Skip to content

Cursor/restore by mnemonic 9650 - #15

Merged
nghiacc merged 5 commits into
mainfrom
cursor/restore-by-mnemonic-9650
Oct 14, 2026
Merged

nghiacc merged 5 commits into
mainfrom
cursor/restore-by-mnemonic-9650

Conversation

@nghiacc

@nghiacc nghiacc commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

restore by mnemonic without wallet id.

cursoragent and others added 5 commits October 9, 2026 12:54
Address still-valid security and correctness issues: relay coin/auth,
identity PoP ownership, PSBT signature integrity and CAS writes,
client verification fail-closed join records and required SendIntent,
payment verification by txid, token metadata no node fallback, PayJoin
fee-rate cap, and R10 scoped to spent inputs.

Co-authored-by: nghiacc <nghiacc@yahoo.com>
Users should not need a wallet ID: derive candidate xpubs/copayerIds
from the recovery phrase (including XEC 899/1899/145 variants), look
them up in the server DB, and re-attach. Align copayerId with BWC
sha256(coin+xpub) so migrated Pi wallets authenticate correctly.

Co-authored-by: nghiacc <nghiacc@yahoo.com>
Preserve envelope/PSBT columns from the Pi dump so db:push does not
prompt for destructive drops on deploy.

Co-authored-by: nghiacc <nghiacc@yahoo.com>
…tore

- Keep full main + PR13 v5/token/DER-auth stack on restore branch
- Materialize 0..address_index-1 and 0..change_address_index-1 addresses
  so migrated v1 wallets expose their historical addresses/funds and do
  not skip m/0/0 when restored by mnemonic only

Co-authored-by: nghiacc <nghiacc@yahoo.com>
Wallet detail was rendering stale context balance (0 after restore)
while tokens came from a fresh /balance call. Use the loaded spendable
amount, refresh balances when wallets are added, and disable nginx/
proxy buffering on notification SSE so status leaves Connecting.

Co-authored-by: nghiacc <nghiacc@yahoo.com>
@coderabbitai

coderabbitai Bot commented Oct 14, 2026

Copy link
Copy Markdown

Review in Change Stack →

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 48bf9d3d-96e1-4a19-8efd-3debba8498f0
📥 Commits

Reviewing files that changed from the base of the PR and between d3b1674 and e0d0a45.

📒 Files selected for processing: 29
  • apps/abcpay-api/src/middleware/auth.ts
  • apps/abcpay-api/src/routes.ts
  • apps/abcpay-api/src/scripts/staging-e2e.ts
  • apps/abcpay-api/src/services/address.service.ts
  • apps/abcpay-api/src/services/envelope.service.ts
  • apps/abcpay-api/src/services/psbt.service.ts
  • apps/abcpay-api/src/services/wallet.service.ts
  • apps/abcpay-web/src/context/WalletContext.tsx
  • apps/abcpay-web/src/lib/api.ts
  • apps/abcpay-web/src/lib/envelopes.ts
  • apps/abcpay-web/src/lib/payjoin.ts
  • apps/abcpay-web/src/lib/payment-requests.ts
  • apps/abcpay-web/src/lib/proposal-verify.ts
  • apps/abcpay-web/src/lib/tx.ts
  • apps/abcpay-web/src/lib/wallet-client.ts
  • apps/abcpay-web/src/pages/RestorePage.tsx
  • apps/abcpay-web/src/pages/TokenSendPage.tsx
  • apps/abcpay-web/src/pages/WalletDetailPage.tsx
  • packages/abcpay-models/src/coins.ts
  • packages/abcpay-wallet-core/src/__tests__/auth.test.ts
  • packages/abcpay-wallet-core/src/__tests__/crypto.test.ts
  • packages/abcpay-wallet-core/src/__tests__/payjoin.test.ts
  • packages/abcpay-wallet-core/src/__tests__/verify.test.ts
  • packages/abcpay-wallet-core/src/auth.ts
  • packages/abcpay-wallet-core/src/chronik.ts
  • packages/abcpay-wallet-core/src/keys.ts
  • packages/abcpay-wallet-core/src/payjoin.ts
  • packages/abcpay-wallet-core/src/verify.ts
  • scripts/lan-web-server.js
 ______________________________________________________________________________________________________________________________________________________________
< Find bugs once. Once a human tester finds a bug, it should be the last time a human tester finds that bug. Automatic tests should check for it from then on. >
 --------------------------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@nghiacc
nghiacc merged commit 8821683 into main Oct 14, 2026
1 of 2 checks passed
@nghiacc
nghiacc deleted the cursor/restore-by-mnemonic-9650 branch October 14, 2026 12:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants