ch_rds/dev/

btcpay.rs

//! Local BTCPay Server bootstrap helpers for development runners.

use std::collections::{BTreeMap, BTreeSet};
use std::env;
use std::fmt;
use std::fs;
use std::path::{Path, PathBuf};
use std::process::Command;
use std::time::{Duration, Instant};

use anyhow::{Context, Result, anyhow, bail, ensure};
use base64::Engine;
use reqwest::StatusCode;
use reqwest::blocking::{Client, RequestBuilder};
use ripemd::{Digest as RipemdDigest, Ripemd160};
use secp256k1::{PublicKey, Secp256k1, SecretKey};
use serde::Deserialize;
use serde_json::{Value, json};
use sha2::{Digest as ShaDigest, Sha256};
use uuid::Uuid;

const EXTENDED_PRIVATE_TO_PUBLIC_VERSIONS: &[([u8; 4], [u8; 4])] = &[
    ([0x04, 0x88, 0xad, 0xe4], [0x04, 0x88, 0xb2, 0x1e]),
    ([0x04, 0x35, 0x83, 0x94], [0x04, 0x35, 0x87, 0xcf]),
];

/// Project-owned metadata used by the local BTCPay development adapter.
#[derive(Clone, Eq, PartialEq)]
pub struct BtcpayDevProfile {
    display_name: String,
    env_prefix: String,
    store_name: String,
    api_key_label: String,
    rate_source: String,
    webhook_path: String,
    default_admin_email: String,
    public_url: String,
    local_docker: LocalDockerConfig,
    default_admin_password: Option<String>,
    default_payment_signing_key: Option<String>,
}

impl BtcpayDevProfile {
    /// Creates a local BTCPay profile with conservative development defaults.
    pub fn new(
        display_name: impl Into<String>,
        env_prefix: impl Into<String>,
        default_admin_email: impl Into<String>,
        public_url: impl Into<String>,
    ) -> Self {
        let display_name = display_name.into();
        let env_prefix = env_prefix.into();
        Self {
            store_name: display_name.clone(),
            api_key_label: format!("{display_name} local dev"),
            rate_source: "coingecko".to_owned(),
            webhook_path: "/api/payments/webhooks/btcpay".to_owned(),
            default_admin_email: default_admin_email.into(),
            public_url: public_url.into(),
            local_docker: LocalDockerConfig::new(env_prefix.to_ascii_lowercase()),
            display_name,
            env_prefix,
            default_admin_password: None,
            default_payment_signing_key: None,
        }
    }

    /// Overrides the local reverse-proxy ports.
    pub fn with_local_ports(mut self, http: u16, https: u16) -> Self {
        self.local_docker.reverseproxy_http_port = http;
        self.local_docker.reverseproxy_https_port = https;
        self
    }

    /// Overrides the generated BTCPay Compose project name.
    pub fn with_compose_project_name(mut self, name: impl Into<String>) -> Self {
        self.local_docker.compose_project_name = name.into();
        self
    }

    /// Overrides the BTCPay webhook path used by the application.
    pub fn with_webhook_path(mut self, path: impl Into<String>) -> Self {
        self.webhook_path = path.into();
        self
    }

    pub(super) fn validate(&self) -> Result<()> {
        for (field, value) in [
            ("display_name", self.display_name.as_str()),
            ("store_name", self.store_name.as_str()),
            ("api_key_label", self.api_key_label.as_str()),
            ("rate_source", self.rate_source.as_str()),
            ("default_admin_email", self.default_admin_email.as_str()),
            ("public_url", self.public_url.as_str()),
        ] {
            ensure!(
                !value.is_empty() && value.trim() == value && !value.chars().any(char::is_control),
                "payment profile {field} must be a non-empty single-line value"
            );
        }
        ensure!(
            self.env_prefix
                .bytes()
                .next()
                .is_some_and(|byte| byte.is_ascii_uppercase())
                && self
                    .env_prefix
                    .bytes()
                    .all(|byte| byte.is_ascii_uppercase() || byte.is_ascii_digit() || byte == b'_'),
            "payment profile env_prefix must use uppercase ASCII environment-key characters"
        );
        ensure!(
            self.webhook_path.starts_with('/')
                && !self.webhook_path.chars().any(char::is_whitespace),
            "payment profile webhook_path must be an absolute path without whitespace"
        );
        let public_url = url::Url::parse(&self.public_url)
            .context("payment profile public_url must be an absolute URL")?;
        ensure!(
            matches!(public_url.scheme(), "http" | "https")
                && public_url.host_str().is_some()
                && public_url.username().is_empty()
                && public_url.password().is_none(),
            "payment profile public_url must be an HTTP(S) URL without credentials"
        );
        self.local_docker.validate()?;
        Ok(())
    }

    pub(super) fn display_name(&self) -> &str {
        &self.display_name
    }

    pub(super) fn skip_btcpay_bootstrap_env_key(&self) -> String {
        self.env_key("SKIP_BTCPAY_BOOTSTRAP")
    }

    fn env_key(&self, suffix: &str) -> String {
        format!("{}_{}", self.env_prefix, suffix)
    }
}

#[derive(Clone, Debug)]
pub(super) struct LocalBtcpayBootstrapOptions {
    profile: BtcpayDevProfile,
    workspace_root: PathBuf,
    project_root: PathBuf,
    env_file: PathBuf,
}

impl LocalBtcpayBootstrapOptions {
    pub(super) fn new(
        profile: BtcpayDevProfile,
        workspace_root: impl Into<PathBuf>,
        project_root: impl Into<PathBuf>,
    ) -> Self {
        let workspace_root = workspace_root.into();
        let project_root = project_root.into();
        Self {
            profile,
            workspace_root,
            env_file: project_root.join(".env"),
            project_root,
        }
    }
}

impl fmt::Debug for BtcpayDevProfile {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        formatter
            .debug_struct("BtcpayDevProfile")
            .field("display_name", &self.display_name)
            .field("env_prefix", &self.env_prefix)
            .field("store_name", &self.store_name)
            .field("api_key_label", &self.api_key_label)
            .field("rate_source", &self.rate_source)
            .field("webhook_path", &self.webhook_path)
            .field("default_admin_email", &self.default_admin_email)
            .field("public_url", &self.public_url)
            .field("local_docker", &self.local_docker)
            .field(
                "default_admin_password",
                &self.default_admin_password.as_ref().map(|_| "[REDACTED]"),
            )
            .field(
                "default_payment_signing_key",
                &self
                    .default_payment_signing_key
                    .as_ref()
                    .map(|_| "[REDACTED]"),
            )
            .finish()
    }
}

#[derive(Clone, Debug)]
pub(super) struct LocalBtcpayBootstrapSummary {
    /// Human-facing app name.
    pub app_display_name: String,
    /// Local BTCPay base URL.
    pub url: String,
    /// Store id written to the app `.env`.
    pub store_id: String,
    /// Masked API key for logs.
    pub api_key_masked: String,
    /// Masked webhook secret for logs.
    pub webhook_secret_masked: String,
    /// App `.env` path updated by the bootstrap.
    pub env_file: PathBuf,
}

pub(super) fn bootstrap_local_btcpay(
    options: &LocalBtcpayBootstrapOptions,
) -> Result<LocalBtcpayBootstrapSummary> {
    let profile = &options.profile;
    let btcpay_root = options.workspace_root.join("third-party").join("btcpay");
    ensure!(
        btcpay_root.is_dir(),
        "BTCPay checkout not found at {}",
        btcpay_root.display()
    );
    ensure!(
        options.project_root.join("Cargo.toml").is_file(),
        "app checkout not found at {}",
        options.project_root.display()
    );
    let mut app_env = EnvFile::read(&options.env_file)?;
    let public_url = app_env
        .effective_value("PUBLIC_URL")
        .filter(|value| !value.trim().is_empty())
        .unwrap_or_else(|| profile.public_url.clone());

    let docker_env = docker_env_values(&profile.local_docker, &app_env);
    write_btcpay_env(&btcpay_root.join(".env"), &docker_env)?;
    run_build_script(&btcpay_root, &docker_env)?;
    patch_local_btcpay_compose(&btcpay_root, &docker_env)?;
    docker_compose_up(&btcpay_root, &docker_env)?;

    let url = format!(
        "http://{}:{}",
        profile.local_docker.host, profile.local_docker.reverseproxy_http_port
    );
    let admin_email = app_env
        .effective_value(profile.env_key("LOCAL_BTCPAY_ADMIN_EMAIL").as_str())
        .filter(|value| !value.trim().is_empty())
        .unwrap_or_else(|| profile.default_admin_email.to_string());
    let admin_password_key = profile.env_key("LOCAL_BTCPAY_ADMIN_PASSWORD");
    let admin_password = app_env
        .effective_value(admin_password_key.as_str())
        .filter(|value| !value.trim().is_empty())
        .or_else(|| {
            profile
                .default_admin_password
                .as_deref()
                .map(str::trim)
                .filter(|value| !value.is_empty())
                .map(ToOwned::to_owned)
        })
        .unwrap_or_else(generate_local_secret);
    app_env.set(admin_password_key.as_str(), admin_password.as_str());
    app_env.write(&options.env_file)?;

    let client = BtcpayClient::new(profile.clone(), url.clone(), admin_email, admin_password)?;
    client.wait_until_ready()?;
    client.ensure_admin_user()?;
    let store_id = client.ensure_store(&public_url)?;
    client.ensure_onchain_wallet(&store_id, &btcpay_root, &docker_env)?;
    client.ensure_rate_settings(&store_id)?;
    let store_id_key = profile.env_key("BTCPAY_STORE_ID");
    let api_key_key = profile.env_key("BTCPAY_API_KEY");
    let webhook_secret_key = profile.env_key("BTCPAY_WEBHOOK_SECRET");
    let current_api_key = app_env.effective_value(api_key_key.as_str());
    let api_key = client.ensure_api_key(&store_id, current_api_key.as_deref())?;
    let current_webhook_secret = app_env.effective_value(webhook_secret_key.as_str());
    let webhook_secret = client.ensure_webhook(
        &store_id,
        &public_url,
        &api_key,
        current_webhook_secret.as_deref(),
    )?;

