bump

Handling unlikely state transition from paid to invalid

BTCPayServer.Tests/ChargeTester.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Text;
+using BTCPayServer.Payments.Lightning;
 using BTCPayServer.Payments.Lightning.Charge;
 using BTCPayServer.Payments.Lightning.CLightning;
 using NBitcoin;
@@ -15,7 +16,7 @@ namespace BTCPayServer.Tests
         {
             this._Parent = serverTester;
             var url = serverTester.GetEnvironment(environmentName, defaultValue);
-            Client = new ChargeClient(new Uri(url), network);
+            Client = (ChargeClient)LightningClientFactory.CreateClient(url, network);
             P2PHost = _Parent.GetEnvironment(environmentName + "_HOST", defaultHost);
         }        
         public ChargeClient Client { get; set; }

BTCPayServer.Tests/Lnd/LndMockTester.cs

@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+using BTCPayServer.Payments.Lightning.Lnd;
+using NBitcoin;
+
+namespace BTCPayServer.Tests.Lnd
+{
+    public class LndMockTester
+    {
+        private ServerTester _Parent;
+
+        public LndMockTester(ServerTester serverTester, string environmentName, string defaultValue, string defaultHost, Network network)
+        {
+            this._Parent = serverTester;
+            var url = serverTester.GetEnvironment(environmentName, defaultValue);
+
+            Swagger = new LndSwaggerClient(new LndRestSettings(new Uri(url)) { AllowInsecure = true });
+            Client = new LndInvoiceClient(Swagger);
+            P2PHost = _Parent.GetEnvironment(environmentName + "_HOST", defaultHost);
+        }
+
+        public LndSwaggerClient Swagger { get; set; }
+        public LndInvoiceClient Client { get; set; }
+        public string P2PHost { get; }
+    }
+}

BTCPayServer.Tests/Lnd/UnitTests.cs

@@ -0,0 +1,226 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+using System.Threading.Tasks;
+using BTCPayServer.Payments.Lightning;
+using BTCPayServer.Payments.Lightning.Lnd;
+using NBitcoin;
+using NBitcoin.RPC;
+using Xunit;
+using Xunit.Abstractions;
+using System.Linq;
+using System.Threading;
+using NBitpayClient;
+using System.Globalization;
+
+namespace BTCPayServer.Tests.Lnd
+{
+    // this depends for now on `docker-compose up devlnd`
+    public class UnitTests
+    {
+        private readonly ITestOutputHelper output;
+
+        public UnitTests(ITestOutputHelper output)
+        {
+            this.output = output;
+            initializeEnvironment();
+
+            MerchantLnd = new LndSwaggerClient(new LndRestSettings(new Uri("https://127.0.0.1:53280")) { AllowInsecure = true });
+            InvoiceClient = new LndInvoiceClient(MerchantLnd);
+
+            CustomerLnd = new LndSwaggerClient(new LndRestSettings(new Uri("https://127.0.0.1:53281")) { AllowInsecure = true });
+        }
+
+        private LndSwaggerClient MerchantLnd { get; set; }
+        private LndInvoiceClient InvoiceClient { get; set; }
+
+        private LndSwaggerClient CustomerLnd { get; set; }
+
+        [Fact]
+        public async Task GetInfo()
+        {
+            var res = await InvoiceClient.GetInfo();
+            output.WriteLine("Result: " + res.ToJson());
+        }
+
+        [Fact]
+        public async Task CreateInvoice()
+        {
+            var res = await InvoiceClient.CreateInvoice(10000, "Hello world", TimeSpan.FromSeconds(3600));
+            output.WriteLine("Result: " + res.ToJson());
+        }
+
+        [Fact]
+        public async Task GetInvoice()
+        {
+            var createInvoice = await InvoiceClient.CreateInvoice(10000, "Hello world", TimeSpan.FromSeconds(3600));
+            var getInvoice = await InvoiceClient.GetInvoice(createInvoice.Id);
+
+            Assert.Equal(createInvoice.BOLT11, getInvoice.BOLT11);
+        }
+
+        [Fact]
+        public void Play()
+        {
+            var seq = new System.Buffers.ReadOnlySequence<byte>(new ReadOnlyMemory<byte>(new byte[1000]));
+            var seq2 = seq.Slice(3);
+            var pos = seq2.GetPosition(0);
+        }
+
+        // integration tests
+        [Fact]
+        public async Task TestWaitListenInvoice()
+        {
+            var merchantInvoice = await InvoiceClient.CreateInvoice(10000, "Hello world", TimeSpan.FromSeconds(3600));
+            var merchantInvoice2 = await InvoiceClient.CreateInvoice(10000, "Hello world", TimeSpan.FromSeconds(3600));
+
+            var waitToken = default(CancellationToken);
+            var listener = await InvoiceClient.Listen(waitToken);
+            var waitTask = listener.WaitInvoice(waitToken);
+
+            await EnsureLightningChannelAsync();
+            var payResponse = await CustomerLnd.SendPaymentSyncAsync(new LnrpcSendRequest
+            {
+                Payment_request = merchantInvoice.BOLT11
+            });
+
+            var invoice = await waitTask;
+            Assert.True(invoice.PaidAt.HasValue);
+
+            var waitTask2 = listener.WaitInvoice(waitToken);
+
+            payResponse = await CustomerLnd.SendPaymentSyncAsync(new LnrpcSendRequest
+            {
+                Payment_request = merchantInvoice2.BOLT11
+            });
+
+            invoice = await waitTask2;
+            Assert.True(invoice.PaidAt.HasValue);
+
+            var waitTask3 = listener.WaitInvoice(waitToken);
+            await Task.Delay(100);
+            listener.Dispose();
+            Assert.Throws<TaskCanceledException>(()=> waitTask3.GetAwaiter().GetResult());
+        }
+
+        [Fact]
+        public async Task CreateLndInvoiceAndPay()
+        {
+            var merchantInvoice = await InvoiceClient.CreateInvoice(10000, "Hello world", TimeSpan.FromSeconds(3600));
+
+            await EnsureLightningChannelAsync();
+            var payResponse = await CustomerLnd.SendPaymentSyncAsync(new LnrpcSendRequest
+            {
+                Payment_request = merchantInvoice.BOLT11
+            });
+
+            var invoice = await InvoiceClient.GetInvoice(merchantInvoice.Id);
+
+            Assert.True(invoice.PaidAt.HasValue);
+        }
+
+
+        public async Task<LnrpcChannel> EnsureLightningChannelAsync()
+        {
+            var merchantInfo = await WaitLNSynched();
+            var merchantNodeAddress = new LnrpcLightningAddress
+            {
+                Pubkey = merchantInfo.NodeId,
+                Host = "merchant_lnd:9735"
+            };
+
+            while (true)
+            {
+                // if channel is pending generate blocks until confirmed
+                var pendingResponse = await CustomerLnd.PendingChannelsAsync();
+                if (pendingResponse.Pending_open_channels?
+                    .Any(a => a.Channel?.Remote_node_pub == merchantNodeAddress.Pubkey) == true)
+                {
+                    ExplorerNode.Generate(1);
+                    await WaitLNSynched();
+                    continue;
+                }
+
+                // check if channel is established
+                var chanResponse = await CustomerLnd.ListChannelsAsync(null, null, null, null);
+                LnrpcChannel channelToMerchant = null;
+                if (chanResponse != null && chanResponse.Channels != null)
+                {
+                    channelToMerchant = chanResponse.Channels
+                    .Where(a => a.Remote_pubkey == merchantNodeAddress.Pubkey)
+                    .FirstOrDefault();
+                }
+
+                if (channelToMerchant == null)
+                {
+                    // create new channel
+                    var isConnected = await CustomerLnd.ListPeersAsync();
+                    if (isConnected.Peers == null ||
+                        !isConnected.Peers.Any(a => a.Pub_key == merchantInfo.NodeId))
+                    {
+                        var connectResp = await CustomerLnd.ConnectPeerAsync(new LnrpcConnectPeerRequest
+                        {
+                            Addr = merchantNodeAddress
+                        });
+                    }
+
+                    var addressResponse = await CustomerLnd.NewWitnessAddressAsync();
+                    var address = BitcoinAddress.Create(addressResponse.Address, Network.RegTest);
+                    await ExplorerNode.SendToAddressAsync(address, Money.Coins(0.2m));
+                    ExplorerNode.Generate(1);
+                    await WaitLNSynched();
+
+                    var channelReq = new LnrpcOpenChannelRequest
+                    {
+                        Local_funding_amount = 16777215.ToString(CultureInfo.InvariantCulture),
+                        Node_pubkey_string = merchantInfo.NodeId
+                    };
+                    var channelResp = await CustomerLnd.OpenChannelSyncAsync(channelReq);
+                }
+                else
+                {
+                    // channel exists, return it
+                    ExplorerNode.Generate(1);
+                    await WaitLNSynched();
+                    return channelToMerchant;
+                }
+            }
+        }
+
+        private async Task<LightningNodeInformation> WaitLNSynched()
+        {
+            while (true)
+            {
+                var merchantInfo = await InvoiceClient.GetInfo();
+                var blockCount = await ExplorerNode.GetBlockCountAsync();
+                if (merchantInfo.BlockHeight != blockCount)
+                {
+                    await Task.Delay(500);
+                }
+                else
+                {
+                    return merchantInfo;
+                }
+            }
+        }
+
+
+
+
+        //
+        private void initializeEnvironment()
+        {
+            NetworkProvider = new BTCPayNetworkProvider(NetworkType.Regtest);
+            ExplorerNode = new RPCClient(RPCCredentialString.Parse(GetEnvironment("TESTS_BTCRPCCONNECTION", "server=http://127.0.0.1:43782;ceiwHEbqWI83:DwubwWsoo3")), NetworkProvider.GetNetwork("BTC").NBitcoinNetwork);
+        }
+
+        public BTCPayNetworkProvider NetworkProvider { get; private set; }
+        public RPCClient ExplorerNode { get; set; }
+
+        internal string GetEnvironment(string variable, string defaultValue)
+        {
+            var var = Environment.GetEnvironmentVariable(variable);
+            return String.IsNullOrEmpty(var) ? defaultValue : var;
+        }
+    }
+}

BTCPayServer.Tests/ServerTester.cs

@@ -20,6 +20,8 @@ using System.Threading;
 using System.Globalization;
 using BTCPayServer.Payments.Lightning.CLightning;
 using BTCPayServer.Payments.Lightning.Charge;
+using BTCPayServer.Tests.Lnd;
+using BTCPayServer.Payments.Lightning;
 
 namespace BTCPayServer.Tests
 {
@@ -47,10 +49,12 @@ namespace BTCPayServer.Tests
             LTCExplorerClient = new ExplorerClient(NetworkProvider.GetNetwork("LTC").NBXplorerNetwork, new Uri(GetEnvironment("TESTS_LTCNBXPLORERURL", "http://127.0.0.1:32838/")));
 
             var btc = NetworkProvider.GetNetwork("BTC").NBitcoinNetwork;
-            CustomerLightningD = new CLightningRPCClient(new Uri(GetEnvironment("TEST_CUSTOMERLIGHTNINGD", "tcp://127.0.0.1:30992/")), btc);
-            MerchantLightningD = new CLightningRPCClient(new Uri(GetEnvironment("TEST_MERCHANTLIGHTNINGD", "tcp://127.0.0.1:30993/")), btc);
+            CustomerLightningD = (CLightningRPCClient)LightningClientFactory.CreateClient(GetEnvironment("TEST_CUSTOMERLIGHTNINGD", "type=clightning;server=tcp://127.0.0.1:30992/"), btc);
+            MerchantLightningD = (CLightningRPCClient)LightningClientFactory.CreateClient(GetEnvironment("TEST_MERCHANTLIGHTNINGD", "type=clightning;server=tcp://127.0.0.1:30993/"), btc);
 
-            MerchantCharge = new ChargeTester(this, "TEST_MERCHANTCHARGE", "http://api-token:foiewnccewuify@127.0.0.1:54938/", "merchant_lightningd", btc);
+            MerchantCharge = new ChargeTester(this, "TEST_MERCHANTCHARGE", "type=charge;server=https://127.0.0.1:54938/;api-token=foiewnccewuify", "merchant_lightningd", btc);
+
+            MerchantLnd = new LndMockTester(this, "TEST_MERCHANTLND", "https://lnd:lnd@127.0.0.1:53280/", "merchant_lnd", btc);
 
             PayTester = new BTCPayServerTester(Path.Combine(_Directory, "pay"))
             {
@@ -78,41 +82,52 @@ namespace BTCPayServer.Tests
         /// <summary>
         /// Connect a customer LN node to the merchant LN node
         /// </summary>
-        public void PrepareLightning()
+        public void PrepareLightning(LightningConnectionType lndBackend)
         {
-            PrepareLightningAsync().GetAwaiter().GetResult();
+            ILightningInvoiceClient client = MerchantCharge.Client;
+            if (lndBackend == LightningConnectionType.LndREST)
+                client = MerchantLnd.Client;
+
+            PrepareLightningAsync(client).GetAwaiter().GetResult();
         }
 
 
+        private static readonly string[] SKIPPED_STATES =
+            { "ONCHAIN", "CHANNELD_SHUTTING_DOWN", "CLOSINGD_SIGEXCHANGE", "CLOSINGD_COMPLETE", "FUNDING_SPEND_SEEN" };
+
         /// <summary>
         /// Connect a customer LN node to the merchant LN node
         /// </summary>
         /// <returns></returns>
-        public async Task PrepareLightningAsync()
+        private async Task PrepareLightningAsync(ILightningInvoiceClient client)
         {
             while (true)
             {
-                var skippedStates = new[] { "ONCHAIN", "CHANNELD_SHUTTING_DOWN", "CLOSINGD_SIGEXCHANGE", "CLOSINGD_COMPLETE", "FUNDING_SPEND_SEEN" };
-                var channel = (await CustomerLightningD.ListPeersAsync())
+                var merchantInfo = await WaitLNSynched(client, CustomerLightningD, MerchantLightningD);
+
+                var peers = await CustomerLightningD.ListPeersAsync();
+                var filteringToTargetedPeers = peers.Where(a => a.Id == merchantInfo.NodeId);
+                var channel = filteringToTargetedPeers
                             .SelectMany(p => p.Channels)
-                            .Where(c => !skippedStates.Contains(c.State ?? ""))
+                            .Where(c => !SKIPPED_STATES.Contains(c.State ?? ""))
                             .FirstOrDefault();
+
                 switch (channel?.State)
                 {
                     case null:
-                        var merchantInfo = await WaitLNSynched();
-                        var clightning = new NodeInfo(merchantInfo.Id, MerchantCharge.P2PHost, merchantInfo.Port);
-                        await CustomerLightningD.ConnectAsync(clightning);
                         var address = await CustomerLightningD.NewAddressAsync();
-                        await ExplorerNode.SendToAddressAsync(address, Money.Coins(0.2m));
+                        await ExplorerNode.SendToAddressAsync(address, Money.Coins(0.5m));
                         ExplorerNode.Generate(1);
-                        await WaitLNSynched();
+                        await WaitLNSynched(client, CustomerLightningD, MerchantLightningD);
                         await Task.Delay(1000);
-                        await CustomerLightningD.FundChannelAsync(clightning, Money.Satoshis(16777215));
+
+                        var merchantNodeInfo = new NodeInfo(merchantInfo.NodeId, merchantInfo.Address, merchantInfo.P2PPort);
+                        await CustomerLightningD.ConnectAsync(merchantNodeInfo);
+                        await CustomerLightningD.FundChannelAsync(merchantNodeInfo, Money.Satoshis(16777215));
                         break;
                     case "CHANNELD_AWAITING_LOCKIN":
                         ExplorerNode.Generate(1);
-                        await WaitLNSynched();
+                        await WaitLNSynched(client, CustomerLightningD, MerchantLightningD);
                         break;
                     case "CHANNELD_NORMAL":
                         return;
@@ -122,23 +137,29 @@ namespace BTCPayServer.Tests
             }
         }
 
