer reaches into the repository twice for a single
logical state transition.

No behavior change for existing UpdatePrompt callers (trackedDestinations
defaults to null).

* fix(LUD-21): split SaveChanges in UpdatePrompt, exclude concurrency from inner catch

Addresses both items from coderabbit review on dcfdf88:

1. DbUpdateConcurrencyException is a DbUpdateException subtype, so the
inner catch in the trackedDestinations flush would have silently
swallowed concurrency conflicts on the invoice row, breaking the
outer retry loop. Narrowed the inner catch with
'when (ex is not DbUpdateConcurrencyException)'.

2. Batching the prompt blob update and the AddressInvoices insert into
a single SaveChangesAsync meant a unique-key violation on the
tracked destination would roll back the entire unit of work and
silently drop the prompt blob update. Split into two
SaveChangesAsync calls: the blob update runs first and any error
propagates (concurrency still retries via the outer catch); the
tracked-destination flush runs after with its own scoped,
unique-key-only swallow.

* test(LUD-21): cover repeat-callback idempotency and hash validation

Adds three assertions inside the existing CanLNURLPayVerify integration test
to illustrate and guard the UpdatePrompt(trackedDestinations) refactor:

- Repeat LNURL callback with the SAME amount: exercises the idempotent
flush path where the AddressInvoices row for the payment hash already
exists. The second callback must return 200 and the verify endpoint
must still resolve the hash afterward (no duplicate row, no throw).

- Repeat LNURL callback with a DIFFERENT amount: a new payment hash is
minted. The new verify URL must resolve, proving the new hash is
indexed in AddressInvoices and the prompt blob transition persists.

- Verify endpoint with a malformed (non-hex / wrong-length) paymentHash
segment must return 404 with Reason 'Not found' at the 64-hex guard
before any DB lookup is performed.

* Address NicolasDorier review feedback on LUD-21

- Remove username from verify route (/lnurlp/verify/{paymentHash}),
look up store from invoice instead; enables verify for all LNURL,
not only Lightning Address
- Replace EF check-then-act in AddressInvoices with SQL INSERT ON
CONFLICT DO NOTHING (single roundtrip, no partial-dup DbContext
corruption)
- Remove IgnoreAntiforgeryToken on GET route
- Remove payment hash tracking from LightningLikePaymentHandler
(only needed for LNURL path, already handled in UILNURLController)
- Standardize all error responses to "Not found"
- Simplify tests: drop cross-store-via-username and unknown-username
checks (no longer applicable without username in route)

* Address NicolasDorier review: guard trackedDestinations on LUD21Enabled, deduplicate AddressInvoices upsert

- trackedDestinations is now null when LUD21 is not enabled, preventing
unnecessary AddressInvoices rows for stores that don't use verify.
- Extract UpsertAddressInvoice helper to eliminate the duplicated INSERT
SQL across AddAddressInvoice, UpdatePrompt, and NewPaymentPrompt.

---------

Co-authored-by: r1ckstardev <r1ckstardev@users.noreply.github.com>
Co-authored-by: r1ckstardev <me@r0ckstar.dev>

PoS: Any store users can now generate a login QR any other store user (#7303)

PoS: Unpermissioned store users can browse login links and invoices from Update PoS page (#7305)

feat: add manual subscription date editing for admins (#7257)

* feat: add manual subscription date editing for admins

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

* refactor: Address code review feedback on subscription date editing

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

* refactor: Use DateOnly params and normalize to UTC for date editing

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

* refactor: added tests and API route

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

* refactor: addressed coding suggestions

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

* refactor: added null check

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

* docs: updated swagger todocument manual subscription date editing

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>

* Slight adjustment

---------

Signed-off-by: Abhijay Jain <Abhijay007j@gmail.com>
Co-authored-by: Nicolas Dorier <nicolas.dorier@gmail.com>

Dev: Helps Rider to find Layouts properly (#7283)

fix(email): skip SMTP AUTH when Login and Password are empty (fixes #7267) (#7269)

When SMTP is configured via IP relay (e.g. Google Workspace relay) without
login credentials, BTCPay still calls AuthenticateAsync if the server
advertises AUTH capability, causing 535 errors.

Skip authentication when both Login and Password are empty.

Co-authored-by: Storm Knight <storm-knight@openclaw.ai>

Allow upgrade/downgrade of a subscription at period end

fix: Cross-store privilege escalation to approved pull payments/payouts in GreenfieldPullPaymentController (#7244)

Co-authored-by: Cerberus Merlin <merlin@cerberus.security>

fix: Broken Access Control: Private form access and invoice creation on other stores via unscoped authorization check (#7236)

Co-authored-by: Cerberus Merlin <merlin@cerberus.security>

Include API key - permission analysis for improved security (#6771)

* Include API key - permission analysis for improved security

resolve codderbyte

Remove designer class

fix review feedback

include text translate

avoid string parsion and use Permission directly

use permission against string

include translation and update selecte stores

Include tests for api key permission edit and usage

.Update api key analysis page

include test

delete key usage when deleting api key

* update layout and delete query