    app_env.set(store_id_key.as_str(), store_id.as_str());
    app_env.set(api_key_key.as_str(), api_key.as_str());
    app_env.set(webhook_secret_key.as_str(), webhook_secret.as_str());
    let signing_key = app_env
        .effective_value("PAYMENT_SIGNING_KEY")
        .filter(|value| !value.trim().is_empty())
        .or_else(|| {
            profile
                .default_payment_signing_key
                .as_deref()
                .map(str::trim)
                .filter(|value| !value.is_empty())
                .map(ToOwned::to_owned)
        })
        .unwrap_or_else(generate_local_secret);
    app_env.set("PAYMENT_SIGNING_KEY", signing_key.as_str());
    app_env.write(&options.env_file)?;

    Ok(LocalBtcpayBootstrapSummary {
        app_display_name: profile.display_name().to_string(),
        url,
        store_id,
        api_key_masked: mask_secret(&api_key),
        webhook_secret_masked: mask_secret(&webhook_secret),
        env_file: options.env_file.clone(),
    })
}

fn generate_local_secret() -> String {
    format!("{}{}", Uuid::new_v4().simple(), Uuid::new_v4().simple())
}

#[derive(Clone, Debug, Eq, PartialEq)]
struct LocalDockerConfig {
    host: String,
    reverseproxy_http_port: u16,
    reverseproxy_https_port: u16,
    nbitcoin_network: String,
    btcpaygen_crypto1: String,
    btcpaygen_reverseproxy: String,
    btcpaygen_subname: String,
    compose_project_name: String,
}

impl LocalDockerConfig {
    fn new(compose_project_name: String) -> Self {
        Self {
            host: "127.0.0.1".to_owned(),
            reverseproxy_http_port: 23_005,
            reverseproxy_https_port: 23_006,
            nbitcoin_network: "regtest".to_owned(),
            btcpaygen_crypto1: "btc".to_owned(),
            btcpaygen_reverseproxy: "nginx".to_owned(),
            btcpaygen_subname: "btcpay".to_owned(),
            compose_project_name,
        }
    }

    fn validate(&self) -> Result<()> {
        for (field, value) in [
            ("host", self.host.as_str()),
            ("nbitcoin_network", self.nbitcoin_network.as_str()),
            ("btcpaygen_crypto1", self.btcpaygen_crypto1.as_str()),
            (
                "btcpaygen_reverseproxy",
                self.btcpaygen_reverseproxy.as_str(),
            ),
            ("btcpaygen_subname", self.btcpaygen_subname.as_str()),
            ("compose_project_name", self.compose_project_name.as_str()),
        ] {
            ensure!(
                !value.is_empty() && value.trim() == value && !value.chars().any(char::is_control),
                "payment profile local_docker.{field} must be a non-empty single-line value"
            );
        }
        ensure!(
            self.reverseproxy_http_port > 0,
            "payment profile local_docker.reverseproxy_http_port must be greater than zero"
        );
        ensure!(
            self.reverseproxy_https_port > 0,
            "payment profile local_docker.reverseproxy_https_port must be greater than zero"
        );
        Ok(())
    }
}

#[derive(Clone, Debug, Default)]
struct EnvFile {
    lines: Vec<String>,
    values: BTreeMap<String, String>,
}

impl EnvFile {
    fn read(path: &Path) -> Result<Self> {
        if !path.exists() {
            return Ok(Self {
                lines: vec![
                    "# Local payment secrets and machine-specific BTCPay values.".to_string(),
                    "# Local dev bootstrap is managed by ch-rds.".to_string(),
                    String::new(),
                ],
                values: BTreeMap::new(),
            });
        }

        let text = fs::read_to_string(path)
            .with_context(|| format!("failed to read {}", path.display()))?;
        let mut values = BTreeMap::new();
        let lines = text
            .lines()
            .map(|line| {
                if let Some((key, value)) = parse_env_line(line) {
                    values.insert(key.to_string(), value.to_string());
                }
                line.to_string()
            })
            .collect();
        Ok(Self { lines, values })
    }

    fn get(&self, key: &str) -> Option<&str> {
        self.values.get(key).map(String::as_str)
    }

    fn effective_value(&self, key: &str) -> Option<String> {
        env::var(key)
            .ok()
            .filter(|value| !value.trim().is_empty())
            .or_else(|| self.get(key).map(str::to_string))
    }

    fn set(&mut self, key: &str, value: &str) {
        self.values.insert(key.to_string(), value.to_string());
    }