-        private async Task<GetInfoResponse> WaitLNSynched()
+        private async Task<LightningNodeInformation> WaitLNSynched(params ILightningInvoiceClient[] clients)
         {
             while (true)
             {
-                var merchantInfo = await MerchantCharge.Client.GetInfoAsync();
                 var blockCount = await ExplorerNode.GetBlockCountAsync();
-                if (merchantInfo.BlockHeight != blockCount)
-                {
-                    await Task.Delay(1000);
-                }
-                else
-                {
-                    return merchantInfo;
-                }
+                var synching = clients.Select(c => WaitLNSynchedCore(blockCount, c)).ToArray();
+                await Task.WhenAll(synching);
+                if (synching.All(c => c.Result != null))
+                    return synching[0].Result;
+                await Task.Delay(1000);
             }
         }
 
+        private async Task<LightningNodeInformation> WaitLNSynchedCore(int blockCount, ILightningInvoiceClient client)
+        {
+            var merchantInfo = await client.GetInfo();
+            if (merchantInfo.BlockHeight == blockCount)
+            {
+                return merchantInfo;
+            }
+            return null;
+        }
+
         public void SendLightningPayment(Invoice invoice)
         {
             SendLightningPaymentAsync(invoice).GetAwaiter().GetResult();
@@ -152,8 +173,10 @@ namespace BTCPayServer.Tests
         }
 
         public CLightningRPCClient CustomerLightningD { get; set; }
+
         public CLightningRPCClient MerchantLightningD { get; private set; }
         public ChargeTester MerchantCharge { get; private set; }
+        public LndMockTester MerchantLnd { get; set; }
 
         internal string GetEnvironment(string variable, string defaultValue)
         {

BTCPayServer.Tests/TestAccount.cs

@@ -117,7 +117,7 @@ namespace BTCPayServer.Tests
         {
             get; set;
         }
-        
+
         public void RegisterLightningNode(string cryptoCode, LightningConnectionType connectionType)
         {
             RegisterLightningNodeAsync(cryptoCode, connectionType).GetAwaiter().GetResult();
@@ -126,15 +126,24 @@ namespace BTCPayServer.Tests
         public async Task RegisterLightningNodeAsync(string cryptoCode, LightningConnectionType connectionType)
         {
             var storeController = this.GetController<StoresController>();
+
+            string connectionString = null;
+            if (connectionType == LightningConnectionType.Charge)
+                connectionString = "type=charge;server=" + parent.MerchantCharge.Client.Uri.AbsoluteUri;
+            else if (connectionType == LightningConnectionType.CLightning)
+                connectionString = "type=clightning;server=" + parent.MerchantLightningD.Address.AbsoluteUri;
+            else if (connectionType == LightningConnectionType.LndREST)
+                connectionString = $"type=lnd-rest;server={parent.MerchantLnd.Swagger.BaseUrl};allowinsecure=true";
+            else
+                throw new NotSupportedException(connectionType.ToString());
+
             await storeController.AddLightningNode(StoreId, new LightningNodeViewModel()
             {
-                Url = connectionType == LightningConnectionType.Charge ? parent.MerchantCharge.Client.Uri.AbsoluteUri :
-                      connectionType == LightningConnectionType.CLightning ? parent.MerchantLightningD.Address.AbsoluteUri
-                      : throw new NotSupportedException(connectionType.ToString()),
+                ConnectionString = connectionString,
                 SkipPortTest = true
             }, "save", "BTC");
             if (storeController.ModelState.ErrorCount != 0)
                 Assert.False(true, storeController.ModelState.FirstOrDefault().Value.Errors[0].ErrorMessage);
         }
-}
+    }
 }

BTCPayServer.Tests/UnitTest1.cs

@@ -38,6 +38,7 @@ using System.Text;
 using BTCPayServer.Rating;
 using BTCPayServer.Validation;
 using ExchangeSharp;
+using System.Security.Cryptography.X509Certificates;
 
 namespace BTCPayServer.Tests
 {
@@ -409,14 +410,20 @@ namespace BTCPayServer.Tests
 
                 var testResult = storeController.AddLightningNode(user.StoreId, new LightningNodeViewModel()
                 {
-                    Url = tester.MerchantCharge.Client.Uri.AbsoluteUri
+                    ConnectionString = "type=charge;server=" + tester.MerchantCharge.Client.Uri.AbsoluteUri
                 }, "test", "BTC").GetAwaiter().GetResult();
                 Assert.DoesNotContain("Error", ((LightningNodeViewModel)Assert.IsType<ViewResult>(testResult).Model).StatusMessage, StringComparison.OrdinalIgnoreCase);
                 Assert.True(storeController.ModelState.IsValid);
 
                 Assert.IsType<RedirectToActionResult>(storeController.AddLightningNode(user.StoreId, new LightningNodeViewModel()
                 {
-                    Url = tester.MerchantCharge.Client.Uri.AbsoluteUri
+                    ConnectionString = "type=charge;server=" + tester.MerchantCharge.Client.Uri.AbsoluteUri
+                }, "save", "BTC").GetAwaiter().GetResult());
+
+                // Make sure old connection string format does not work
+                Assert.IsType<ViewResult>(storeController.AddLightningNode(user.StoreId, new LightningNodeViewModel()
+                {
+                    ConnectionString = tester.MerchantCharge.Client.Uri.AbsoluteUri
                 }, "save", "BTC").GetAwaiter().GetResult());
 
                 var storeVm = Assert.IsType<Models.StoreViewModels.StoreViewModel>(Assert.IsType<ViewResult>(storeController.UpdateStore()).Model);
@@ -428,106 +435,148 @@ namespace BTCPayServer.Tests
         public void CanParseLightningURL()
         {
             LightningConnectionString conn = null;
-            Assert.True(LightningConnectionString.TryParse("/test/a", out conn));
-            Assert.Equal("unix://test/a", conn.ToString());
-            Assert.Equal("unix://test/a", conn.ToUri(true).AbsoluteUri);
-            Assert.Equal("unix://test/a", conn.ToUri(false).AbsoluteUri);
-            Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            Assert.True(LightningConnectionString.TryParse("/test/a", true, out conn));
+            for (int i = 0; i < 2; i++)
+            {
+                if (i == 1)
+                    Assert.True(LightningConnectionString.TryParse(conn.ToString(), false, out conn));
+                Assert.Equal(i == 0, conn.IsLegacy);
+                Assert.Equal("type=clightning;server=unix://test/a", conn.ToString());
+                Assert.Equal("unix://test/a", conn.ToUri(true).AbsoluteUri);
+                Assert.Equal("unix://test/a", conn.ToUri(false).AbsoluteUri);
+                Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            }
 
-            Assert.True(LightningConnectionString.TryParse("unix://test/a", out conn));
-            Assert.Equal("unix://test/a", conn.ToString());
-            Assert.Equal("unix://test/a", conn.ToUri(true).AbsoluteUri);
-            Assert.Equal("unix://test/a", conn.ToUri(false).AbsoluteUri);
-            Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            Assert.True(LightningConnectionString.TryParse("unix://test/a", true, out conn));
+            for (int i = 0; i < 2; i++)
+            {
+                if (i == 1)
+                    Assert.True(LightningConnectionString.TryParse(conn.ToString(), false, out conn));
+                Assert.Equal("type=clightning;server=unix://test/a", conn.ToString());
+                Assert.Equal("unix://test/a", conn.ToUri(true).AbsoluteUri);
+                Assert.Equal("unix://test/a", conn.ToUri(false).AbsoluteUri);
+                Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            }
 
-            Assert.True(LightningConnectionString.TryParse("unix://test/a", out conn));
-            Assert.Equal("unix://test/a", conn.ToString());
-            Assert.Equal("unix://test/a", conn.ToUri(true).AbsoluteUri);
-            Assert.Equal("unix://test/a", conn.ToUri(false).AbsoluteUri);
-            Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            Assert.True(LightningConnectionString.TryParse("unix://test/a", true, out conn));
+            for (int i = 0; i < 2; i++)
+            {
+                if (i == 1)
+                    Assert.True(LightningConnectionString.TryParse(conn.ToString(), false, out conn));
+                Assert.Equal("type=clightning;server=unix://test/a", conn.ToString());
+                Assert.Equal("unix://test/a", conn.ToUri(true).AbsoluteUri);
+                Assert.Equal("unix://test/a", conn.ToUri(false).AbsoluteUri);
+                Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            }
 
-            Assert.True(LightningConnectionString.TryParse("tcp://test/a", out conn));
-            Assert.Equal("tcp://test/a", conn.ToString());
-            Assert.Equal("tcp://test/a", conn.ToUri(true).AbsoluteUri);
-            Assert.Equal("tcp://test/a", conn.ToUri(false).AbsoluteUri);
-            Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            Assert.True(LightningConnectionString.TryParse("tcp://test/a", true, out conn));
+            for (int i = 0; i < 2; i++)
+            {
+                if (i == 1)
+                    Assert.True(LightningConnectionString.TryParse(conn.ToString(), false, out conn));
+                Assert.Equal("type=clightning;server=tcp://test/a", conn.ToString());
+                Assert.Equal("tcp://test/a", conn.ToUri(true).AbsoluteUri);
+                Assert.Equal("tcp://test/a", conn.ToUri(false).AbsoluteUri);
+                Assert.Equal(LightningConnectionType.CLightning, conn.ConnectionType);
+            }
 
-            Assert.True(LightningConnectionString.TryParse("http://aaa:bbb@test/a", out conn));
-            Assert.Equal("http://aaa:bbb@test/a", conn.ToString());
-            Assert.Equal("http://aaa:bbb@test/a", conn.ToUri(true).AbsoluteUri);
-            Assert.Equal("http://test/a", conn.ToUri(false).AbsoluteUri);
-            Assert.Equal(LightningConnectionType.Charge, conn.ConnectionType);
-            Assert.Equal("aaa", conn.Username);
-            Assert.Equal("bbb", conn.Password);
+            Assert.True(LightningConnectionString.TryParse("http://aaa:bbb@test/a", true, out conn));
+            for (int i = 0; i < 2; i++)
+            {
+                if (i == 1)
+                    Assert.True(LightningConnectionString.TryParse(conn.ToString(), false, out conn));
+                Assert.Equal("type=charge;server=http://aaa:bbb@test/a", conn.ToString());
+                Assert.Equal("http://aaa:bbb@test/a", conn.ToUri(true).AbsoluteUri);
+                Assert.Equal("http://test/a", conn.ToUri(false).AbsoluteUri);
+                Assert.Equal(LightningConnectionType.Charge, conn.ConnectionType);
+                Assert.Equal("aaa", conn.Username);
+                Assert.Equal("bbb", conn.Password);
+            }
 
-            Assert.False(LightningConnectionString.TryParse("lol://aaa:bbb@test/a", out conn));
-            Assert.False(LightningConnectionString.TryParse("https://test/a", out conn));
-            Assert.False(LightningConnectionString.TryParse("unix://dwewoi:dwdwqd@test/a", out conn));
+            Assert.True(LightningConnectionString.TryParse("http://api-token:bbb@test/a", true, out conn));
+            for (int i = 0; i < 2; i++)
+            {
+                if (i == 1)
+                    Assert.True(LightningConnectionString.TryParse(conn.ToString(), false, out conn));
+                Assert.Equal("type=charge;server=http://test/a;api-token=bbb", conn.ToString());
+            }
+
+            Assert.False(LightningConnectionString.TryParse("lol://aaa:bbb@test/a", true, out conn));
+            Assert.False(LightningConnectionString.TryParse("https://test/a", true, out conn));
+            Assert.False(LightningConnectionString.TryParse("unix://dwewoi:dwdwqd@test/a", true, out conn));
+            Assert.False(LightningConnectionString.TryParse("tcp://test/a", false, out conn));
+            Assert.False(LightningConnectionString.TryParse("type=charge;server=http://aaa:bbb@test/a;unk=lol", false, out conn));
+            Assert.False(LightningConnectionString.TryParse("type=charge;server=tcp://aaa:bbb@test/a", false, out conn));
+            Assert.False(LightningConnectionString.TryParse("type=charge", false, out conn));
+            Assert.False(LightningConnectionString.TryParse("type=clightning", false, out conn));
+            Assert.True(LightningConnectionString.TryParse("type=clightning;server=tcp://aaa:bbb@test/a", false, out conn));
+            Assert.True(LightningConnectionString.TryParse("type=clightning;server=/aaa:bbb@test/a", false, out conn));
+            Assert.True(LightningConnectionString.TryParse("type=clightning;server=unix://aaa:bbb@test/a", false, out conn));
+            Assert.False(LightningConnectionString.TryParse("type=clightning;server=wtf://aaa:bbb@test/a", false, out conn));
+
+            var macaroon = "0201036c6e640247030a10b0dbbde28f009f83d330bde05075ca251201301a160a0761646472657373120472656164120577726974651a170a08696e766f6963657312047265616412057772697465000006200ae088692e67cf14e767c3d2a4a67ce489150bf810654ff980e1b7a7e263d5e8";
+
+            var certthumbprint = "c51bb1d402306d0da00e85581b32aa56166bcbab7eb888ff925d7167eb436d06";
+
+            // We get this format from "openssl x509 -noout -fingerprint -sha256 -inform pem -in <certificate>"
+            var certthumbprint2 = "C5:1B:B1:D4:02:30:6D:0D:A0:0E:85:58:1B:32:AA:56:16:6B:CB:AB:7E:B8:88:FF:92:5D:71:67:EB:43:6D:06";
+            
+            var lndUri = $"type=lnd-rest;server=https://lnd:lnd@127.0.0.1:53280/;macaroon={macaroon};certthumbprint={certthumbprint}";
+            var lndUri2 = $"type=lnd-rest;server=https://lnd:lnd@127.0.0.1:53280/;macaroon={macaroon};certthumbprint={certthumbprint2}";
+
+            var certificateHash = new X509Certificate2(Encoders.Hex.DecodeData("2d2d2d2d2d424547494e2043455254494649434154452d2d2d2d2d0a4d494942396a4343415a7967417749424167495156397a62474252724e54716b4e4b55676d72524d377a414b42676771686b6a4f50515144416a41784d5238770a485159445651514b45785a73626d5167595856306232646c626d56795958526c5a43426a5a584a304d51347744415944565151444577564754304e56557a41650a467730784f4441304d6a55794d7a517a4d6a4261467730784f5441324d6a41794d7a517a4d6a42614d444578487a416442674e5642416f54466d78755a4342680a645852765a3256755a584a686447566b49474e6c636e5178446a414d42674e5642414d5442555a50513156544d466b77457759484b6f5a497a6a3043415159490a4b6f5a497a6a304441516344516741454b7557424568564f75707965434157476130766e713262712f59396b41755a78616865646d454553482b753936436d450a397577486b4b2b4a7667547a66385141783550513741357254637155374b57595170303175364f426c5443426b6a414f42674e56485138424166384542414d430a4171517744775944565230544151482f42415577417745422f7a427642674e56485245456144426d6767564754304e565534494a6247396a5957786f62334e300a6877522f4141414268784141414141414141414141414141414141414141414268775373474f69786877514b41457342687753702f717473687754417141724c0a687753702f6d4a72687753702f754f77687753702f714e59687753702f6874436877514b70514157687753702f6c42514d416f4743437147534d343942414d430a413067414d45554349464866716d595a5043647a4a5178386b47586859473834394c31766541364c784d6f7a4f5774356d726835416945413662756e51556c710a6558553070474168776c3041654d726a4d4974394c7652736179756162565a593278343d0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0a"))
+                            .GetCertHash(System.Security.Cryptography.HashAlgorithmName.SHA256);
+
+            
+            Assert.True(LightningConnectionString.TryParse(lndUri, false, out conn));
+            Assert.True(LightningConnectionString.TryParse(lndUri2, false, out var conn2));
+            Assert.Equal(conn2.ToString(), conn.ToString());
+            Assert.Equal(lndUri, conn.ToString());
+            Assert.Equal(LightningConnectionType.LndREST, conn.ConnectionType);
+            Assert.Equal(macaroon, Encoders.Hex.EncodeData(conn.Macaroon));
+            Assert.Equal(certthumbprint.Replace(":", "", StringComparison.OrdinalIgnoreCase).ToLowerInvariant(), Encoders.Hex.EncodeData(conn.CertificateThumbprint));
+            Assert.True(certificateHash.SequenceEqual(conn.CertificateThumbprint));
+
+            // AllowInsecure can be set to allow http
+            Assert.False(LightningConnectionString.TryParse($"type=lnd-rest;server=http://127.0.0.1:53280/;macaroon={macaroon};allowinsecure=false", false, out conn2));
+            Assert.True(LightningConnectionString.TryParse($"type=lnd-rest;server=http://127.0.0.1:53280/;macaroon={macaroon};allowinsecure=true", false, out conn2));
+            Assert.True(LightningConnectionString.TryParse($"type=lnd-rest;server=http://127.0.0.1:53280/;macaroon={macaroon};allowinsecure=true", false, out conn2));
         }
 
