Dash2

[shocknet-justin]

Note

Medium Risk
New admin-only APIs expose balances and full user operation history; assets/liabilities logic was refactored with pagination and batch lookups, which affects financial reconciliation views.

Overview
Adds admin dashboard capabilities: paginated user directory (GetUsersAdminInfo) with balance, lock state, linked app users, and app ownership, plus admin-scoped user operations (GetUserOperationsFromAdmin) that require user_id and can read history for banned users while enforcing page-size caps.

Introduces GetAssetsAndLiabilitiesV2 with per-LND and per-liquidity-provider filters and cursor/index pagination (has_more, next_cursor / next_index_offset) instead of dumping full operation lists. The original admin assets/liabilities call is kept by adapting V1 requests to V2 and flattening paged results back to arrays. LND listing now passes offset/limit into invoices, payments, and transactions; liquidity provider ops use explicit incoming/outgoing cursors.

Tracked asset operations can include optional user_id when mapped to a user payment/invoice/chain op. Nostr transport returns an error for unknown rpcName instead of only logging. Storage gains FindAndCount and batch In() lookups to avoid N+1 queries when building asset pages.

^{Reviewed by Cursor Bugbot for commit 86e8785. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

V1 default payment limit shrunk

Medium Severity

BuildV2ReqFromV1 defaults limit_payments to DEFAULT_LND_PAGE_SIZE (20), but the removed V1 handler used 50 when the field was omitted. Legacy GetAssetsAndLiabilities({}) calls now return fewer LND payment rows with no API version change.

 

^{Reviewed by Cursor Bugbot for commit 8a19cc8. Configure here.}

[boufni95]

this is fine, with pagination the user can just load more data now

[cursor]

Multiple apps overwrite owner id

Low Severity

GetUsersAdminInfo builds owner_of_app_id with applications.forEach(a => apps[a.owner.user_id] = a.app_id), so a user who owns more than one application only keeps the last app id in the map, and others get the wrong or missing owner link in admin user info.

 

^{Reviewed by Cursor Bugbot for commit 047e309. Configure here.}

[boufni95]

this is not an issue, since all application owners are unique, the same user cannot own two apps

[shocknet-justin]

@BugBot review

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

There are 4 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 86e8785. Configure here.}

[cursor]

Tx pagination unstable block height

Medium Severity

LND transaction pages for admin assets use the current chain tip as startHeight on every request while the client only persists tx_index_offset. When the tip advances between “load more” calls, the underlying getTransactions window shifts, so the same offset can skip or repeat on-chain activity in incoming_tx / outgoing_tx.

Additional Locations (1)

• src/services/main/adminManager.ts#L660-L697

 

^{Reviewed by Cursor Bugbot for commit 86e8785. Configure here.}

[cursor]

LP timeout breaks assets

Medium Severity

A new 10s Promise.race around liquidity-provider GetUserOperations throws on timeout. That error propagates through GetProviderAssetsAndLiabilities and aborts all of GetAssetsAndLiabilitiesV2 (including the V1 shim), so slow or hung LP calls can block LND balances and user totals that do not depend on the LP.

 

^{Reviewed by Cursor Bugbot for commit 86e8785. Configure here.}