    fn write(&self, path: &Path) -> Result<()> {
        let mut seen = BTreeSet::new();
        let mut output = Vec::new();
        for line in &self.lines {
            if let Some((key, _)) = parse_env_line(line)
                && let Some(value) = self.values.get(key)
            {
                output.push(format!("{key}={value}"));
                seen.insert(key.to_string());
                continue;
            }
            output.push(line.clone());
        }
        for (key, value) in &self.values {
            if seen.contains(key) {
                continue;
            }
            if output.last().is_some_and(|line| !line.is_empty()) {
                output.push(String::new());
            }
            output.push(format!("{key}={value}"));
        }
        if let Some(parent) = path.parent() {
            fs::create_dir_all(parent)
                .with_context(|| format!("failed to create {}", parent.display()))?;
        }
        fs::write(path, format!("{}\n", output.join("\n")))
            .with_context(|| format!("failed to write {}", path.display()))
    }
}

fn parse_env_line(line: &str) -> Option<(&str, &str)> {
    let trimmed = line.trim_start();
    if trimmed.is_empty() || trimmed.starts_with('#') {
        return None;
    }
    let (key, value) = line.split_once('=')?;
    let key = key.trim();
    if key.is_empty() {
        return None;
    }
    Some((key, value.trim()))
}

fn docker_env_values(config: &LocalDockerConfig, app_env: &EnvFile) -> BTreeMap<String, String> {
    let mut values = BTreeMap::new();
    values.insert("BTCPAY_HOST".to_string(), config.host.clone());
    values.insert(
        "REVERSEPROXY_HTTP_PORT".to_string(),
        config.reverseproxy_http_port.to_string(),
    );
    values.insert(
        "REVERSEPROXY_HTTPS_PORT".to_string(),
        config.reverseproxy_https_port.to_string(),
    );
    values.insert(
        "NBITCOIN_NETWORK".to_string(),
        config.nbitcoin_network.clone(),
    );
    values.insert(
        "BTCPAYGEN_CRYPTO1".to_string(),
        config.btcpaygen_crypto1.clone(),
    );
    values.insert(
        "BTCPAYGEN_REVERSEPROXY".to_string(),
        config.btcpaygen_reverseproxy.clone(),
    );
    values.insert(
        "BTCPAYGEN_SUBNAME".to_string(),
        config.btcpaygen_subname.clone(),
    );
    values.insert(
        "COMPOSE_PROJECT_NAME".to_string(),
        config.compose_project_name.clone(),
    );
    values.insert(
        "BTCPAY_ADDITIONAL_HOSTS".to_string(),
        local_btcpay_additional_hosts(
            config.host.as_str(),
            app_env
                .effective_value("BTCPAY_ADDITIONAL_HOSTS")
                .as_deref()
                .unwrap_or_default(),
        ),
    );
    for key in [
        "BTCPAY_SSHAUTHORIZEDKEYS",
        "BTCPAY_SSHTRUSTEDFINGERPRINTS",
        "BTCPAY_SSHKEYFILE",
    ] {
        values.insert(
            key.to_string(),
            app_env.effective_value(key).unwrap_or_default(),
        );
    }
    values
}

fn write_btcpay_env(path: &Path, values: &BTreeMap<String, String>) -> Result<()> {
    let mut lines = Vec::new();
    for key in [
        "BTCPAY_HOST",
        "REVERSEPROXY_HTTP_PORT",
        "REVERSEPROXY_HTTPS_PORT",
        "NBITCOIN_NETWORK",
        "BTCPAYGEN_CRYPTO1",
        "BTCPAYGEN_REVERSEPROXY",
        "BTCPAYGEN_SUBNAME",
        "COMPOSE_PROJECT_NAME",
        "BTCPAY_ADDITIONAL_HOSTS",
        "BTCPAY_SSHAUTHORIZEDKEYS",
        "BTCPAY_SSHTRUSTEDFINGERPRINTS",
        "BTCPAY_SSHKEYFILE",
    ] {
        lines.push(format!(
            "{key}={}",
            values.get(key).map(String::as_str).unwrap_or_default()
        ));
    }
    fs::write(path, format!("{}\n", lines.join("\n")))
        .with_context(|| format!("failed to write {}", path.display()))
}

fn run_build_script(btcpay_root: &Path, envs: &BTreeMap<String, String>) -> Result<()> {
    let (program, args): (&str, Vec<String>) = if cfg!(windows) {
        (
            "powershell",
            vec![
                "-NoProfile".to_string(),
                "-ExecutionPolicy".to_string(),
                "Bypass".to_string(),
                "-File".to_string(),
                btcpay_root.join("build.ps1").display().to_string(),
            ],
        )
    } else {
        (
            "bash",
            vec![btcpay_root.join("build.sh").display().to_string()],
        )
    };
    run_command("BTCPay build step", program, &args, btcpay_root, envs)
}

fn patch_local_btcpay_compose(btcpay_root: &Path, envs: &BTreeMap<String, String>) -> Result<()> {
    let subname = required_env_value(envs, "BTCPAYGEN_SUBNAME")?;
    let compose_file = btcpay_root
        .join("Generated")
        .join(format!("docker-compose.{subname}.yml"));
    let compose = fs::read_to_string(&compose_file)
        .with_context(|| format!("failed to read {}", compose_file.display()))?;
    let patched = compose.replace("\n        onion=tor:9050\n", "\n        onion=0\n");

    if patched != compose {
        fs::write(&compose_file, patched)
            .with_context(|| format!("failed to write {}", compose_file.display()))?;
    }