         [Fact]
         public void CanSendLightningPaymentCLightning()
         {
-            using (var tester = ServerTester.Create())
-            {
-                tester.Start();
-                tester.PrepareLightning();
-                var user = tester.NewAccount();
-                user.GrantAccess();
-                user.RegisterLightningNode("BTC", LightningConnectionType.CLightning);
-                user.RegisterDerivationScheme("BTC");
-
-                var invoice = user.BitPay.CreateInvoice(new Invoice()
-                {
-                    Price = 0.01m,
-                    Currency = "USD",
-                    PosData = "posData",
-                    OrderId = "orderId",
-                    ItemDesc = "Some description"
-                });
-
-                tester.SendLightningPayment(invoice);
-
-                Eventually(() =>
-                {
-                    var localInvoice = user.BitPay.GetInvoice(invoice.Id);
-                    Assert.Equal("complete", localInvoice.Status);
-                    Assert.Equal("False", localInvoice.ExceptionStatus.ToString());
-                });
-            }
+            ProcessLightningPayment(LightningConnectionType.CLightning);
         }
 
         [Fact]
         public void CanSendLightningPaymentCharge()
         {
+            ProcessLightningPayment(LightningConnectionType.Charge);
+        }
+
+        [Fact]
+        public void CanSendLightningPaymentLnd()
+        {
+            ProcessLightningPayment(LightningConnectionType.LndREST);
+        }
+
+        void ProcessLightningPayment(LightningConnectionType type)
+        {
+            // For easier debugging and testing
+            // LightningLikePaymentHandler.LIGHTNING_TIMEOUT = int.MaxValue;
 
             using (var tester = ServerTester.Create())
             {
                 tester.Start();
-                tester.PrepareLightning();
                 var user = tester.NewAccount();
                 user.GrantAccess();
-                user.RegisterLightningNode("BTC", LightningConnectionType.Charge);
+                user.RegisterLightningNode("BTC", type);
                 user.RegisterDerivationScheme("BTC");
+                
+                tester.PrepareLightning(type);
 
-                var invoice = user.BitPay.CreateInvoice(new Invoice()
-                {
-                    Price = 0.01m,
-                    Currency = "USD",
-                    PosData = "posData",
-                    OrderId = "orderId",
-                    ItemDesc = "Some description"
-                });
-
-                tester.SendLightningPayment(invoice);
-
-                Eventually(() =>
-                {
-                    var localInvoice = user.BitPay.GetInvoice(invoice.Id);
-                    Assert.Equal("complete", localInvoice.Status);
-                    Assert.Equal("False", localInvoice.ExceptionStatus.ToString());
-                });
-
+                Task.WaitAll(CanSendLightningPaymentCore(tester, user));
 
                 Task.WaitAll(Enumerable.Range(0, 5)
                     .Select(_ => CanSendLightningPaymentCore(tester, user))
@@ -537,7 +586,10 @@ namespace BTCPayServer.Tests
 
         async Task CanSendLightningPaymentCore(ServerTester tester, TestAccount user)
         {
-            await Task.Delay(TimeSpan.FromSeconds(RandomUtils.GetUInt32() % 5));
+            // TODO: If this parameter is less than 1 second we start having concurrency problems
+            await Task.Delay(TimeSpan.FromMilliseconds(1000));
+            //
+
             var invoice = await user.BitPay.CreateInvoiceAsync(new Invoice()
             {
                 Price = 0.01m,
@@ -1309,8 +1361,9 @@ namespace BTCPayServer.Tests
                 Assert.NotNull(vm.SelectedAppType);
                 Assert.Null(vm.Name);
                 vm.Name = "test";
+                vm.SelectedAppType = AppType.PointOfSale.ToString();
                 var redirectToAction = Assert.IsType<RedirectToActionResult>(apps.CreateApp(vm).Result);
-                Assert.Equal(nameof(apps.ListApps), redirectToAction.ActionName);
+                Assert.Equal(nameof(apps.UpdatePointOfSale), redirectToAction.ActionName);
                 var appList = Assert.IsType<ListAppsViewModel>(Assert.IsType<ViewResult>(apps.ListApps().Result).Model);
                 var appList2 = Assert.IsType<ListAppsViewModel>(Assert.IsType<ViewResult>(apps2.ListApps().Result).Model);
                 Assert.Single(appList.Apps);

BTCPayServer.Tests/UnitTestPeusa.cs

@@ -0,0 +1,48 @@
+using System;
+using NBitcoin;
+using Xunit;
+
+namespace BTCPayServer.Tests
+{
+    // Helper class for testing functionality and generating data needed during coding/debuging
+    public class UnitTestPeusa
+    {
+        // Unit test that generates temorary checkout Bitpay page
+        // https://forkbitpay.slack.com/archives/C7M093Z55/p1508293682000217
+
+        // Testnet of Bitpay down
+        //[Fact]
+        //public void BitpayCheckout()
+        //{
+        //    var key = new Key(Encoders.Hex.DecodeData("7b70a06f35562873e3dcb46005ed0fe78e1991ad906e56adaaafa40ba861e056"));
+        //    var url = new Uri("https://test.bitpay.com/");
+        //    var btcpay = new Bitpay(key, url);
+        //    var invoice = btcpay.CreateInvoice(new Invoice()
+        //    {
+
+        //        Price = 5.0,
+        //        Currency = "USD",
+        //        PosData = "posData",
+        //        OrderId = "cdfd8a5f-6928-4c3b-ba9b-ddf438029e73",
+        //        ItemDesc = "Hello from the otherside"
+        //    }, Facade.Merchant);
+
+        //    // go to invoice.Url
+        //    Console.WriteLine(invoice.Url);
+        //}
+
+        // Generating Extended public key to use on http://localhost:14142/stores/{storeId}
+        [Fact]
+        public void GeneratePubkey()
+        {
+            var network = Network.RegTest;
+
+            ExtKey masterKey = new ExtKey();
+            Console.WriteLine("Master key : " + masterKey.ToString(network));
+            ExtPubKey masterPubKey = masterKey.Neuter();
+
+            ExtPubKey pubkey = masterPubKey.Derive(0);
+            Console.WriteLine("PubKey " + 0 + " : " + pubkey.ToString(network));
+        }
+    }
+}

BTCPayServer.Tests/docker-compose.yml

@@ -17,9 +17,10 @@ services:
       TESTS_POSTGRES: User ID=postgres;Host=postgres;Port=5432;Database=btcpayserver
       TESTS_PORT: 80
       TESTS_HOSTNAME: tests
-      TEST_MERCHANTLIGHTNINGD: "/etc/merchant_lightningd_datadir/lightning-rpc"
-      TEST_CUSTOMERLIGHTNINGD: "/etc/customer_lightningd_datadir/lightning-rpc"
-      TEST_MERCHANTCHARGE: http://api-token:foiewnccewuify@lightning-charged:9112/
+      TEST_MERCHANTLIGHTNINGD: "type=clightning;server=/etc/merchant_lightningd_datadir/lightning-rpc"
+      TEST_CUSTOMERLIGHTNINGD: "type=clightning;server=/etc/customer_lightningd_datadir/lightning-rpc"
+      TEST_MERCHANTCHARGE: "type=charge;server=https://lightning-charged:9112/;api-token=foiewnccewuify;allowinsecure=true"
+      TEST_MERCHANTLND: "type=lnd-rest;server=https://lnd:lnd@127.0.0.1:53280/;allowinsecure=true"
       TESTS_INCONTAINER: "true"
     expose:
       - "80"
@@ -44,6 +45,22 @@ services:
       - customer_lightningd
       - merchant_lightningd
       - lightning-charged
+      - customer_lnd
+      - merchant_lnd
+
+  devlnd: 
+    image: nicolasdorier/docker-bitcoin:0.16.0
+    environment:
+      BITCOIN_EXTRA_ARGS: |
+        regtest=1
+        connect=bitcoind:39388
+    links:
+      - nbxplorer
+      - postgres
+      - customer_lnd
+      - merchant_lnd
+
+
 
   nbxplorer:
     image: nicolasdorier/nbxplorer:1.0.2.8
@@ -80,8 +97,13 @@ services:
         rpcport=43782
         port=39388
         whitelist=0.0.0.0/0
+        zmqpubrawtx=tcp://0.0.0.0:28332
+        zmqpubrawblock=tcp://0.0.0.0:28332
+        zmqpubrawtxlock=tcp://0.0.0.0:28332
+        zmqpubhashblock=tcp://0.0.0.0:28332
     ports: 
       - "43782:43782"
+      - "28332:28332"
     expose:
       - "43782" # RPC
       - "39388" # P2P
@@ -177,8 +199,59 @@ services:
     expose:
       - "5432"
 
+  merchant_lnd:
+    image: btcpayserver/lnd:0.4.2.0
+    environment:
+      LND_CHAIN: "btc"
+      LND_ENVIRONMENT: "regtest"
+      LND_EXTRA_ARGS: |
+        restlisten=0.0.0.0:8080
+        bitcoin.node=bitcoind
+        bitcoind.rpchost=bitcoind:43782
+        bitcoind.zmqpath=tcp://bitcoind:28332
+        externalip=merchant_lnd:9735
+        no-macaroons=1
+        debuglevel=debug
+        noencryptwallet=1
+    ports:
+      - "53280:8080"
+    expose:
+      - "9735"
+    volumes:
+      - "merchant_lnd_datadir:/data"
+      - "bitcoin_datadir:/deps/.bitcoin"
+    links:
+      - bitcoind
+
+  customer_lnd:
+    image: btcpayserver/lnd:0.4.2.0
+    environment:
+      LND_CHAIN: "btc"
+      LND_ENVIRONMENT: "regtest"
+      LND_EXTRA_ARGS: |
+        restlisten=0.0.0.0:8080
+        bitcoin.node=bitcoind
+        bitcoind.rpchost=bitcoind:43782
+        bitcoind.zmqpath=tcp://bitcoind:28332
+        externalip=customer_lnd:10009
+        no-macaroons=1
+        debuglevel=debug
+        noencryptwallet=1
+    ports:
+      - "53281:8080"
+    expose:
+      - "8080"
+      - "10009"
+    volumes:
+      - "customer_lnd_datadir:/root/.lnd"
+      - "bitcoin_datadir:/deps/.bitcoin"
+    links:
+      - bitcoind
+
 volumes:
     bitcoin_datadir:
     customer_lightningd_datadir:
     merchant_lightningd_datadir:
     lightning_charge_datadir:
+    customer_lnd_datadir:
+    merchant_lnd_datadir:

BTCPayServer/BTCPayNetwork.cs

@@ -44,6 +44,7 @@ namespace BTCPayServer
         public string CryptoCode { get; internal set; }
         public string BlockExplorerLink { get; internal set; }
         public string UriScheme { get; internal set; }
+        public Money MinFee { get; internal set; }
 
         [Obsolete("Should not be needed")]
         public bool IsBTC

BTCPayServer/BTCPayNetworkProvider.Dogecoin.cs

@@ -27,7 +27,8 @@ namespace BTCPayServer
                 },
                 CryptoImagePath = "imlegacy/dogecoin.png",
                 DefaultSettings = BTCPayDefaultSettings.GetDefaultSettings(NetworkType),
-                CoinType = NetworkType == NetworkType.Mainnet ? new KeyPath("3'") : new KeyPath("1'")
+                CoinType = NetworkType == NetworkType.Mainnet ? new KeyPath("3'") : new KeyPath("1'"),
+                MinFee = Money.Coins(1m)
             });
         }
     }

BTCPayServer/BTCPayNetworkProvider.cs

@@ -53,7 +53,7 @@ namespace BTCPayServer
             InitPolis();
             InitFeathercoin();
             InitGroestlcoin();
-            InitUfo();
+            //InitUfo();
         }
 
         /// <summary>

BTCPayServer/BTCPayServer.csproj

@@ -2,7 +2,7 @@
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <TargetFramework>netcoreapp2.1</TargetFramework>
-		<Version>1.0.2.38</Version>
+		<Version>1.0.2.43</Version>
     <NoWarn>NU1701,CA1816,CA1308,CA1810,CA2208</NoWarn>
   </PropertyGroup>
   <ItemGroup>
@@ -111,6 +111,7 @@
 	<ItemGroup>
 	  <Folder Include="Build\" />
 	  <Folder Include="wwwroot\vendor\clipboard.js\" />
+	  <Folder Include="wwwroot\vendor\highlightjs\" />
 	</ItemGroup>
 
