AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 29 Bitcoin

[Feature] Store-scoped labels + linkedType-scoped LabelManager suggestions (#7050)

Public commit record

What the developer wrote

Authored by thgO.O

91/100 · Strong
[Feature] Store-scoped labels + linkedType-scoped LabelManager suggestions (#7050)

* feat: allow label manager to scope suggestions by linked type

* fix: render unlabeled payment requests as "Unlabeled" in reports

* feat: apply linked type scoped labels to EditPaymentRequest view

* feat: add store-scoped label tables

* test: cover store-scoped label migration

* feat: add StoreLabelRepository

* feat: support store-scoped LabelManager

* refactor: payment requests use store-scoped labels

* fix: adapt ReservedAddresses to labelmanager event

* refactor: coderabbit nits

* refactor: type-scoped store labels schema with snake_case

* refactor: persist label colors as column

* refactor: cleanup label links and usage

* refactor: simplify label repository ops

* fix: secure label updates and ensure pgcrypto

* test: stabilize CanUpgradeAndDowngrade

* refactor: coderabbit nits

* feat: use snake_case schema and case-insensitive label merge

* test: add playwright coverage for store label casing

* refactor: use snake_case schema and indexed case-insensitive label lookups
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit refactors how BTCPay Server stores labels for payment requests, moving them from a wallet-based graph system into new store-scoped database tables. It also adds a new API endpoint for updating store-scoped labels. The changes are primarily a feature/refactoring effort, but they include security-relevant hardening such as CSRF token validation on the new update endpoint, a check that the target store exists and matches the route, and restrictions preventing deletion or renaming of reserved system label types. A migration copies existing payment-request labels into the new tables and removes the old wallet-graph entries.

Recommended action

No immediate action required; this is a feature/refactoring commit with defensive hardening. Reviewers should verify that the new UpdateStoreLabels endpoint enforces the intended authorization policy in all deployment configurations, that the anti-forgery token header name matches the server-side antiforgery configuration, and that the migration correctly handles large datasets and concurrent updates. Consider whether the StoreLabelsJson GET endpoint returning all store labels for a linked type could leak sensitive label names to any user with store access.

Security signals we found

01

New POST endpoint /stores/{storeId}/update-labels is protected with [Authorize(Policy = Policies.CanModifyStoreSettings)] and [ValidateAntiForgeryToken]

02

Client-side JS extracts and sends the anti-forgery token in the RequestVerificationToken header for label updates

03

Store-scoped label endpoints verify CurrentStore exists and matches the route storeId before acting

04

Delete/Rename payment-request label actions now reject reserved WalletObjectData.Types.AllTypes labels

05

Migration uses raw SQL but operates on existing data with ON CONFLICT DO NOTHING and parameterized Dapper queries in repository code

06

Label text is normalized, trimmed, and capped at 50 characters to limit injection surface

07

Case-insensitive unique index on store_id, type, lower(text) prevents duplicate label creation

Risk score

Why this scored 29/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.