    Ok(())
}

fn docker_compose_up(btcpay_root: &Path, envs: &BTreeMap<String, String>) -> Result<()> {
    let subname = required_env_value(envs, "BTCPAYGEN_SUBNAME")?;
    let project_name = required_env_value(envs, "COMPOSE_PROJECT_NAME")?;
    let compose_file = btcpay_root
        .join("Generated")
        .join(format!("docker-compose.{subname}.yml"));
    ensure!(
        compose_file.is_file(),
        "generated BTCPay compose file is missing at {}",
        compose_file.display()
    );

    let args = vec![
        "compose".to_string(),
        "--project-name".to_string(),
        project_name.to_string(),
        "--env-file".to_string(),
        ".env".to_string(),
        "-f".to_string(),
        compose_file.display().to_string(),
        "up".to_string(),
        "-d".to_string(),
    ];
    run_command(
        "BTCPay docker compose up",
        "docker",
        &args,
        btcpay_root,
        envs,
    )
}

fn run_command(
    label: &str,
    program: &str,
    args: &[String],
    cwd: &Path,
    envs: &BTreeMap<String, String>,
) -> Result<()> {
    let mut command = Command::new(program);
    command.current_dir(cwd).args(args).envs(envs);
    command.env("COMPOSE_CONVERT_WINDOWS_PATHS", "1");
    let status = command
        .status()
        .with_context(|| format!("failed to start {label}"))?;
    ensure!(status.success(), "{label} exited with status {status}");
    Ok(())
}

struct BtcpayClient {
    profile: BtcpayDevProfile,
    base_url: String,
    admin_email: String,
    admin_password: String,
    client: Client,
}

impl BtcpayClient {
    fn new(
        profile: BtcpayDevProfile,
        base_url: String,
        admin_email: String,
        admin_password: String,
    ) -> Result<Self> {
        let client = Client::builder()
            .timeout(Duration::from_secs(30))
            .build()
            .context("failed to create BTCPay HTTP client")?;
        Ok(Self {
            profile,
            base_url: base_url.trim_end_matches('/').to_string(),
            admin_email,
            admin_password,
            client,
        })
    }

    fn wait_until_ready(&self) -> Result<()> {
        let deadline = Instant::now() + Duration::from_secs(180);
        let mut last_error = None;
        while Instant::now() < deadline {
            match self.client.get(format!("{}/", self.base_url)).send() {
                Ok(response)
                    if response.status().is_success() || response.status().is_redirection() =>
                {
                    return Ok(());
                }
                Ok(response) => {
                    last_error = Some(anyhow!("BTCPay returned {}", response.status()));
                }
                Err(error) => {
                    last_error = Some(error.into());
                }
            }
            std::thread::sleep(Duration::from_secs(2));
        }
        Err(last_error.unwrap_or_else(|| anyhow!("BTCPay did not become ready in time")))
    }

    fn ensure_admin_user(&self) -> Result<()> {
        if self.has_valid_admin_credentials()? {
            return Ok(());
        }

        let html = self
            .client
            .get(format!("{}/register", self.base_url))
            .send()
            .context("failed to load BTCPay register page")?
            .text()
            .context("failed to read BTCPay register page")?;
        let csrf = parse_csrf_token(&html).ok_or_else(|| {
            anyhow!(
                "BTCPay admin account exists with different credentials. Reset local BTCPay volumes or set {}/{}.",
                self.profile.env_key("LOCAL_BTCPAY_ADMIN_EMAIL"),
                self.profile.env_key("LOCAL_BTCPAY_ADMIN_PASSWORD")
            )
        })?;
        let response = self
            .client
            .post(format!("{}/register?logon=true", self.base_url))
            .form(&[
                ("Email", self.admin_email.as_str()),
                ("Password", self.admin_password.as_str()),
                ("ConfirmPassword", self.admin_password.as_str()),
                ("__RequestVerificationToken", csrf.as_str()),
            ])
            .send()
            .context("failed to submit BTCPay admin register form")?;
        ensure!(
            response.status().is_success() || response.status().is_redirection(),
            "BTCPay admin register returned {}",
            response.status()
        );
        ensure!(
            self.has_valid_admin_credentials()?,
            "BTCPay local admin bootstrap did not produce valid API credentials"
        );
        Ok(())
    }