 	<ItemGroup>

BTCPayServer/Configuration/BTCPayServerOptions.cs

@@ -77,11 +77,18 @@ namespace BTCPayServer.Configuration
                 var lightning = conf.GetOrDefault<string>($"{net.CryptoCode}.lightning", string.Empty);
                 if(lightning.Length != 0)
                 {
-                    if(!LightningConnectionString.TryParse(lightning, out var connectionString, out var error))
+                    if(!LightningConnectionString.TryParse(lightning, true, out var connectionString, out var error))
                     {
-                        throw new ConfigException($"Invalid setting {net.CryptoCode}.lightning, you need to pass either " +
-                            $"the absolute path to the unix socket of a running CLightning instance (eg. /root/.lightning/lightning-rpc), " +
-                            $"or the url to a charge server with crendetials (eg. https://apitoken@API_TOKEN_SECRET:charge.example.com/)");
+                        throw new ConfigException($"Invalid setting {net.CryptoCode}.lightning, " + Environment.NewLine +
+                            $"If you have a lightning server use: 'type=clightning;server=/root/.lightning/lightning-rpc', " + Environment.NewLine +
+                            $"If you have a lightning charge server: 'type=charge;server=https://charge.example.com;api-token=yourapitoken'" + Environment.NewLine +
+                            $"If you have a lnd server: 'type=lnd-rest;server=https://lnd:lnd@lnd.example.com;macaroon=abf239...;certthumbprint=2abdf302...'" + Environment.NewLine +
+                            $"              lnd server: 'type=lnd-rest;server=https://lnd:lnd@lnd.example.com;macaroonfilepath=/root/.lnd/admin.macaroon;certthumbprint=2abdf302...'" + Environment.NewLine +
+                            error);
+                    }
+                    if(connectionString.IsLegacy)
+                    {
+                        Logs.Configuration.LogWarning($"Setting {net.CryptoCode}.lightning will work but use an deprecated format, please replace it by '{connectionString.ToString()}'");
                     }
                     InternalLightningByCryptoCode.Add(net.CryptoCode, connectionString);
                 }

BTCPayServer/Controllers/AppsController.PointOfSale.cs

@@ -134,7 +134,7 @@ namespace BTCPayServer.Controllers
             });
             await UpdateAppSettings(app);
             StatusMessage = "App updated";
-            return RedirectToAction(nameof(UpdatePointOfSale));
+            return RedirectToAction(nameof(ListApps));
         }
 
         [HttpGet]

BTCPayServer/Controllers/AppsController.cs

@@ -102,9 +102,9 @@ namespace BTCPayServer.Controllers
                 StatusMessage = "Error: You are not owner of this store";
                 return RedirectToAction(nameof(ListApps));
             }
+            var id = Encoders.Base58.EncodeData(RandomUtils.GetBytes(32));
             using (var ctx = _ContextFactory.CreateContext())
             {
-                var id = Encoders.Base58.EncodeData(RandomUtils.GetBytes(32));
                 var appData = new AppData() { Id = id };
                 appData.StoreDataId = selectedStore;
                 appData.Name = vm.Name;
@@ -113,6 +113,9 @@ namespace BTCPayServer.Controllers
                 await ctx.SaveChangesAsync();
             }
             StatusMessage = "App successfully created";
+
+            if (appType == AppType.PointOfSale)
+                return RedirectToAction(nameof(UpdatePointOfSale), new { appId = id });
             return RedirectToAction(nameof(ListApps));
         }
 

BTCPayServer/Controllers/InvoiceController.UI.cs

@@ -175,6 +175,7 @@ namespace BTCPayServer.Controllers
         [Route("invoice")]
         [AcceptMediaTypeConstraint("application/bitcoin-paymentrequest", false)]
         [XFrameOptionsAttribute(null)]
+        [ReferrerPolicyAttribute("origin")]
         public async Task<IActionResult> Checkout(string invoiceId, string id = null, string paymentMethodId = null)
         {
             //Keep compatibility with Bitpay
@@ -186,6 +187,20 @@ namespace BTCPayServer.Controllers
             if (model == null)
                 return NotFound();
 
+
+            _CSP.Add(new ConsentSecurityPolicy("script-src", "'unsafe-eval'")); // Needed by Vue
+            if(!string.IsNullOrEmpty(model.CustomCSSLink) && 
+                Uri.TryCreate(model.CustomCSSLink, UriKind.Absolute, out var uri))
+            {
+                _CSP.Clear();
+            }
+
+            if (!string.IsNullOrEmpty(model.CustomLogoLink) &&
+                Uri.TryCreate(model.CustomLogoLink, UriKind.Absolute, out uri))
+            {
+                _CSP.Clear();
+            }
+
             return View(nameof(Checkout), model);
         }
 

BTCPayServer/Controllers/InvoiceController.cs

@@ -41,12 +41,14 @@ using NBXplorer;
 using BTCPayServer.HostedServices;
 using BTCPayServer.Payments;
 using BTCPayServer.Rating;
+using BTCPayServer.Security;
 
 namespace BTCPayServer.Controllers
 {
     public partial class InvoiceController : Controller
     {
         InvoiceRepository _InvoiceRepository;
+        ContentSecurityPolicies _CSP;
         BTCPayRateProviderFactory _RateProvider;
         StoreRepository _StoreRepository;
         UserManager<ApplicationUser> _UserManager;
@@ -64,6 +66,7 @@ namespace BTCPayServer.Controllers
             StoreRepository storeRepository,
             EventAggregator eventAggregator,
             BTCPayWalletProvider walletProvider,
+            ContentSecurityPolicies csp,
             BTCPayNetworkProvider networkProvider)
         {
             _ServiceProvider = serviceProvider;
@@ -75,6 +78,7 @@ namespace BTCPayServer.Controllers
             _EventAggregator = eventAggregator;
             _NetworkProvider = networkProvider;
             _WalletProvider = walletProvider;
+            _CSP = csp;
         }
 
 
@@ -115,10 +119,11 @@ namespace BTCPayServer.Controllers
             entity.Status = "new";
             entity.SpeedPolicy = ParseSpeedPolicy(invoice.TransactionSpeed, store.SpeedPolicy);
 
-
             HashSet<CurrencyPair> currencyPairsToFetch = new HashSet<CurrencyPair>();
             var rules = storeBlob.GetRateRules(_NetworkProvider);
 
+            await UpdateCLightningConnectionStringIfNeeded(store);
+
             foreach (var network in store.GetSupportedPaymentMethods(_NetworkProvider)
                                                .Select(c => _NetworkProvider.GetNetwork(c.PaymentId.CryptoCode))
                                                 .Where(c => c != null))
@@ -208,6 +213,22 @@ namespace BTCPayServer.Controllers
             return new DataWrapper<InvoiceResponse>(resp) { Facade = "pos/invoice" };
         }
 
+        private async Task UpdateCLightningConnectionStringIfNeeded(StoreData store)
+        {
+            bool needUpdate = false;
+            foreach (var method in store.GetSupportedPaymentMethods(_NetworkProvider).OfType<Payments.Lightning.LightningSupportedPaymentMethod>())
+            {
+                var lightning = method.GetLightningUrl();
+                if (lightning.IsLegacy)
+                {
+                    method.SetLightningUrl(lightning);
+                    needUpdate = true;
+                }
+            }
+            if(needUpdate)
+                await _StoreRepository.UpdateStore(store);
+        }
+
         private async Task<PaymentMethod> CreatePaymentMethodAsync(Dictionary<CurrencyPair, Task<RateResult>> fetchingByCurrencyPair, IPaymentMethodHandler handler, ISupportedPaymentMethod supportedPaymentMethod, BTCPayNetwork network, InvoiceEntity entity, StoreData store)
         {
             var storeBlob = store.GetStoreBlob();

BTCPayServer/Controllers/StoresController.BTCLike.cs

@@ -320,7 +320,19 @@ namespace BTCPayServer.Controllers
                             builder.SubtractFees();
                     }
                     builder.SetChange(changeAddress.Item1);
-                    builder.SendEstimatedFees(feeRateValue);
+
+                    if (network.MinFee == null)
+                    {
+                        builder.SendEstimatedFees(feeRateValue);
+                    }
+                    else
+                    {
+                        var estimatedFee = builder.EstimateFees(feeRateValue);
+                        if (network.MinFee > estimatedFee)
+                            builder.SendFees(network.MinFee);
+                        else
+                            builder.SendEstimatedFees(feeRateValue);
+                    }
                     builder.Shuffle();
                     var unsigned = builder.BuildTransaction(false);
 

BTCPayServer/Controllers/StoresController.LightningLike.cs

@@ -26,16 +26,15 @@ namespace BTCPayServer.Controllers
                 return NotFound();
             LightningNodeViewModel vm = new LightningNodeViewModel();
             vm.CryptoCode = cryptoCode;
-            vm.InternalLightningNode = GetInternalLighningNode(cryptoCode)?.ToUri(true)?.AbsoluteUri;
+            vm.InternalLightningNode = GetInternalLighningNode(cryptoCode)?.ToString();
             SetExistingValues(store, vm);
             return View(vm);
         }
 
         private void SetExistingValues(StoreData store, LightningNodeViewModel vm)
         {
-            vm.Url = GetExistingLightningSupportedPaymentMethod(vm.CryptoCode, store)?.GetLightningUrl()?.ToString();
+            vm.ConnectionString = GetExistingLightningSupportedPaymentMethod(vm.CryptoCode, store)?.GetLightningUrl()?.ToString();
         }
-
         private LightningSupportedPaymentMethod GetExistingLightningSupportedPaymentMethod(string cryptoCode, StoreData store)
         {
             var id = new PaymentMethodId(cryptoCode, PaymentTypes.LightningLike);
@@ -65,7 +64,7 @@ namespace BTCPayServer.Controllers
             var network = vm.CryptoCode == null ? null : _ExplorerProvider.GetNetwork(vm.CryptoCode);
 
             var internalLightning = GetInternalLighningNode(network.CryptoCode);
-            vm.InternalLightningNode = internalLightning?.ToUri(true)?.AbsoluteUri;
+            vm.InternalLightningNode = internalLightning?.ToString();
             if (network == null)
             {
                 ModelState.AddModelError(nameof(vm.CryptoCode), "Invalid network");
@@ -74,33 +73,51 @@ namespace BTCPayServer.Controllers
 
             PaymentMethodId paymentMethodId = new PaymentMethodId(network.CryptoCode, PaymentTypes.LightningLike);
             Payments.Lightning.LightningSupportedPaymentMethod paymentMethod = null;
-            if (!string.IsNullOrEmpty(vm.Url))
+            if (!string.IsNullOrEmpty(vm.ConnectionString))
             {
-                if (!LightningConnectionString.TryParse(vm.Url, out var connectionString, out var error))
+                if (!LightningConnectionString.TryParse(vm.ConnectionString, false, out var connectionString, out var error))
                 {
-                    ModelState.AddModelError(nameof(vm.Url), $"Invalid URL ({error})");
+                    ModelState.AddModelError(nameof(vm.ConnectionString), $"Invalid URL ({error})");
                     return View(vm);
                 }
 
-                var internalDomain = internalLightning?.ToUri(false)?.DnsSafeHost;
-                bool isLocal = (internalDomain == "127.0.0.1" || internalDomain == "localhost");
+                var internalDomain = internalLightning.BaseUri?.DnsSafeHost;
 
                 bool isInternalNode = connectionString.ConnectionType == LightningConnectionType.CLightning ||
                                       connectionString.BaseUri.DnsSafeHost == internalDomain ||
-                                      isLocal;
+                                      (internalDomain == "127.0.0.1" || internalDomain == "localhost");
 
-                if (connectionString.BaseUri.Scheme == "http" && !isLocal)
+                if (connectionString.BaseUri.Scheme == "http")
                 {
-                    if (!isInternalNode || (isInternalNode && !CanUseInternalLightning()))
+                    if (!isInternalNode)
                     {
-                        ModelState.AddModelError(nameof(vm.Url), "The url must be HTTPS");
+                        ModelState.AddModelError(nameof(vm.ConnectionString), "The url must be HTTPS");
+                        return View(vm);
+                    }
+                }
+
+                if(connectionString.MacaroonFilePath != null)
+                {
+                    if(!CanUseInternalLightning())
+                    {
+                        ModelState.AddModelError(nameof(vm.ConnectionString), "You are not authorized to use macaroonfilepath");
+                        return View(vm);
+                    }
+                    if(!System.IO.File.Exists(connectionString.MacaroonFilePath))
+                    {
+                        ModelState.AddModelError(nameof(vm.ConnectionString), "The macaroonfilepath file does exist");
+                        return View(vm);
+                    }
+                    if(!System.IO.Path.IsPathRooted(connectionString.MacaroonFilePath))
+                    {
+                        ModelState.AddModelError(nameof(vm.ConnectionString), "The macaroonfilepath should be fully rooted");
                         return View(vm);
                     }
                 }
 
                 if (isInternalNode && !CanUseInternalLightning())
                 {
-                    ModelState.AddModelError(nameof(vm.Url), "Unauthorized url");
+                    ModelState.AddModelError(nameof(vm.ConnectionString), "Unauthorized url");
                     return View(vm);
                 }
 
@@ -110,6 +127,7 @@ namespace BTCPayServer.Controllers
                 };
                 paymentMethod.SetLightningUrl(connectionString);
             }
+
             if (command == "save")
             {
                 store.SetSupportedPaymentMethod(paymentMethodId, paymentMethod);
@@ -121,7 +139,7 @@ namespace BTCPayServer.Controllers
             {
                 if (paymentMethod == null)
                 {
-                    ModelState.AddModelError(nameof(vm.Url), "Missing url parameter");
+                    ModelState.AddModelError(nameof(vm.ConnectionString), "Missing url parameter");
                     return View(vm);
                 }
                 var handler = (LightningLikePaymentHandler)_ServiceProvider.GetRequiredService<IPaymentMethodHandler<Payments.Lightning.LightningSupportedPaymentMethod>>();
@@ -135,7 +153,7 @@ namespace BTCPayServer.Controllers
                             await handler.TestConnection(info, cts.Token);
                         }
                     }
-                    vm.StatusMessage = $"Connection to the lightning node succeed ({info})";
+                    vm.StatusMessage = $"Connection to the lightning node succeeded ({info})";
                 }
                 catch (Exception ex)
                 {

BTCPayServer/Controllers/UserStoresController.cs

@@ -121,7 +121,10 @@ namespace BTCPayServer.Controllers
             var store = await _Repo.CreateStore(GetUserId(), vm.Name);
             CreatedStoreId = store.Id;
             StatusMessage = "Store successfully created";
-            return RedirectToAction(nameof(ListStores));
+            return RedirectToAction(nameof(StoresController.UpdateStore), "Stores", new
+            {
+                storeId = store.Id
+            });
         }
 
         private static async Task<string> GetBalanceString((BTCPayWallet Wallet, DerivationStrategyBase DerivationStrategy) _)

BTCPayServer/Extensions.cs

@@ -98,6 +98,26 @@ namespace BTCPayServer
             return str + "/";
         }
 
+        public static void SetHeaderOnStarting(this HttpResponse resp, string name, string value)
+        {
+            if (resp.HasStarted)
+                return;
+            resp.OnStarting(() =>
+            {
+                SetHeader(resp, name, value);
+                return Task.CompletedTask;
+            });
+        }
+
+        public static void SetHeader(this HttpResponse resp, string name, string value)
+        {
+            var existing = resp.Headers[name].FirstOrDefault();
+            if (existing != null && value == null)
+                resp.Headers.Remove(name);
+            else
+                resp.Headers[name] = value;
+        }
+
         public static string GetAbsoluteRoot(this HttpRequest request)
         {
             return string.Concat(
@@ -109,7 +129,7 @@ namespace BTCPayServer
 
         public static string GetAbsoluteUri(this HttpRequest request, string redirectUrl)
         {
-            bool isRelative = 
+            bool isRelative =
                 (redirectUrl.Length > 0 && redirectUrl[0] == '/')
                 || !new Uri(redirectUrl, UriKind.RelativeOrAbsolute).IsAbsoluteUri;
             return isRelative ? request.GetAbsoluteRoot() + redirectUrl : redirectUrl;
@@ -141,7 +161,7 @@ namespace BTCPayServer
 
         public static void AddRange<T>(this HashSet<T> hashSet, IEnumerable<T> items)
         {
-            foreach(var item in items)
+            foreach (var item in items)
             {
                 hashSet.Add(item);
             }
@@ -157,6 +177,15 @@ namespace BTCPayServer
             NBitcoin.Extensions.TryAdd(ctx.Items, "BitpayAuth", value);
         }
 
