8000 X cashu refund by shroominic · Pull Request #44 · Routstr/proxy · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

X cashu refund #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

X cashu refund #44

wants to merge 4 commits into from

Conversation

shroominic
Copy link
Contributor

No description provided.

cursor[bot]
cursor bot reviewed Jun 19, 2025
View reviewed changes
Copy link
@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Authorization Parameter Overwritten

The auth parameter in the get_bearer_token_key function is immediately overwritten by re-reading the Authorization header from the request. This makes the passed auth parameter useless and can lead to incorrect behavior if the caller expects the provided value to be used.

router/proxy.py#L371-L373

proxy/router/proxy.py

Lines 371 to 373 in a287a73

# Handle regular bearer token authentication
auth = request.headers.get("Authorization", "")
bearer_key = auth.replace("Bearer ", "") if auth.startswith("Bearer ") else ""

Fix in Cursor

Bug: Cashu Refund: Balance Conversion & API Key Deletion Errors

The x_cashu_refund function has two bugs. First, key.balance (in millisatoshis) is passed directly to WALLET.send(), which expects satoshis. This unit mismatch, inconsistent with other wallet operations, could lead to sending 1000x the intended amount. The balance should be converted using key.balance // 1000. Second, the API key is deleted and the session committed before confirming the WALLET.send() operation's success, risking permanent balance loss if the send fails.

router/cashu.py#L205-L211

proxy/router/cashu.py

Lines 205 to 211 in a287a73

async def x_cashu_refund(key: ApiKey, session: AsyncSession) -> str:
async with WALLET_LOCK:
refund_token = await WALLET.send(key.balance)
await session.delete(key)
await session.commit()
return refund_token

Fix in Cursor

Bug: Missing Argument Causes Function Error

The validate_bearer_key function is called with only three arguments when processing the X-Cashu header in the proxy function. It expects four arguments: bearer_key, session, refund_address, and key_expiry_time. The omission of key_expiry_time will result in a TypeError.

router/proxy.py#L337-L338

proxy/router/proxy.py

Lines 337 to 338 in a287a73

if x_cashu := request.headers.get("X-Cashu", None):
key = await validate_bearer_key(x_cashu, session, "X-CASHU")

Fix in Cursor

BugBot free trial expires on July 22, 2025
You have used $0.00 of your $50.00 spend limit so far. Manage your spend limit in the Cursor dashboard.

Was this report helpful? Give feedback by reacting with 👍 or 👎

@9qeklajc
Copy link
Contributor
9qeklajc commented Jun 21, 2025 •
edited
Loading

maybe/not sure if it makes sense to also set the X-Cashu header when request failed:

  • fail to redeem
  • llm provider is down
  • ...

basically always send X-Cashu header even with status code different than 200, so the client can always redeem the token back to it's wallet .. without forcing client to collect pending payments

@sh1ftred sh1ftred added bug Something isn't working cashu labels Jul 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
bug Something isn't working cashu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@shroominic @9qeklajc @sh1ftred
0