    fn has_valid_admin_credentials(&self) -> Result<bool> {
        let response = self
            .admin_auth(
                self.client
                    .get(format!("{}/api/v1/users/me", self.base_url)),
            )
            .send()
            .context("failed to check BTCPay admin credentials")?;
        match response.status() {
            StatusCode::OK => Ok(true),
            StatusCode::UNAUTHORIZED => Ok(false),
            status => bail!("BTCPay admin credential check returned {status}"),
        }
    }

    fn ensure_store(&self, public_url: &str) -> Result<String> {
        let stores: Vec<Value> = self.admin_get_json("/api/v1/stores")?;
        for store in stores {
            if store.get("name").and_then(Value::as_str) == Some(self.profile.store_name.as_str())
                && let Some(id) = store.get("id").and_then(Value::as_str)
            {
                return Ok(id.to_string());
            }
        }

        let created: Value = self.admin_post_json(
            "/api/v1/stores",
            &json!({
                "name": self.profile.store_name.as_str(),
                "website": public_url,
                "defaultLang": "en",
                "speedPolicy": "MediumSpeed",
                "redirectAutomatically": false,
                "anyoneCanCreateInvoice": false,
            }),
        )?;
        created
            .get("id")
            .and_then(Value::as_str)
            .map(str::to_string)
            .ok_or_else(|| anyhow!("BTCPay store creation returned an unexpected response"))
    }

    fn ensure_onchain_wallet(
        &self,
        store_id: &str,
        btcpay_root: &Path,
        docker_env: &BTreeMap<String, String>,
    ) -> Result<()> {
        match self.admin_get_json::<Value>(&format!(
            "/api/v1/stores/{store_id}/payment-methods/OnChain/BTC"
        )) {
            Ok(payload)
                if payload.get("enabled").and_then(Value::as_bool) == Some(true)
                    && payload
                        .get("derivationScheme")
                        .and_then(Value::as_str)
                        .is_some() =>
            {
                return Ok(());
            }
            Ok(_) => {}
            Err(error) if error.to_string().contains("404") => {}
            Err(error) => return Err(error),
        }

        let (tpub, fingerprint) = derive_local_bitcoin_tpub(btcpay_root, docker_env)?;
        let payload: Value = self.admin_put_json(
            &format!("/api/v1/stores/{store_id}/payment-methods/OnChain/BTC"),
            &json!({
                "enabled": true,
                "cryptoCode": "BTC",
                "derivationScheme": tpub,
                "label": self.profile.api_key_label.as_str(),
                "accountKeyPath": fingerprint,
            }),
        )?;
        ensure!(
            payload
                .get("derivationScheme")
                .and_then(Value::as_str)
                .is_some(),
            "BTCPay on-chain wallet setup returned an unexpected response"
        );
        Ok(())
    }

    fn ensure_rate_settings(&self, store_id: &str) -> Result<()> {
        let payload: Value = self.admin_put_json(
            &format!("/api/v1/stores/{store_id}/rates/configuration/primary"),
            &json!({
                "spread": "0",
                "preferredSource": self.profile.rate_source.as_str(),
                "isCustomScript": false,
                "effectiveScript": "",
            }),
        )?;
        ensure!(
            payload.get("isCustomScript").and_then(Value::as_bool) == Some(false),
            "BTCPay rate configuration returned an unexpected response"
        );
        Ok(())
    }

    fn ensure_api_key(&self, store_id: &str, current_key: Option<&str>) -> Result<String> {
        let required_permissions = [
            format!("btcpay.store.cancreateinvoice:{store_id}"),
            format!("btcpay.store.canviewinvoices:{store_id}"),
            format!("btcpay.store.webhooks.canmodifywebhooks:{store_id}"),
            format!("btcpay.store.canviewstoresettings:{store_id}"),
        ];
        if let Some(key) = current_key
            && !is_placeholder_value(key)
            && self.api_key_has_permissions(key, &required_permissions)?
        {
            return Ok(key.to_string());
        }

        let created: Value = self.admin_post_json(
            "/api/v1/api-keys",
            &json!({
                "label": self.profile.api_key_label.as_str(),
                "permissions": required_permissions,
            }),
        )?;
        created
            .get("apiKey")
            .and_then(Value::as_str)
            .map(str::to_string)
            .ok_or_else(|| anyhow!("BTCPay API key creation returned an unexpected response"))
    }

    fn ensure_webhook(
        &self,
        store_id: &str,
        public_url: &str,
        api_key: &str,
        current_secret: Option<&str>,
    ) -> Result<String> {
        let webhook_url = btcpay_webhook_url(public_url, self.profile.webhook_path.as_str())?;
        if let Some(secret) = current_secret
            && !is_placeholder_value(secret)
            && self.webhook_exists(store_id, api_key, webhook_url.as_str())?
        {
            return Ok(secret.to_string());
        }