+        public static async Task<T> WithCancellation<T>(this Task<T> task, CancellationToken cancellationToken)
+        {
+            var waiting = Task.Delay(-1, cancellationToken);
+            var doing = task;
+            await Task.WhenAny(waiting, doing);
+            cancellationToken.ThrowIfCancellationRequested();
+            return await doing;
+        }
+
         public static (string Signature, String Id, String Authorization) GetBitpayAuth(this HttpContext ctx)
         {
             ctx.Items.TryGetValue("BitpayAuth", out object obj);

BTCPayServer/Filters/ContentSecurityPolicyAttribute.cs

@@ -0,0 +1,106 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using BTCPayServer.Security;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace BTCPayServer.Filters
+{
+    public interface IContentSecurityPolicy : IFilterMetadata { }
+    public class ContentSecurityPolicyAttribute : Attribute, IActionFilter, IContentSecurityPolicy
+    {
+        public void OnActionExecuted(ActionExecutedContext context)
+        {
+
+        }
+
+        public bool AutoSelf { get; set; } = true;
+        public bool UnsafeInline { get; set; } = true;
+        public bool FixWebsocket { get; set; } = true;
+        public string FontSrc { get; set; } = null;
+        public string ImgSrc { get; set; } = null;
+        public string DefaultSrc { get; set; }
+        public string StyleSrc { get; set; }
+        public string ScriptSrc { get; set; }
+
+        public void OnActionExecuting(ActionExecutingContext context)
+        {
+            if (context.IsEffectivePolicy<IContentSecurityPolicy>(this))
+            {
+                var policies = context.HttpContext.RequestServices.GetService(typeof(ContentSecurityPolicies)) as ContentSecurityPolicies;
+                if (policies == null)
+                    return;
+                if (DefaultSrc != null)
+                {
+                    policies.Add(new ConsentSecurityPolicy("default-src", DefaultSrc));
+                }
+                if (UnsafeInline)
+                {
+                    policies.Add(new ConsentSecurityPolicy("script-src", "'unsafe-inline'"));
+                }
+                if (!string.IsNullOrEmpty(FontSrc))
+                {
+                    policies.Add(new ConsentSecurityPolicy("font-src", FontSrc));
+                }
+
+                if (!string.IsNullOrEmpty(ImgSrc))
+                {
+                    policies.Add(new ConsentSecurityPolicy("img-src", ImgSrc));
+                }
+
+                if (!string.IsNullOrEmpty(StyleSrc))
+                {
+                    policies.Add(new ConsentSecurityPolicy("style-src", StyleSrc));
+                }
+
+                if (!string.IsNullOrEmpty(ScriptSrc))
+                {
+                    policies.Add(new ConsentSecurityPolicy("script-src", ScriptSrc));
+                }
+
+                if (FixWebsocket && AutoSelf) // Self does not match wss:// and ws:// :(
+                {
+                    var request = context.HttpContext.Request;
+
+                    var url = string.Concat(
+                            request.Scheme.Equals("http", StringComparison.OrdinalIgnoreCase) ? "ws" : "wss",
+                            "://",
+                            request.Host.ToUriComponent(),
+                            request.PathBase.ToUriComponent());
+                    policies.Add(new ConsentSecurityPolicy("connect-src", url));
+                }
+
+                context.HttpContext.Response.OnStarting(() =>
+                {
+                    if (!policies.HasRules)
+                        return Task.CompletedTask;
+                    if (AutoSelf)
+                    {
+                        bool hasSelf = false;
+                        foreach (var group in policies.Rules.GroupBy(p => p.Name))
+                        {
+                            hasSelf = group.Any(g => g.Value.Contains("'self'", StringComparison.OrdinalIgnoreCase));
+                            if (!hasSelf && !group.Any(g => g.Value.Contains("'none'", StringComparison.OrdinalIgnoreCase) ||
+                                               g.Value.Contains("*", StringComparison.OrdinalIgnoreCase)))
+                            {
+                                policies.Add(new ConsentSecurityPolicy(group.Key, "'self'"));
+                                hasSelf = true;
+                            }
+                            if (hasSelf)
+                            {
+                                foreach (var authorized in policies.Authorized)
+                                {
+                                    policies.Add(new ConsentSecurityPolicy(group.Key, authorized));
+                                }
+                            }
+                        }
+                    }
+                    context.HttpContext.Response.SetHeader("Content-Security-Policy", policies.ToString());
+                    return Task.CompletedTask;
+                });
+            }
+        }
+    }
+}

BTCPayServer/Filters/ReferrerPolicyAttribute.cs

@@ -0,0 +1,30 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace BTCPayServer.Filters
+{
+    public interface IReferrerPolicy : IFilterMetadata { }
+    public class ReferrerPolicyAttribute : Attribute, IActionFilter
+    {
+        public ReferrerPolicyAttribute(string value)
+        {
+            Value = value;
+        }
+        public string Value { get; set; }
+        public void OnActionExecuted(ActionExecutedContext context)
+        {
+
+        }
+
+        public void OnActionExecuting(ActionExecutingContext context)
+        {
+            if (context.IsEffectivePolicy<ReferrerPolicyAttribute>(this))
+            {
+                context.HttpContext.Response.SetHeaderOnStarting("Referrer-Policy", Value);
+            }
+        }
+    }
+}

BTCPayServer/Filters/XContentTypeOptionsAttribute.cs

@@ -0,0 +1,25 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace BTCPayServer.Filters
+{
+    public class XContentTypeOptionsAttribute : Attribute, IActionFilter
+    {
+        public XContentTypeOptionsAttribute(string value)
+        {
+            Value = value;
+        }
+        public void OnActionExecuted(ActionExecutedContext context)
+        {
+        }
+
+        public string Value { get; set; }
+        public void OnActionExecuting(ActionExecutingContext context)
+        {
+            context.HttpContext.Response.SetHeaderOnStarting("X-Content-Type-Options", Value);
+        }
+    }
+}

BTCPayServer/Filters/XFrameOptionsAttribute.cs

@@ -23,11 +23,7 @@ namespace BTCPayServer.Filters
 
         public void OnActionExecuting(ActionExecutingContext context)
         {
-            var existing = context.HttpContext.Response.Headers["x-frame-options"].FirstOrDefault();
-            if (existing != null && Value == null)
-                context.HttpContext.Response.Headers.Remove("x-frame-options");
-            else
-                context.HttpContext.Response.Headers["x-frame-options"] = Value;
+            context.HttpContext.Response.SetHeaderOnStarting("X-Frame-Options", Value);
         }
     }
 }

BTCPayServer/Filters/XXSSProtectionAttribute.cs

@@ -0,0 +1,23 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.AspNetCore.Mvc.ViewFeatures.Internal;
+
+namespace BTCPayServer.Filters
+{
+    public class XXSSProtectionAttribute : Attribute, IActionFilter
+    {
+        public void OnActionExecuted(ActionExecutedContext context)
+        {
+        }
+
+        public void OnActionExecuting(ActionExecutingContext context)
+        {
+            context.HttpContext.Response.SetHeaderOnStarting("X-XSS-Protection", "1; mode=block");
+        }
+        
+    }
+}

BTCPayServer/HostedServices/CssThemeManager.cs

@@ -11,6 +11,8 @@ using NBXplorer.Models;
 using System.Collections.Concurrent;
 using BTCPayServer.Events;
 using BTCPayServer.Services;
+using Microsoft.AspNetCore.Mvc.Filters;
+using BTCPayServer.Security;
 
 namespace BTCPayServer.HostedServices
 {
@@ -50,6 +52,33 @@ namespace BTCPayServer.HostedServices
         }
     }
 
+    public class ContentSecurityPolicyCssThemeManager : Attribute, IActionFilter, IOrderedFilter
+    {
+        public int Order => 1001;
+
+        public void OnActionExecuted(ActionExecutedContext context)
+        {
+            
+        }
+
+        public void OnActionExecuting(ActionExecutingContext context)
+        {
+            var manager = context.HttpContext.RequestServices.GetService(typeof(CssThemeManager)) as CssThemeManager;
+            var policies = context.HttpContext.RequestServices.GetService(typeof(ContentSecurityPolicies)) as ContentSecurityPolicies;
+            if (manager != null && policies != null)
+            {
+                if(manager.CreativeStartUri != null && Uri.TryCreate(manager.CreativeStartUri, UriKind.Absolute, out var uri))
+                {
+                    policies.Clear();
+                }
+                if (manager.BootstrapUri != null && Uri.TryCreate(manager.BootstrapUri, UriKind.Absolute, out uri))
+                {
+                    policies.Clear();
+                }
+            }
+        }
+    }
+
     public class CssThemeManagerHostedService : BaseAsyncService
     {
         private SettingsRepository _SettingsRepository;

BTCPayServer/Hosting/BTCPayServerServices.cs

@@ -104,6 +104,7 @@ namespace BTCPayServer.Hosting
             });
 
             services.AddSingleton<CssThemeManager>();
+            services.Configure<MvcOptions>((o) => { o.Filters.Add(new ContentSecurityPolicyCssThemeManager()); });
             services.AddSingleton<IHostedService, CssThemeManagerHostedService>();
 
             services.AddSingleton<Payments.IPaymentMethodHandler<DerivationStrategy>, Payments.Bitcoin.BitcoinLikePaymentHandler>();

BTCPayServer/Hosting/Startup.cs

@@ -39,6 +39,7 @@ using Microsoft.AspNetCore.Mvc.Cors.Internal;
 using Microsoft.AspNetCore.Server.Kestrel.Core;
 using System.Net;
 using Meziantou.AspNetCore.BundleTagHelpers;
+using BTCPayServer.Security;
 
 namespace BTCPayServer.Hosting
 {
@@ -79,8 +80,19 @@ namespace BTCPayServer.Hosting
             services.AddMvc(o =>
             {
                 o.Filters.Add(new XFrameOptionsAttribute("DENY"));
+                o.Filters.Add(new XContentTypeOptionsAttribute("nosniff"));
+                o.Filters.Add(new XXSSProtectionAttribute());
+                o.Filters.Add(new ReferrerPolicyAttribute("same-origin"));
+                //o.Filters.Add(new ContentSecurityPolicyAttribute()
+                //{
+                //    FontSrc = "'self' https://fonts.gstatic.com/",
+                //    ImgSrc = "'self' data:",
+                //    DefaultSrc = "'none'",
+                //    StyleSrc = "'self' 'unsafe-inline'",
+                //    ScriptSrc = "'self' 'unsafe-inline'"
+                //});
             });
-
+            services.TryAddScoped<ContentSecurityPolicies>();
             services.Configure<IdentityOptions>(options =>
             {
                 options.Password.RequireDigit = false;

BTCPayServer/Logging/Logs.cs

@@ -15,9 +15,14 @@ namespace BTCPayServer.Logging
         }
         public static void Configure(ILoggerFactory factory)
         {
-            Configuration = factory.CreateLogger("Configuration");
-            PayServer = factory.CreateLogger("PayServer");
-            Events = factory.CreateLogger("Events");
+            if (factory == null)
+                Configure(new FuncLoggerFactory(n => NullLogger.Instance));
+            else
+            {
+                Configuration = factory.CreateLogger("Configuration");
+                PayServer = factory.CreateLogger("PayServer");
+                Events = factory.CreateLogger("Events");
+            }
         }
         public static ILogger Configuration
         {

BTCPayServer/Models/StoreViewModels/LightningNodeViewModel.cs

@@ -9,8 +9,8 @@ namespace BTCPayServer.Models.StoreViewModels
 {
     public class LightningNodeViewModel
     {
-        [Display(Name = "Lightning charge url")]
-        public string Url
+        [Display(Name = "Connection string")]
+        public string ConnectionString
         {
             get;
             set;

BTCPayServer/Payments/Lightning/LightningClientFactory.cs

@@ -4,6 +4,8 @@ using System.Linq;
 using System.Threading.Tasks;
 using BTCPayServer.Payments.Lightning.Charge;
 using BTCPayServer.Payments.Lightning.CLightning;
+using NBitcoin;
+using BTCPayServer.Payments.Lightning.Lnd;
 
 namespace BTCPayServer.Payments.Lightning
 {
@@ -12,16 +14,38 @@ namespace BTCPayServer.Payments.Lightning
         public ILightningInvoiceClient CreateClient(LightningSupportedPaymentMethod supportedPaymentMethod, BTCPayNetwork network)
         {
             var uri = supportedPaymentMethod.GetLightningUrl();
-            if (uri.ConnectionType == LightningConnectionType.Charge)
+            return CreateClient(uri, network.NBitcoinNetwork);
+        }
+
+        public static ILightningInvoiceClient CreateClient(LightningConnectionString connString, Network network)
+        {
+            if (connString.ConnectionType == LightningConnectionType.Charge)
             {
-                return new ChargeClient(uri.ToUri(true), network.NBitcoinNetwork);
+                return new ChargeClient(connString.ToUri(true), network);
             }
-            else if (uri.ConnectionType == LightningConnectionType.CLightning)
+            else if (connString.ConnectionType == LightningConnectionType.CLightning)
             {
-                return new CLightningRPCClient(uri.ToUri(false), network.NBitcoinNetwork);
+                return new CLightningRPCClient(connString.ToUri(false), network);
+            }
+            else if (connString.ConnectionType == LightningConnectionType.LndREST)
+            {
+                return new LndInvoiceClient(new LndSwaggerClient(new LndRestSettings(connString.BaseUri)
+                {
+                    Macaroon = connString.Macaroon,
+                    MacaroonFilePath = connString.MacaroonFilePath,
+                    CertificateThumbprint = connString.CertificateThumbprint,
+                    AllowInsecure = connString.AllowInsecure,
+                }));
             }
             else
-                throw new NotSupportedException($"Unsupported connection string for lightning server ({uri.ConnectionType})");
+                throw new NotSupportedException($"Unsupported connection string for lightning server ({connString.ConnectionType})");
+        }
+
+        public static ILightningInvoiceClient CreateClient(string connectionString, Network network)
+        {
+            if (!Payments.Lightning.LightningConnectionString.TryParse(connectionString, false, out var conn, out string error))
+                throw new FormatException($"Invalid format ({error})");
+            return Payments.Lightning.LightningClientFactory.CreateClient(conn, network);
         }
     }
 }

