BTCPay Server

This commit is a simple user-interface fix: it moves a checkbox setting ('Disable zero amount invoices') so it appears in the correct section of the Point of Sale settings page. The setting was previously only shown under the 'Keypad' section, but it should be visible for all Point of Sale types. There is no security issue here.

This commit adds a new optional setting for BTCPay Server's Point of Sale (PoS) app that lets store owners block invoices with a zero total amount. Previously, a customer could complete a checkout flow that created an invoice worth nothing, which could be used to generate fake or confusing payment records, test transactions, or possibly abuse downstream systems that expect only paid invoices. The change is a defensive feature, not a fix for a known active attack, and it is disabled by default.

This commit introduces a new Greenfield (REST) Subscription API to BTCPay Server, allowing stores to manage subscription offerings, plans, subscribers, credits, and checkout sessions programmatically. It also refactors existing subscription internals, adds new permissions, and makes small related fixes such as handling empty URL paths and adding a null check for invoice IDs. There is no explicit security bug in the diff, but the large new attack surface and a few design choices warrant careful review.

This commit simply renames two permission strings from 'membership' to 'offerings' across the codebase. It is a non-functional refactor that updates labels, constants, authorization checks, and API documentation to match the new terminology. There is no security-relevant change.

This is a large feature commit titled 'Monetization' that adds subscription and paid-access functionality to BTCPay Server. It introduces new plugins for monetization and subscriptions, changes how user login restrictions are enforced, adds a 'limited login' authentication scheme, and refactors user registration/invitation email flows. The changes touch authentication, authorization, billing, and user lifecycle logic. While the commit is framed as a feature, several areas have security implications: a new limited-login path that signs users in under a separate scheme when normal login is blocked, changes to password-reset and invitation-token handling, and new database entities for plans/subscribers/portal sessions. No explicit security bug is visible in the diff, but the breadth and sensitivity of the modified code means defects could have significant consequences.

This commit fixes a UI bug where BTCPay Server was showing a 'Create a new wallet' button to users who did not have permission to create wallets. The button itself was just a link; the actual wallet creation endpoint still enforced permissions separately. So the fix is about hiding an option that shouldn't appear, not about blocking an unauthorized action. It is a defense-in-depth or user-experience security improvement rather than a critical vulnerability.

This commit refactors how BTCPay Server decides whether a user is allowed to log in. It replaces a simple built-in check with a new extensible system where plugins can add their own login-blocking rules. The change touches password logins, two-factor/FIDO2/LNURL logins, API key authentication, and basic HTTP authentication. It also fixes a small bug in basic authentication where the password was checked before the user was validated. There is no claim in the commit that this fixes a known security vulnerability, and no CVE or advisory is referenced.

This is a large internal refactoring of how BTCPay Server's web UI tracks which navigation menu item is active. It replaces scattered, string-based helpers with a single LayoutModel and a new Razor tag helper. There is no obvious security vulnerability in the change; it is primarily code cleanup and test updates to match the new HTML IDs.

This commit standardizes the wording and behavior of delete-confirmation dialogs across the BTCPay Server web interface. Previously, different screens asked users to type different words such as "DELETE" or "REMOVE" to confirm deletion. Now every confirmation prompt uses the same word, "Delete," and the check is case-insensitive. This is a user-experience and consistency improvement, not a fix for a security vulnerability.

This is a large refactoring commit that moves BTCPay Server's webhook and email-rule features into separate plugin areas and introduces a new database-backed email-rule system with JSONPath-based conditions. The changes are primarily structural: code is relocated, controllers are renamed, and a new TextTemplate helper is added for email interpolation. There is no explicit security fix or vulnerability disclosure in the commit message or diff, and no direct evidence of an exploitable bug is visible in the supplied materials.

This commit improves error messages shown to users when a Bitcoin transaction file (PSBT) cannot be signed because it is malformed or missing required data. It does not change the underlying signing rules; it only reports failures more clearly and redirects the user to an analysis view instead of attempting to sign an invalid PSBT. There is no direct evidence this fixes an exploitable vulnerability.