        let secret = format!("{}_{}", Uuid::new_v4(), Uuid::new_v4());
        let created: Value = self.api_key_post_json(
            api_key,
            &format!("/api/v1/stores/{store_id}/webhooks"),
            &json!({
                "enabled": true,
                "automaticRedelivery": true,
                "url": webhook_url,
                "secret": secret,
                "authorizedEvents": {
                    "everything": false,
                    "specificEvents": [
                        "InvoiceCreated",
                        "InvoiceReceivedPayment",
                        "InvoiceProcessing",
                        "InvoiceSettled",
                        "InvoiceExpired",
                        "InvoiceInvalid"
                    ]
                }
            }),
        )?;
        Ok(created
            .get("secret")
            .and_then(Value::as_str)
            .unwrap_or(secret.as_str())
            .to_string())
    }

    fn api_key_has_permissions(&self, key: &str, required_permissions: &[String]) -> Result<bool> {
        let response = self
            .api_key_auth(
                key,
                self.client
                    .get(format!("{}/api/v1/api-keys/current", self.base_url)),
            )
            .send()
            .context("failed to check BTCPay API key")?;
        if response.status() == StatusCode::UNAUTHORIZED {
            return Ok(false);
        }
        let payload: Value = response_json(response, "BTCPay API key check")?;
        let Some(permissions) = payload.get("permissions").and_then(Value::as_array) else {
            return Ok(false);
        };
        let permissions = permissions
            .iter()
            .filter_map(Value::as_str)
            .collect::<BTreeSet<_>>();
        Ok(required_permissions
            .iter()
            .all(|permission| permissions.contains(permission.as_str())))
    }

    fn webhook_exists(&self, store_id: &str, api_key: &str, webhook_url: &str) -> Result<bool> {
        let webhooks: Vec<Value> =
            self.api_key_get_json(api_key, &format!("/api/v1/stores/{store_id}/webhooks"))?;
        Ok(webhooks
            .iter()
            .any(|webhook| webhook.get("url").and_then(Value::as_str) == Some(webhook_url)))
    }

    fn admin_get_json<T: for<'de> Deserialize<'de>>(&self, path: &str) -> Result<T> {
        let response = self
            .admin_auth(self.client.get(format!("{}{}", self.base_url, path)))
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn admin_post_json<T: for<'de> Deserialize<'de>>(
        &self,
        path: &str,
        payload: &Value,
    ) -> Result<T> {
        let response = self
            .admin_auth(self.client.post(format!("{}{}", self.base_url, path)))
            .json(payload)
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn admin_put_json<T: for<'de> Deserialize<'de>>(
        &self,
        path: &str,
        payload: &Value,
    ) -> Result<T> {
        let response = self
            .admin_auth(self.client.put(format!("{}{}", self.base_url, path)))
            .json(payload)
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn api_key_get_json<T: for<'de> Deserialize<'de>>(
        &self,
        api_key: &str,
        path: &str,
    ) -> Result<T> {
        let response = self
            .api_key_auth(
                api_key,
                self.client.get(format!("{}{}", self.base_url, path)),
            )
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn api_key_post_json<T: for<'de> Deserialize<'de>>(
        &self,
        api_key: &str,
        path: &str,
        payload: &Value,
    ) -> Result<T> {
        let response = self
            .api_key_auth(
                api_key,
                self.client.post(format!("{}{}", self.base_url, path)),
            )
            .json(payload)
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn admin_auth(&self, request: RequestBuilder) -> RequestBuilder {
        let token = base64::engine::general_purpose::STANDARD
            .encode(format!("{}:{}", self.admin_email, self.admin_password));
        request.header(reqwest::header::AUTHORIZATION, format!("Basic {token}"))
    }

    fn api_key_auth(&self, api_key: &str, request: RequestBuilder) -> RequestBuilder {
        request.header(reqwest::header::AUTHORIZATION, format!("token {api_key}"))
    }
}

fn response_json<T: for<'de> Deserialize<'de>>(
    response: reqwest::blocking::Response,
    label: &str,
) -> Result<T> {
    let status = response.status();
    let text = response
        .text()
        .with_context(|| format!("failed to read {label} response"))?;
    ensure!(
        status.is_success(),
        "{label} returned {status}: {}",
        text.chars().take(500).collect::<String>()
    );
    serde_json::from_str(&text)
        .with_context(|| format!("{label} returned an unexpected JSON response"))
}

fn derive_local_bitcoin_tpub(
    btcpay_root: &Path,
    docker_env: &BTreeMap<String, String>,
) -> Result<(String, String)> {
    let command = [
        "rm -f /tmp/btcpay-walletdump.txt",
        "bitcoin-cli -datadir=/data -rpcwallet= dumpwallet /tmp/btcpay-walletdump.txt >/dev/null",
        "awk '/extended private masterkey/ {print $5}' /tmp/btcpay-walletdump.txt",
    ]
    .join(" && ");
    let compose_file = btcpay_root
        .join("Generated")
        .join("docker-compose.generated.yml");
    let output = Command::new("docker")
        .current_dir(btcpay_root)
        .envs(docker_env)
        .args(["compose", "--env-file", ".env", "-f"])
        .arg(compose_file)
        .args(["exec", "-T", "bitcoind", "sh", "-lc", command.as_str()])
        .output()
        .context("failed to read local BTCPay bitcoin wallet")?;
    ensure!(
        output.status.success(),
        "failed to read local BTCPay bitcoin wallet: {}",
        String::from_utf8_lossy(&output.stderr).trim()
    );
    let tprv = String::from_utf8_lossy(&output.stdout)
        .lines()
        .last()
        .map(str::trim)
        .filter(|line| !line.is_empty())
        .ok_or_else(|| {
            anyhow!("local BTCPay bitcoin wallet did not expose an extended private key")
        })?
        .to_string();
    extended_private_key_to_public(&tprv)
}