BTCPayServer/Payments/Lightning/LightningConnectionString.cs

@@ -1,25 +1,288 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.WebUtilities;
+using Microsoft.Extensions.Primitives;
+using NBitcoin.DataEncoders;
 
 namespace BTCPayServer.Payments.Lightning
 {
     public enum LightningConnectionType
     {
         Charge,
-        CLightning
+        CLightning,
+        LndREST
     }
     public class LightningConnectionString
     {
-        public static bool TryParse(string str, out LightningConnectionString connectionString)
+        static Dictionary<string, LightningConnectionType> typeMapping;
+        static Dictionary<LightningConnectionType, string> typeMappingReverse;
+        static LightningConnectionString()
         {
-            return TryParse(str, out connectionString, out var error);
+            typeMapping = new Dictionary<string, LightningConnectionType>();
+            typeMapping.Add("clightning", LightningConnectionType.CLightning);
+            typeMapping.Add("charge", LightningConnectionType.Charge);
+            typeMapping.Add("lnd-rest", LightningConnectionType.LndREST);
+            typeMappingReverse = new Dictionary<LightningConnectionType, string>();
+            foreach (var kv in typeMapping)
+            {
+                typeMappingReverse.Add(kv.Value, kv.Key);
+            }
         }
-        public static bool TryParse(string str, out LightningConnectionString connectionString, out string error)
+        public static bool TryParse(string str, bool supportLegacy, out LightningConnectionString connectionString)
+        {
+            return TryParse(str, supportLegacy, out connectionString, out var error);
+        }
+        public static bool TryParse(string str, bool supportLegacy, out LightningConnectionString connectionString, out string error)
         {
             if (str == null)
                 throw new ArgumentNullException(nameof(str));
+
+            if (supportLegacy)
+            {
+                var parsed = TryParseLegacy(str, out connectionString, out error);
+                if (!parsed)
+                {
+                    parsed = TryParseNewFormat(str, out connectionString, out error);
+                }
+                return parsed;
+            }
+            else
+            {
+                return TryParseNewFormat(str, out connectionString, out error);
+            }
+        }
+
+        private static bool TryParseNewFormat(string str, out LightningConnectionString connectionString, out string error)
+        {
+            connectionString = null;
+            error = null;
+            var parts = str.Split(new char[] { ';' }, StringSplitOptions.RemoveEmptyEntries);
+            Dictionary<string, string> keyValues = new Dictionary<string, string>();
+            foreach (var part in parts.Select(p => p.Trim()))
+            {
+                var idx = part.IndexOf('=', StringComparison.OrdinalIgnoreCase);
+                if (idx == -1)
+                {
+                    error = "The format of the connectionString should a list of key=value delimited by semicolon";
+                    return false;
+                }
+                var key = part.Substring(0, idx).Trim().ToLowerInvariant();
+                var value = part.Substring(idx + 1).Trim();
+                if (keyValues.ContainsKey(key))
+                {
+                    error = $"Duplicate key {key}";
+                    return false;
+                }
+                keyValues.Add(key, value);
+            }
+
+            var possibleTypes = String.Join(", ", typeMapping.Select(k => k.Key).ToArray());
+
+            LightningConnectionString result = new LightningConnectionString();
+            var type = Take(keyValues, "type");
+            if (type == null)
+            {
+                error = $"The key 'type' is mandatory, possible values are {possibleTypes}";
+                return false;
+            }
+
+            if (!typeMapping.TryGetValue(type.ToLowerInvariant(), out var connectionType))
+            {
+                error = $"The key 'type' is invalid, possible values are {possibleTypes}";
+                return false;
+            }
+
+            result.ConnectionType = connectionType;
+
+            switch (connectionType)
+            {
+                case LightningConnectionType.Charge:
+                    {
+                        var server = Take(keyValues, "server");
+                        if (server == null)
+                        {
+                            error = $"The key 'server' is mandatory for charge connection strings";
+                            return false;
+                        }
+
+                        if (!Uri.TryCreate(server, UriKind.Absolute, out var uri)
+                            || (uri.Scheme != "http" && uri.Scheme != "https"))
+                        {
+                            error = $"The key 'server' should be an URI starting by http:// or https://";
+                            return false;
+                        }
+
+                        parts = uri.UserInfo.Split(':');
+                        if (!string.IsNullOrEmpty(uri.UserInfo) && parts.Length == 2)
+                        {
+                            result.Username = parts[0];
+                            result.Password = parts[1];
+                        }
+                        else
+                        {
+                            var apiToken = Take(keyValues, "api-token");
+                            if (apiToken == null)
+                            {
+                                error = "The key 'api-token' is not found";
+                                return false;
+                            }
+                            result.Username = "api-token";
+                            result.Password = apiToken;
+                        }
+                        result.BaseUri = new UriBuilder(uri) { UserName = "", Password = "" }.Uri;
+                    }
+                    break;
+                case LightningConnectionType.CLightning:
+                    {
+                        var server = Take(keyValues, "server");
+                        if (server == null)
+                        {
+                            error = $"The key 'server' is mandatory for charge connection strings";
+                            return false;
+                        }
+
+                        if (server.StartsWith("//", StringComparison.OrdinalIgnoreCase))
+                            server = "unix:" + str;
+                        else if (server.StartsWith("/", StringComparison.OrdinalIgnoreCase))
+                            server = "unix:/" + str;
+
+                        if (!Uri.TryCreate(server, UriKind.Absolute, out var uri)
+                            || (uri.Scheme != "tcp" && uri.Scheme != "unix"))
+                        {
+                            error = $"The key 'server' should be an URI starting by tcp:// or unix:// or a path to the 'lightning-rpc' unix socket";
+                            return false;
+                        }
+                        result.BaseUri = uri;
+                    }
+                    break;
+                case LightningConnectionType.LndREST:
+                    {
+                        var server = Take(keyValues, "server");
+                        if (server == null)
+                        {
+                            error = $"The key 'server' is mandatory for lnd connection strings";
+                            return false;
+                        }
+                        if (!Uri.TryCreate(server, UriKind.Absolute, out var uri)
+                            || (uri.Scheme != "http" && uri.Scheme != "https"))
+                        {
+                            error = $"The key 'server' should be an URI starting by http:// or https://";
+                            return false;
+                        }
+                        parts = uri.UserInfo.Split(':');
+                        if (!string.IsNullOrEmpty(uri.UserInfo) && parts.Length == 2)
+                        {
+                            result.Username = parts[0];
+                            result.Password = parts[1];
+                        }
+                        result.BaseUri = new UriBuilder(uri) { UserName = "", Password = "" }.Uri;
+
+                        var macaroon = Take(keyValues, "macaroon");
+                        if (macaroon != null)
+                        {
+                            try
+                            {
+                                result.Macaroon = Encoder.DecodeData(macaroon);
+                            }
+                            catch
+                            {
+                                error = $"The key 'macaroon' format should be in hex";
+                                return false;
+                            }
+                        }
+
+                        var macaroonFilePath = Take(keyValues, "macaroonfilepath");
+                        if (macaroonFilePath != null)
+                        {
+                            if(macaroon != null)
+                            {
+                                error = $"The key 'macaroon' is already specified";
+                                return false;
+                            }
+                            if(!macaroonFilePath.EndsWith(".macaroon", StringComparison.OrdinalIgnoreCase))
+                            {
+                                error = $"The key 'macaroonfilepath' should point to a .macaroon file";
+                                return false;
+                            }
+                            result.MacaroonFilePath = macaroonFilePath;
+                        }
+
+                        string securitySet = null;
+                        var certthumbprint = Take(keyValues, "certthumbprint");
+                        if (certthumbprint != null)
+                        {
+                            try
+                            {
+                                var bytes = Encoders.Hex.DecodeData(certthumbprint.Replace(":", string.Empty, StringComparison.OrdinalIgnoreCase));
+                                if (bytes.Length != 32)
+                                {
+                                    error = $"The key 'certthumbprint' has invalid length: it should be the SHA256 of the PEM format of the certificate (32 bytes)";
+                                    return false;
+                                }
+                                result.CertificateThumbprint = bytes;
+                            }
+                            catch
+                            {
+                                error = $"The key 'certthumbprint' has invalid format: it should be the SHA256 of the PEM format of the certificate";
+                                return false;
+                            }
+                            securitySet = "certthumbprint";
+                        }
+
+                        var allowinsecureStr = Take(keyValues, "allowinsecure");
+
+                        if (allowinsecureStr != null)
+                        {
+                            var allowedValues = new[] { "true", "false" };
+                            if (!allowedValues.Any(v => v.Equals(allowinsecureStr, StringComparison.OrdinalIgnoreCase)))
+                            {
+                                error = $"The key 'allowinsecure' should be true or false";
+                                return false;
+                            }
+
+                            bool allowInsecure = allowinsecureStr.Equals("true", StringComparison.OrdinalIgnoreCase);
+                            if (securitySet != null && allowInsecure)
+                            {
+                                error = $"The key 'allowinsecure' conflict with '{securitySet}'";
+                                return false;
+                            }
+                            result.AllowInsecure = allowInsecure;
+                        }
+
+                        if (!result.AllowInsecure && result.BaseUri.Scheme == "http")
+                        {
+                            error = $"The key 'allowinsecure' is false, but server's Uri is not using https";
+                            return false;
+                        }
+                    }
+                    break;
+                default:
+                    throw new NotSupportedException(connectionType.ToString());
+            }
+
+            if (keyValues.Count != 0)
+            {
+                error = $"Unknown keys ({String.Join(", ", keyValues.Select(k => k.Key).ToArray())})";
+                return false;
+            }
+
+            connectionString = result;
+            return true;
+        }
+        private static string Take(Dictionary<string, string> keyValues, string key)
+        {
+            if (keyValues.TryGetValue(key, out var v))
+                keyValues.Remove(key);
+            return v;
+        }
+
+        private static bool TryParseLegacy(string str, out LightningConnectionString connectionString, out string error)
+        {
             if (str.StartsWith('/'))
                 str = "unix:" + str;
             var result = new LightningConnectionString();
@@ -27,7 +290,7 @@ namespace BTCPayServer.Payments.Lightning
             error = null;
 
             Uri uri;
-            if (!System.Uri.TryCreate(str, UriKind.Absolute, out uri))
+            if (!Uri.TryCreate(str, UriKind.Absolute, out uri))
             {
                 error = "Invalid URL";
                 return false;
@@ -40,7 +303,6 @@ namespace BTCPayServer.Payments.Lightning
                 error = $"The url support the following protocols {protocols}";
                 return false;
             }
-
             if (uri.Scheme == "unix")
             {
                 str = uri.AbsoluteUri.Substring("unix:".Length);
@@ -49,8 +311,12 @@ namespace BTCPayServer.Payments.Lightning
                     str = str.Substring(1);
                 }
                 uri = new Uri("unix://" + str, UriKind.Absolute);
+                result.ConnectionType = LightningConnectionType.CLightning;
             }
 
+            if (uri.Scheme == "tcp")
+                result.ConnectionType = LightningConnectionType.CLightning;
+
             if (uri.Scheme == "http" || uri.Scheme == "https")
             {
                 var parts = uri.UserInfo.Split(':');
@@ -61,6 +327,7 @@ namespace BTCPayServer.Payments.Lightning
                 }
                 result.Username = parts[0];
                 result.Password = parts[1];
+                result.ConnectionType = LightningConnectionType.Charge;
             }
             else if (!string.IsNullOrEmpty(uri.UserInfo))
             {
@@ -68,6 +335,7 @@ namespace BTCPayServer.Payments.Lightning
                 return false;
             }
             result.BaseUri = new UriBuilder(uri) { UserName = "", Password = "" }.Uri;
+            result.IsLegacy = true;
             connectionString = result;
             return true;
         }
@@ -80,15 +348,17 @@ namespace BTCPayServer.Payments.Lightning
         public string Username { get; set; }
         public string Password { get; set; }
         public Uri BaseUri { get; set; }
+        public bool IsLegacy { get; private set; }
 
         public LightningConnectionType ConnectionType
         {
-            get
-            {
-                return BaseUri.Scheme == "http" || BaseUri.Scheme == "https" ? LightningConnectionType.Charge 
-                    : LightningConnectionType.CLightning;
-            }
+            get;
+            private set;
         }
+        public byte[] Macaroon { get; set; }
+        public string MacaroonFilePath { get; set; }
+        public byte[] CertificateThumbprint { get; set; }
+        public bool AllowInsecure { get; set; }
 
         public Uri ToUri(bool withCredentials)
         {
@@ -101,10 +371,57 @@ namespace BTCPayServer.Payments.Lightning
                 return BaseUri;
             }
         }
-
+        static NBitcoin.DataEncoders.DataEncoder Encoder = NBitcoin.DataEncoders.Encoders.Hex;
         public override string ToString()
         {
-            return ToUri(true).AbsoluteUri;
+            var type = typeMappingReverse[ConnectionType];
+            StringBuilder builder = new StringBuilder();
+            builder.Append($"type={type}");
+            switch (ConnectionType)
+            {
+                case LightningConnectionType.Charge:
+                    if (Username == null || Username == "api-token")
+                    {
+                        builder.Append($";server={BaseUri};api-token={Password}");
+                    }
+                    else
+                    {
+                        builder.Append($";server={ToUri(true)}");
+                    }
+                    break;
+                case LightningConnectionType.CLightning:
+                    builder.Append($";server={BaseUri}");
+                    break;
+                case LightningConnectionType.LndREST:
+                    if (Username == null)
+                    {
+                        builder.Append($";server={BaseUri}");
+                    }
+                    else
+                    {
+                        builder.Append($";server={ToUri(true)}");
+                    }
+                    if (Macaroon != null)
+                    {
+                        builder.Append($";macaroon={Encoder.EncodeData(Macaroon)}");
+                    }
+                    if (MacaroonFilePath != null)
+                    {
+                        builder.Append($";macaroonfilepath={MacaroonFilePath}");
+                    }
+                    if (CertificateThumbprint != null)
+                    {
+                        builder.Append($";certthumbprint={Encoders.Hex.EncodeData(CertificateThumbprint)}");
+                    }
+                    if (AllowInsecure)
+                    {
+                        builder.Append($";allowinsecure=true");
+                    }
+                    break;
+                default:
+                    throw new NotSupportedException(type);
+            }
+            return builder.ToString();
         }
     }
 }

BTCPayServer/Payments/Lightning/LightningLikePaymentHandler.cs

@@ -15,6 +15,8 @@ namespace BTCPayServer.Payments.Lightning
 {
     public class LightningLikePaymentHandler : PaymentMethodHandlerBase<LightningSupportedPaymentMethod>
     {
+        public static int LIGHTNING_TIMEOUT = 5000;
+
         NBXplorerDashboard _Dashboard;
         LightningClientFactory _LightningClientFactory;
         public LightningLikePaymentHandler(
@@ -41,7 +43,7 @@ namespace BTCPayServer.Payments.Lightning
             description = description.Replace("{StoreName}", store.StoreName ?? "", StringComparison.OrdinalIgnoreCase)
                                      .Replace("{ItemDescription}", invoice.ProductInformation.ItemDesc ?? "", StringComparison.OrdinalIgnoreCase)
                                      .Replace("{OrderId}", invoice.OrderId ?? "", StringComparison.OrdinalIgnoreCase);
-            using (var cts = new CancellationTokenSource(5000))
+            using (var cts = new CancellationTokenSource(LIGHTNING_TIMEOUT))
             {
                 try
                 {
@@ -70,7 +72,7 @@ namespace BTCPayServer.Payments.Lightning
             if (!_Dashboard.IsFullySynched(network.CryptoCode, out var summary))
                 throw new PaymentMethodUnavailableException($"Full node not available");
 
-            using (var cts = new CancellationTokenSource(5000))
+            using (var cts = new CancellationTokenSource(LIGHTNING_TIMEOUT))
             {
                 var client = _LightningClientFactory.CreateClient(supportedPaymentMethod, network);
                 LightningNodeInformation info = null;

BTCPayServer/Payments/Lightning/LightningSupportedPaymentMethod.cs

@@ -8,18 +8,41 @@ namespace BTCPayServer.Payments.Lightning
     public class LightningSupportedPaymentMethod : ISupportedPaymentMethod
     {
         public string CryptoCode { get; set; }
+
+        [Obsolete("Use Get/SetLightningUrl")]
+        public string Username { get; set; }
+        [Obsolete("Use Get/SetLightningUrl")]
+        public string Password { get; set; }
+
+        // This property MUST be after CryptoCode or else JSON serialization fails
+        public PaymentMethodId PaymentId => new PaymentMethodId(CryptoCode, PaymentTypes.LightningLike);
+
         [Obsolete("Use Get/SetLightningUrl")]
         public string LightningChargeUrl { get; set; }
 
+        [Obsolete("Use Get/SetLightningUrl")]
+        public string LightningConnectionString { get; set; }
+
         public LightningConnectionString GetLightningUrl()
         {
 #pragma warning disable CS0618 // Type or member is obsolete
-            var fullUri = new UriBuilder(LightningChargeUrl) { UserName = Username, Password = Password }.Uri.AbsoluteUri;
-            if(!LightningConnectionString.TryParse(fullUri, out var connectionString, out var error))
+            if (!string.IsNullOrEmpty(LightningConnectionString))
             {
-                throw new FormatException(error);
+                if (!BTCPayServer.Payments.Lightning.LightningConnectionString.TryParse(LightningConnectionString, false, out var connectionString, out var error))
+                {
+                    throw new FormatException(error);
+                }
+                return connectionString;
+            }
+            else
+            {
+                var fullUri = new UriBuilder(LightningChargeUrl) { UserName = Username, Password = Password }.Uri.AbsoluteUri;
+                if (!BTCPayServer.Payments.Lightning.LightningConnectionString.TryParse(fullUri, true, out var connectionString, out var error))
+                {
+                    throw new FormatException(error);
+                }
+                return connectionString;
             }
-            return connectionString;
 #pragma warning restore CS0618 // Type or member is obsolete
         }
 
@@ -29,16 +52,11 @@ namespace BTCPayServer.Payments.Lightning
                 throw new ArgumentNullException(nameof(connectionString));
 
 #pragma warning disable CS0618 // Type or member is obsolete
-            Username = connectionString.Username;
-            Password = connectionString.Password;
-            LightningChargeUrl = connectionString.BaseUri.AbsoluteUri;
+            LightningConnectionString = connectionString.ToString();
+            Username = null;
+            Password = null;
+            LightningChargeUrl = null;
 #pragma warning restore CS0618 // Type or member is obsolete
         }
-
-        [Obsolete("Use Get/SetLightningUrl")]
-        public string Username { get; set; }
-        [Obsolete("Use Get/SetLightningUrl")]
-        public string Password { get; set; }
-        public PaymentMethodId PaymentId => new PaymentMethodId(CryptoCode, PaymentTypes.LightningLike);
     }
 }

BTCPayServer/Payments/Lightning/Lnd/LndAuthentication.cs

@@ -0,0 +1,67 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net.Http;
+using System.Threading.Tasks;
+using NBitcoin.DataEncoders;
+
+namespace BTCPayServer.Payments.Lightning.Lnd
+{
+    public abstract class LndAuthentication
+    {
+        public class FixedMacaroonAuthentication : LndAuthentication
+        {
+            public FixedMacaroonAuthentication(byte[] macaroon)
+            {
+                if (macaroon == null)
+                    throw new ArgumentNullException(nameof(macaroon));
+                Macaroon = macaroon;
+            }
+            public byte[] Macaroon { get; set; }
+            public override void AddAuthentication(HttpRequestMessage httpRequest)
+            {
+                httpRequest.Headers.Add("Grpc-Metadata-macaroon", Encoders.Hex.EncodeData(Macaroon));
+            }
+        }
+        public class NullAuthentication : LndAuthentication
+        {
+            public static NullAuthentication Instance { get; } = new NullAuthentication();
+
+            private NullAuthentication()
+            {
+
+            }
+            public override void AddAuthentication(HttpRequestMessage httpRequest)
+            {
+            }
+        }
+
+        public class MacaroonFileAuthentication : LndAuthentication
+        {
+            public MacaroonFileAuthentication(string filePath)
+            {
+                if (filePath == null)
+                    throw new ArgumentNullException(nameof(filePath));
+                // Because this dump the whole file, let's make sure it is indeed the macaroon
+                if (!filePath.EndsWith(".macaroon", StringComparison.OrdinalIgnoreCase))
+                    throw new ArgumentException(message: "filePath is not a macaroon file", paramName: nameof(filePath));
+                FilePath = filePath;
+            }
+            public string FilePath { get; set; }
+            public override void AddAuthentication(HttpRequestMessage httpRequest)
+            {
+                try
+                {
+                    var bytes = File.ReadAllBytes(FilePath);
+                    httpRequest.Headers.Add("Grpc-Metadata-macaroon", Encoders.Hex.EncodeData(bytes));
+                }
+                catch
+                {
+                }
+            }
+        }
+
+        public abstract void AddAuthentication(HttpRequestMessage httpRequest);
+    }
+}

BTCPayServer/Payments/Lightning/Lnd/LndInvoiceClient.cs

@@ -0,0 +1,227 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Net.Security;
+using System.Security.Authentication;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
+using System.Threading;
+using System.Threading.Channels;
+using System.Threading.Tasks;
+using NBitcoin;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+
+namespace BTCPayServer.Payments.Lightning.Lnd
+{
+    public class LndInvoiceClient : ILightningInvoiceClient
+    {
+        class LndInvoiceClientSession : ILightningListenInvoiceSession
+        {
+            private LndSwaggerClient _Parent;
+            Channel<LightningInvoice> _Invoices = Channel.CreateBounded<LightningInvoice>(50);
+            CancellationTokenSource _Cts = new CancellationTokenSource();
+            ManualResetEventSlim _Stopped = new ManualResetEventSlim(false);
+
+            public LndInvoiceClientSession(LndSwaggerClient parent)
+            {
+                _Parent = parent;
+            }
+
+            public async void StartListening()
+            {
+                var urlBuilder = new StringBuilder();
+                urlBuilder.Append(_Parent.BaseUrl).Append("/v1/invoices/subscribe");
+                try
+                {
+                    using (var client = _Parent.CreateHttpClient())
+                    {
+                        client.Timeout = TimeSpan.FromMilliseconds(Timeout.Infinite);
+
+                        var request = new HttpRequestMessage(HttpMethod.Get, urlBuilder.ToString());
+
+                        using (var response = await client.SendAsync(
+                            request, HttpCompletionOption.ResponseHeadersRead, _Cts.Token))
+                        {
+                            using (var body = await response.Content.ReadAsStreamAsync())
+                            using (var reader = new StreamReader(body))
+                            {
+                                while (!_Cts.IsCancellationRequested)
+                                {
+                                    string line = await reader.ReadLineAsync().WithCancellation(_Cts.Token);
+                                    if (line != null && line.StartsWith("{\"result\":", StringComparison.OrdinalIgnoreCase))
+                                    {
+                                        var invoiceString = JObject.Parse(line)["result"].ToString();
+                                        LnrpcInvoice parsedInvoice = _Parent.Deserialize<LnrpcInvoice>(invoiceString);
+                                        await _Invoices.Writer.WriteAsync(ConvertLndInvoice(parsedInvoice));
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                catch when (_Cts.IsCancellationRequested)
+                {
+
+                }
+                finally
+                {
+                    _Stopped.Set();
+                }
+            }
+
+            public async Task<LightningInvoice> WaitInvoice(CancellationToken cancellation)
+            {
+                try
+                {
+                    return await _Invoices.Reader.ReadAsync(cancellation);
+                }
+                catch (ChannelClosedException)
+                {
+                    throw new TaskCanceledException();
+                }
+            }
+
+            public void Dispose()
+            {
+                _Cts.Cancel();
+                _Stopped.Wait();
+                _Invoices.Writer.Complete();
+            }
+        }
+
+
+        public LndSwaggerClient _rpcClient;
+
+        public LndInvoiceClient(LndSwaggerClient swaggerClient)
+        {
+            if (swaggerClient == null)
+                throw new ArgumentNullException(nameof(swaggerClient));
+            _rpcClient = swaggerClient;
+        }
+
+        public async Task<LightningInvoice> CreateInvoice(LightMoney amount, string description, TimeSpan expiry,
+            CancellationToken cancellation = default(CancellationToken))
+        {
+            var strAmount = ConvertInv.ToString(amount.ToUnit(LightMoneyUnit.Satoshi));
+            var strExpiry = ConvertInv.ToString(Math.Round(expiry.TotalSeconds, 0));
+            // lnd requires numbers sent as strings. don't ask
+            var resp = await _rpcClient.AddInvoiceAsync(new LnrpcInvoice
+            {
+                Value = strAmount,
+                Memo = description,
+                Expiry = strExpiry
+            });
+
+            var invoice = new LightningInvoice
+            {
+                Id = BitString(resp.R_hash),
+                Amount = amount,
+                BOLT11 = resp.Payment_request,
+                Status = "unpaid"
+            };
+            return invoice;
+        }
+
+        public async Task<LightningNodeInformation> GetInfo(CancellationToken cancellation = default(CancellationToken))
+        {
+            var resp = await _rpcClient.GetInfoAsync(cancellation);
+
+            var nodeInfo = new LightningNodeInformation
+            {
+                BlockHeight = (int?)resp.Block_height ?? 0,
+                NodeId = resp.Identity_pubkey
+            };
+
+
+            var node = await _rpcClient.GetNodeInfoAsync(resp.Identity_pubkey, cancellation);
+            if (node.Node.Addresses == null || node.Node.Addresses.Count == 0)
+                throw new Exception("Lnd External IP not set, make sure you use --externalip=$EXTERNALIP parameter on lnd");
+
+            var firstNodeInfo = node.Node.Addresses.First();
+            var externalHostPort = firstNodeInfo.Addr.Split(':');
+
+            nodeInfo.Address = externalHostPort[0];
+            nodeInfo.P2PPort = ConvertInv.ToInt32(externalHostPort[1]);
+
+            return nodeInfo;
+        }
+
+        public async Task<LightningInvoice> GetInvoice(string invoiceId, CancellationToken cancellation = default(CancellationToken))
+        {
+            var resp = await _rpcClient.LookupInvoiceAsync(invoiceId, null, cancellation);
+            return ConvertLndInvoice(resp);
+        }
+
+        public Task<ILightningListenInvoiceSession> Listen(CancellationToken cancellation = default(CancellationToken))
+        {
+            var session = new LndInvoiceClientSession(this._rpcClient);
+            session.StartListening();
+            return Task.FromResult<ILightningListenInvoiceSession>(session);
+        }
+
+        internal static LightningInvoice ConvertLndInvoice(LnrpcInvoice resp)
+        {
+            var invoice = new LightningInvoice
+            {
+                // TODO: Verify id corresponds to R_hash
+                Id = BitString(resp.R_hash),
+                Amount = new LightMoney(ConvertInv.ToInt64(resp.Value), LightMoneyUnit.Satoshi),
+                BOLT11 = resp.Payment_request,
+                Status = "unpaid"
+            };
+
+            if (resp.Settle_date != null)
+            {
+                invoice.PaidAt = DateTimeOffset.FromUnixTimeSeconds(ConvertInv.ToInt64(resp.Settle_date));
+                invoice.Status = "paid";
+            }
+            else
+            {
+                var invoiceExpiry = ConvertInv.ToInt64(resp.Creation_date) + ConvertInv.ToInt64(resp.Expiry);
+                if (DateTimeOffset.FromUnixTimeSeconds(invoiceExpiry) > DateTimeOffset.UtcNow)
+                {
+                    invoice.Status = "expired";
+                }
+            }
+            return invoice;
+        }
+
+
+        // utility static methods... maybe move to separate class
+        private static string BitString(byte[] bytes)
+        {
+            return BitConverter.ToString(bytes)
+                .Replace("-", "", StringComparison.InvariantCulture)
+                .ToLower(CultureInfo.InvariantCulture);
+        }
+
+        // Invariant culture conversion
+        public static class ConvertInv
+        {
+            public static int ToInt32(string str)
+            {
+                return Convert.ToInt32(str, CultureInfo.InvariantCulture.NumberFormat);
+            }
+
+            public static long ToInt64(string str)
+            {
+                return Convert.ToInt64(str, CultureInfo.InvariantCulture.NumberFormat);
+            }
+
+            public static string ToString(decimal d)
+            {
+                return d.ToString(CultureInfo.InvariantCulture);
+            }
+
+            public static string ToString(double d)
+            {
+                return d.ToString(CultureInfo.InvariantCulture);
+            }
+        }
+    }
+}

BTCPayServer/Payments/Lightning/Lnd/LndRestSettings.cs

@@ -0,0 +1,36 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace BTCPayServer.Payments.Lightning.Lnd
+{
+    public class LndRestSettings
+    {
+        public LndRestSettings()
+        {
+
+        }
+        public LndRestSettings(Uri uri)
+        {
+            Uri = uri;
+        }
+        public Uri Uri { get; set; }
+        /// <summary>
+        /// The SHA256 of the PEM certificate
+        /// </summary>
+        public byte[] CertificateThumbprint { get; set; }
+        public byte[] Macaroon { get; set; }
+        public bool AllowInsecure { get; set; }
+        public string MacaroonFilePath { get; set; }
+
+        public LndAuthentication CreateLndAuthentication()
+        {
+            if (Macaroon != null)
+                return new LndAuthentication.FixedMacaroonAuthentication(Macaroon);
+            if (!string.IsNullOrEmpty(MacaroonFilePath))
+                return new LndAuthentication.MacaroonFileAuthentication(MacaroonFilePath);
+            return LndAuthentication.NullAuthentication.Instance;
+        }
+    }
+}

BTCPayServer/Payments/Lightning/Lnd/LndSwaggerClient.partial.cs

@@ -0,0 +1,84 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Net.Http;
+using System.Net.Security;
+using System.Security.Authentication;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using NBitcoin.DataEncoders;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+
+namespace BTCPayServer.Payments.Lightning.Lnd
+{
+    public partial class LndSwaggerClient
+    {
+        public LndSwaggerClient(LndRestSettings settings)
+        {
+            if (settings == null)
+                throw new ArgumentNullException(nameof(settings));
+            _LndSettings = settings;
+            _Authentication = settings.CreateLndAuthentication();
+            BaseUrl = settings.Uri.AbsoluteUri.TrimEnd('/');
+            _httpClient = CreateHttpClient(settings);
+            _settings = new System.Lazy<Newtonsoft.Json.JsonSerializerSettings>(() =>
+            {
+                var json = new Newtonsoft.Json.JsonSerializerSettings();
+                UpdateJsonSerializerSettings(json);
+                return json;
+            });
+        }
+        LndRestSettings _LndSettings;
+        LndAuthentication _Authentication;
+
+        partial void PrepareRequest(HttpClient client, HttpRequestMessage request, string url)
+        {
+            _Authentication.AddAuthentication(request);
+        }
+
+        internal static HttpClient CreateHttpClient(LndRestSettings settings)
+        {
+            var handler = new HttpClientHandler
+            {
+                SslProtocols = SslProtocols.Tls12
+            };
+
+            var expectedThumbprint = settings.CertificateThumbprint?.ToArray();
+            if (expectedThumbprint != null)
+            {
+                handler.ServerCertificateCustomValidationCallback = (request, cert, chain, errors) =>
+                {
+                    var actualCert = chain.ChainElements[chain.ChainElements.Count - 1].Certificate;
+                    var hash = actualCert.GetCertHash(System.Security.Cryptography.HashAlgorithmName.SHA256);
+                    return hash.SequenceEqual(expectedThumbprint);
+                };
+            }
+
+            if (settings.AllowInsecure)
+            {
+                handler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
+            }
+            else
+            {
+                if (settings.Uri.Scheme == "http")
+                    throw new InvalidOperationException("AllowInsecure is set to false, but the URI is not using https");
+            }
+            return new HttpClient(handler);
+        }
+
+        internal HttpClient CreateHttpClient()
+        {
+            return LndSwaggerClient.CreateHttpClient(_LndSettings);
+        }
+
+        internal T Deserialize<T>(string str)
+        {
+            return JsonConvert.DeserializeObject<T>(str, _settings.Value);
+        }
+    }
+}