fn extended_private_key_to_public(value: &str) -> Result<(String, String)> {
    let payload = bs58::decode(value)
        .with_check(None)
        .into_vec()
        .context("invalid local BTCPay extended private key")?;
    ensure!(
        payload.len() == 78 && payload.get(45) == Some(&0),
        "invalid local BTCPay extended private key payload"
    );
    let version: [u8; 4] = payload[0..4].try_into().expect("slice length is checked");
    let public_version = EXTENDED_PRIVATE_TO_PUBLIC_VERSIONS
        .iter()
        .find_map(|(private, public)| (*private == version).then_some(*public))
        .ok_or_else(|| anyhow!("unsupported local BTCPay extended private key version"))?;

    let secret_bytes = payload[46..78].try_into().expect("slice length is checked");
    let secret = SecretKey::from_byte_array(secret_bytes)
        .context("invalid local BTCPay private key scalar")?;
    let secp = Secp256k1::new();
    let public_key = PublicKey::from_secret_key(&secp, &secret).serialize();
    let fingerprint = hash160(&public_key)[..4]
        .iter()
        .map(|byte| format!("{byte:02x}"))
        .collect::<String>();

    let mut public_payload = Vec::with_capacity(78);
    public_payload.extend_from_slice(&public_version);
    public_payload.extend_from_slice(&payload[4..45]);
    public_payload.extend_from_slice(&public_key);
    let tpub = bs58::encode(public_payload).with_check().into_string();
    Ok((tpub, fingerprint))
}

fn hash160(value: &[u8]) -> [u8; 20] {
    let sha = <Sha256 as ShaDigest>::digest(value);
    let ripe = <Ripemd160 as RipemdDigest>::digest(sha);
    ripe.into()
}

fn btcpay_webhook_url(public_url: &str, webhook_path: &str) -> Result<String> {
    let parsed = url::Url::parse(public_url)
        .with_context(|| format!("invalid public payment URL `{public_url}`"))?;
    let host = match parsed.host_str() {
        Some("127.0.0.1" | "localhost") => "host.docker.internal",
        Some(host) => host,
        None => "host.docker.internal",
    };
    let mut netloc = host.to_string();
    if let Some(port) = parsed.port() {
        netloc = format!("{netloc}:{port}");
    }
    let scheme = if parsed.scheme().is_empty() {
        "http"
    } else {
        parsed.scheme()
    };
    Ok(format!("{scheme}://{netloc}{webhook_path}"))
}

fn parse_csrf_token(html: &str) -> Option<String> {
    for tag in html.split('>') {
        if !tag.contains("__RequestVerificationToken") {
            continue;
        }
        if let Some(value) = html_attr_value(tag, "value") {
            return Some(value);
        }
    }
    None
}

fn html_attr_value(tag: &str, name: &str) -> Option<String> {
    let needle = format!("{name}=\"");
    let start = tag.find(needle.as_str())? + needle.len();
    let rest = &tag[start..];
    let end = rest.find('"')?;
    Some(rest[..end].to_string())
}

fn required_env_value<'a>(values: &'a BTreeMap<String, String>, key: &str) -> Result<&'a str> {
    values
        .get(key)
        .map(String::as_str)
        .filter(|value| !value.trim().is_empty())
        .ok_or_else(|| anyhow!("missing required BTCPay env value {key}"))
}

fn local_btcpay_additional_hosts(primary_host: &str, configured_hosts: &str) -> String {
    let mut hosts = configured_hosts
        .split(',')
        .map(str::trim)
        .filter(|host| !host.is_empty())
        .map(str::to_string)
        .collect::<Vec<_>>();
    if primary_host == "127.0.0.1" && !hosts.iter().any(|host| host == "localhost") {
        hosts.push("localhost".to_string());
    }
    if primary_host == "localhost" && !hosts.iter().any(|host| host == "127.0.0.1") {
        hosts.push("127.0.0.1".to_string());
    }
    hosts.join(",")
}

fn is_placeholder_value(value: &str) -> bool {
    matches!(
        value.trim(),
        "" | "__change_me__" | "BTCPAY_STORE_ID_FROM_UI"
    )
}

fn mask_secret(value: &str) -> String {
    if value.len() <= 8 {
        return "********".to_string();
    }
    format!("{}...{}", &value[..4], &value[value.len() - 4..])
}