BTCPayServer/Program.cs

@@ -31,9 +31,14 @@ namespace BTCPayServer
             var logger = loggerFactory.CreateLogger("Configuration");
             try
             {
+                // This is the only way toat LoadArgs can print to console. Because LoadArgs is called by the HostBuilder before Logs.Configure is called
                 var conf = new DefaultConfiguration() { Logger = logger }.CreateConfiguration(args);
                 if (conf == null)
                     return;
+                Logs.Configure(loggerFactory);
+                new BTCPayServerOptions().LoadArgs(conf);
+                Logs.Configure(null);
+                /////
 
                 host = new WebHostBuilder()
                     .UseKestrel()
@@ -64,6 +69,8 @@ namespace BTCPayServer
             finally
             {
                 processor.Dispose();
+                if(host == null)
+                    Logs.Configuration.LogError("Configuration error");
                 if (host != null)
                     host.Dispose();
                 loggerProvider.Dispose();

BTCPayServer/Security/ContentSecurityPolicies.cs

@@ -0,0 +1,120 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace BTCPayServer.Security
+{
+    public class ConsentSecurityPolicy
+    {
+        public ConsentSecurityPolicy(string name, string value)
+        {
+            _Value = value;
+            _Name = name;
+        }
+
+
+        private readonly string _Name;
+        public string Name
+        {
+            get
+            {
+                return _Name;
+            }
+        }
+
+        private readonly string _Value;
+        public string Value
+        {
+            get
+            {
+                return _Value;
+            }
+        }
+
+
+        public override bool Equals(object obj)
+        {
+            ConsentSecurityPolicy item = obj as ConsentSecurityPolicy;
+            if (item == null)
+                return false;
+            return GetHashCode().Equals(item.GetHashCode());
+        }
+        public static bool operator ==(ConsentSecurityPolicy a, ConsentSecurityPolicy b)
+        {
+            if (System.Object.ReferenceEquals(a, b))
+                return true;
+            if (((object)a == null) || ((object)b == null))
+                return false;
+            return a.GetHashCode() == b.GetHashCode();
+        }
+
+        public static bool operator !=(ConsentSecurityPolicy a, ConsentSecurityPolicy b)
+        {
+            return !(a == b);
+        }
+
+        public override int GetHashCode()
+        {
+            return HashCode.Combine(Name, Value);
+        }
+    }
+    public class ContentSecurityPolicies
+    {
+        public ContentSecurityPolicies()
+        {
+
+        }
+        HashSet<ConsentSecurityPolicy> _Policies = new HashSet<ConsentSecurityPolicy>();
+        public void Add(ConsentSecurityPolicy policy)
+        {
+            if (_Policies.Any(p => p.Name == policy.Name && p.Value == policy.Name))
+                return;
+            _Policies.Add(policy);
+        }
+
+        public IEnumerable<ConsentSecurityPolicy> Rules => _Policies;
+        public bool HasRules => _Policies.Count != 0;
+
+        public override string ToString()
+        {
+            StringBuilder value = new StringBuilder();
+            bool firstGroup = true;
+            foreach(var group in Rules.GroupBy(r => r.Name))
+            {
+                if (!firstGroup)
+                {
+                    value.Append(';');
+                }
+                List<string> values = new List<string>();
+                values.Add(group.Key);
+                foreach (var v in group)
+                {
+                    values.Add(v.Value);
+                }
+                foreach(var i in authorized)
+                {
+                    values.Add(i);
+                }
+                value.Append(String.Join(" ", values.OfType<object>().ToArray()));
+                firstGroup = false;
+            }
+            return value.ToString();
+        }
+
+        internal void Clear()
+        {
+            authorized.Clear();
+            _Policies.Clear();
+        }
+
+        HashSet<string> authorized = new HashSet<string>();
+        internal void AddAllAuthorized(string v)
+        {
+            authorized.Add(v);
+        }
+
+        public IEnumerable<string> Authorized => authorized;
+    }
+}

BTCPayServer/Services/BTCPayServerEnvironment.cs

@@ -7,13 +7,17 @@ using System.Threading.Tasks;
 using System.Text;
 using NBXplorer;
 using NBitcoin;
+using Microsoft.AspNetCore.Http;
 
 namespace BTCPayServer.Services
 {
     public class BTCPayServerEnvironment
     {
-        public BTCPayServerEnvironment(IHostingEnvironment env, BTCPayNetworkProvider provider)
+        public BTCPayServerEnvironment(IHostingEnvironment env, BTCPayNetworkProvider provider, IHttpContextAccessor httpContext)
         {
+            ExpectedHost = httpContext.HttpContext.Request.Host.Value;
+            ExpectedDomain = httpContext.HttpContext.Request.Host.Host;
+            ExpectedProtocol = httpContext.HttpContext.Request.Scheme;
             Version = typeof(BTCPayServerEnvironment).GetTypeInfo().Assembly.GetCustomAttribute<AssemblyFileVersionAttribute>().Version;
 #if DEBUG
             Build = "Debug";
@@ -27,6 +31,11 @@ namespace BTCPayServer.Services
         {
             get; set;
         }
+
+        public string ExpectedDomain { get; set; }
+        public string ExpectedHost { get; set; }
+        public string ExpectedProtocol { get; set; }
+
         public NetworkType NetworkType { get; set; }
         public string Version
         {

BTCPayServer/Views/Apps/UpdatePointOfSale.cshtml

@@ -74,8 +74,8 @@
 </section>
 
 @section Scripts {
-    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/styles/default.min.css">
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/highlight.min.js"></script>
+    <link rel="stylesheet" href="~/vendor/highlightjs/default.min.css">
+    <script src="~/vendor/highlightjs/highlight.min.js"></script>
     <script>hljs.initHighlightingOnLoad();</script>
 }
 

BTCPayServer/Views/Home/Home.cshtml

@@ -57,11 +57,14 @@
     <div class="container text-center">
         <h2>Video tutorials</h2>
         <div class="row">
-            <div class="col-md-6 text-center">
-                <iframe width="400" height="225" src="https://www.youtube.com/embed/xh3Eac66qc4" frameborder="0" allowfullscreen></iframe>
+            <div class="col-md-4 text-center">
+            </div>
+            <div class="col-md-4 text-center">
+                <a href="https://www.youtube.com/channel/UCpG9WL6TJuoNfFVkaDMp9ug" target="_blank">
+                    <img src="~/img/youtube.png" height="225" width="400" />
+                </a>
             </div>
             <div class="col-md-6 text-center">
-                <iframe width="400" height="225" src="https://www.youtube.com/embed/Xo_vApXTZBU" frameborder="0" allowfullscreen></iframe>
             </div>
         </div>
     </div>

BTCPayServer/Views/Shared/_Layout.cshtml

@@ -78,9 +78,19 @@
 
                 </ul>
             </div>
+            <div id="badUrl" class="alert alert-danger alert-dismissible" style="display:none; position:absolute; top:75px;" role="alert">
+                <button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
+                <span>BTCPay is expecting you to access this website from <b>@(env.ExpectedProtocol)://@(env.ExpectedHost)/</b>. If you want to change this expectation:</span>
+                <ul>
+                    <li>Either starts BTCPay with <b>--externalurl @(env.ExpectedProtocol)://@(env.ExpectedHost)/</b></li>
+                    <li>Or, if using docker-compose deployment, setting environment variable <b>BTCPAY_PROTOCOL=@(env.ExpectedProtocol)</b> and <b>BTCPAY_HOST=@(env.ExpectedDomain)</b></li>
+                </ul>
+                
+            </div>
         </div>
     </nav>
 
+
     @RenderBody()
 
     <footer class="siteFooter bg-dark text-white">
@@ -93,6 +103,14 @@
     }
 
     @RenderSection("Scripts", required: false)
+
+    <script type="text/javascript">
+        var expectedDomain = @Html.Raw(Json.Serialize(env.ExpectedHost));
+        var expectedProtocol = @Html.Raw(Json.Serialize(env.ExpectedProtocol));
+        if (window.location.host != expectedDomain || window.location.protocol != expectedProtocol + ":") {
+            document.getElementById("badUrl").style.display = "block";
+        }
+    </script>
 </body>
 
 </html>

BTCPayServer/Views/Stores/AddLightningNode.cshtml

@@ -7,38 +7,54 @@
 
 <h4>@ViewData["Title"]</h4>
 <partial name="_StatusMessage" for="StatusMessage" />
-<div class="row">
-    <div class="col-md-6">
-        <div asp-validation-summary="All" class="text-danger"></div>
-    </div>
-</div>
 
-<div class="alert alert-warning alert-dismissible" role="alert">
-    <button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
-    <p>
-        <span>A connection to a lightning charge node or clightning unix socket is required to generate lightning network enabled invoices. <br /></span>
-        <span>This is experimental and not advised for production so keep in mind:</span>
-    </p>
-    <ul>
-        <li>You might lose your money</li>
-        <li>The devs of BTCPay Server don't know what they are doing and won't be able to help you if shit hit the fan</li>
-        <li>You approve being #reckless and being the sole responsible party for your loss</li>
-        <li>BTCPay Server relies on a <a href="https://github.com/ElementsProject/lightning-charge">Lightning Charge</a> node or CLightning unix socket</li>
-        <li>If you have no idea what above mean, search by yourself</li>
-        <li>If you still have no idea how to use lightning, give up for now, we'll make it easier later</li>
-    </ul>
-</div>
 <div class="row">
-    <div class="col-md-8">
+    <div class="col-md-10">
         <form method="post">
             <div class="form-group">
-                <h5>Lightning node url</h5>
-                <span>This URL should point to an installed lightning charge server for @Model.CryptoCode</span>
+                <p>This connection string encapsulates the necessary information BTCPay needs to connect to your lightning node, we currently support:</p>
+                <ul>
+                    <li><code>clightning</code> via TCP or unix domain socket connection</li>
+                    <li><code>lightning charge</code> via HTTPS</li>
+                    <li><code>lnd</code> via the REST proxy</li>
+                </ul>
+                <table class="table table-sm table-responsive-md">
+                    <thead>
+                        <tr>
+                            <th>Examples</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+
+                        <tr>
+                            <th class="small"><b>type=</b>clightning;<b>server=</b>unix://root/.lightning/lightning-rpc</th>
+                        </tr>
+                        <tr>
+                            <th class="small"><b>type=</b>clightning;<b>server=</b>tcp://1.1.1.1:27743/</th>
+                        </tr>
+                        <tr>
+                            <th class="small"><b>type=</b>lnd-rest;<b>server=</b>http://mylnd:8080/;<b>macaroonfilepath=</b>/root/.lnd/admin.macaroon;<b>allowinsecure=</b>true</th>
+                        </tr>
+                        <tr>
+                            <th class="small"><b>type=</b>lnd-rest;<b>server=</b>https://mylnd:8080/;<b>macaroon=</b>abef263adfe...</th>
+                        </tr>
+                        <tr>
+                            <th class="small"><b>type=</b>lnd-rest;<b>server=</b>https://mylnd:8080/;<b>macaroon=</b>abef263adfe...;<b>certthumbprint=</b>abef263adfe...</th>
+                        </tr>
+                        <tr>
+                            <th class="small"><b>type=</b>charge;<b>server=</b>https://charge:8080/;<b>api-token=</b>myapitoken...</th>
+                        </tr>
+                    </tbody>
+                </table>
+                <p>Note that the <code>certthumbprint</code> to connect to your LND node can be obtained through this command line:</p>
+                <p><pre><code>openssl x509 -noout -fingerprint -sha256 -inform pem -in /root/.lnd/tls.cert</code></pre></p>
+                <p>You can omit <code>certthumprint</code> if you the certificate is trusted by your machine</p>
+                <p>You can set <code>allowinsecure</code> to <code>true</code> if your LND REST server is using HTTP or HTTPS with an untrusted certificate which you don't know the <code>certthumprint</code></p>
             </div>
             <div class="form-group">
-                <label asp-for="Url"></label>
-                <input id="lightningurl" asp-for="Url" class="form-control" />
-                <span asp-validation-for="Url" class="text-danger"></span>
+                <label asp-for="ConnectionString"></label>
+                <input id="lightningurl" asp-for="ConnectionString" class="form-control" />
+                <span asp-validation-for="ConnectionString" class="text-danger"></span>
                 @if(Model.InternalLightningNode != null)
                 {
                     <p class="form-text text-muted">

BTCPayServer/wwwroot/checkout/js/core.js

@@ -30,6 +30,7 @@ function onDataCallback(jsonData) {
         newStatus === "paid") {
         if ($(".modal-dialog").hasClass("expired")) {
             $(".modal-dialog").removeClass("expired");
+            $("#expired").removeClass("active");
         }
 
         $(".modal-dialog").addClass("paid");
@@ -39,6 +40,11 @@ function onDataCallback(jsonData) {
     }
 
     if (newStatus === "expired" || newStatus === "invalid") { //TODO: different state if the invoice is invalid (failed to confirm after timeout)
+        if ($(".modal-dialog").hasClass("paid")) {
+            $(".modal-dialog").removeClass("paid");
+            $("#paid").removeClass("active");
+        }
+
         $(".timer-row").removeClass("expiring-soon");
         $(".timer-row__spinner").html("");
         $("#emailAddressView").removeClass("active");

BTCPayServer/wwwroot/vendor/bootstrap4/css/bootstrap.css

@@ -2902,7 +2902,7 @@ tbody.collapse.show {
   border-color: rgba(0, 0, 0, 0.1); }
 
 .navbar-light .navbar-toggler-icon {
-  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(0, 0, 0, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E"); }
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(255, 255, 255, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E"); }
 
 .navbar-light .navbar-text {
   color: rgba(0, 0, 0, 0.5); }

BTCPayServer/wwwroot/vendor/highlightjs/default.min.css

@@ -0,0 +1 @@
+.hljs{display:block;overflow-x:auto;padding:0.5em;background:#F0F0F0}.hljs,.hljs-subst{color:#444}.hljs-comment{color:#888888}.hljs-keyword,.hljs-attribute,.hljs-selector-tag,.hljs-meta-keyword,.hljs-doctag,.hljs-name{font-weight:bold}.hljs-type,.hljs-string,.hljs-number,.hljs-selector-id,.hljs-selector-class,.hljs-quote,.hljs-template-tag,.hljs-deletion{color:#880000}.hljs-title,.hljs-section{color:#880000;font-weight:bold}.hljs-regexp,.hljs-symbol,.hljs-variable,.hljs-template-variable,.hljs-link,.hljs-selector-attr,.hljs-selector-pseudo{color:#BC6060}.hljs-literal{color:#78A960}.hljs-built_in,.hljs-bullet,.hljs-code,.hljs-addition{color:#397300}.hljs-meta{color:#1f7199}.hljs-meta-string{color:#4d99bf}.hljs-emphasis{font-style:italic}.hljs-strong{font-weight:bold}