From e2860d08b199a6891d84ed5b8d515eb46fad7a6d Mon Sep 17 00:00:00 2001 From: Chris Troutner Date: Sun, 21 Dec 2025 11:22:44 -0700 Subject: [PATCH] Changing default cost to 200 sats per call --- .env-local => .env-example | 1 + README.md | 4 ++-- bin/server.js | 19 ++++++++++++++++++- src/config/env/common.js | 4 ++-- src/config/x402.js | 2 +- 5 files changed, 24 insertions(+), 6 deletions(-) rename .env-local => .env-example (97%) diff --git a/.env-local b/.env-example similarity index 97% rename from .env-local rename to .env-example index c175025..59b22be 100644 --- a/.env-local +++ b/.env-example @@ -25,6 +25,7 @@ PORT=5942 X402_ENABLED=true SERVER_BCH_ADDRESS=bitcoincash:qqlrzp23w08434twmvr4fxw672whkjy0py26r63g3d FACILITATOR_URL=http://localhost:4345/facilitator +X402_PRICE_SAT=200 # Basic Authentication required to access this API? USE_BASIC_AUTH=true diff --git a/README.md b/README.md index a98cb82..2890158 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ This is a REST API for communicating with Bitcoin Cash infrastructure. It replac ## x402-bch Payments -All REST endpoints exposed under the `/v6` prefix are protected by the [`x402-bch-express`](https://www.npmjs.com/package/x402-bch-express) middleware. Each API call requires a BCH payment authorization for **2000 satoshis**. The middleware advertises payment requirements via HTTP 402 responses and validates incoming `X-PAYMENT` headers with a configured Facilitator. +All REST endpoints exposed under the `/v6` prefix are protected by the [`x402-bch-express`](https://www.npmjs.com/package/x402-bch-express) middleware. Each API call requires a BCH payment authorization for **200 satoshis**. The middleware advertises payment requirements via HTTP 402 responses and validates incoming `X-PAYMENT` headers with a configured Facilitator. ### Configuration @@ -17,7 +17,7 @@ Environment variables control the payment flow: - `X402_ENABLED` — set to `false` (case-insensitive) to disable the middleware. Defaults to enabled. - `SERVER_BCH_ADDRESS` — BCH cash address that receives funding transactions. Defaults to `bitcoincash:qqlrzp23w08434twmvr4fxw672whkjy0py26r63g3d`. - `FACILITATOR_URL` — Root URL of the facilitator service (e.g., `http://localhost:4345/facilitator`). -- `X402_PRICE_SAT` — Optional; override the satoshi price per call (defaults to `2000`). +- `X402_PRICE_SAT` — Optional; override the satoshi price per call (defaults to `200`). When `X402_ENABLED=false`, the server continues to operate without payment headers for local development or trusted deployments. diff --git a/bin/server.js b/bin/server.js index 7b6c7a8..b35e70f 100644 --- a/bin/server.js +++ b/bin/server.js @@ -83,8 +83,10 @@ class Server { // Apply x402 middleware based on configuration // Logic: - // - If X402_ENABLED=false OR USE_BASIC_AUTH=false: Don't apply x402 (no rate limits) // - If X402_ENABLED=true AND USE_BASIC_AUTH=true: Apply x402 conditionally (bypass if basic auth valid) + // - If X402_ENABLED=true AND USE_BASIC_AUTH=false: Apply x402 unconditionally (no basic auth bypass) + // - If X402_ENABLED=false AND USE_BASIC_AUTH=true: Require basic auth only + // - If X402_ENABLED=false AND USE_BASIC_AUTH=false: No access control // Apply access control middleware based on configuration if (x402Settings.enabled && basicAuthSettings.enabled) { @@ -112,6 +114,21 @@ class Server { } app.use(conditionalX402Middleware) + } else if (x402Settings.enabled && !basicAuthSettings.enabled) { + // X402_ENABLED=true AND USE_BASIC_AUTH=false: Apply x402 unconditionally (no basic auth bypass) + const routes = buildX402Routes(this.config.apiPrefix) + const facilitatorOptions = x402Settings.facilitatorUrl + ? { url: x402Settings.facilitatorUrl } + : undefined + + wlogger.info(`x402 middleware enabled (basic auth disabled); enforcing ${x402Settings.priceSat} satoshis per request`) + + // Apply x402 middleware unconditionally - no basic auth bypass + app.use(x402PaymentMiddleware( + x402Settings.serverAddress, + routes, + facilitatorOptions + )) } else if (basicAuthSettings.enabled && !x402Settings.enabled) { // USE_BASIC_AUTH=true AND X402_ENABLED=false: Require basic auth, reject unauthenticated requests wlogger.info('Basic auth enforcement enabled (x402 disabled)') diff --git a/src/config/env/common.js b/src/config/env/common.js index 2887e00..f8e52d8 100644 --- a/src/config/env/common.js +++ b/src/config/env/common.js @@ -26,10 +26,10 @@ const normalizeBoolean = (value, defaultValue) => { return defaultValue } -// By default, the price per API call is 2000 satoshis. +// By default, the price per API call is 200 satoshis. // But the user can override this value by setting the X402_PRICE_SAT environment variable. const parsedPriceSat = Number(process.env.X402_PRICE_SAT) -const priceSat = Number.isFinite(parsedPriceSat) && parsedPriceSat > 0 ? parsedPriceSat : 2000 +const priceSat = Number.isFinite(parsedPriceSat) && parsedPriceSat > 0 ? parsedPriceSat : 200 const x402Defaults = { enabled: normalizeBoolean(process.env.X402_ENABLED, true), diff --git a/src/config/x402.js b/src/config/x402.js index 45f0ac8..93099e3 100644 --- a/src/config/x402.js +++ b/src/config/x402.js @@ -26,7 +26,7 @@ export function buildX402Routes (apiPrefix = '/v6') { price: config.x402.priceSat, network: NETWORK, config: { - description: `${DEFAULT_DESCRIPTION} (2000 satoshis)`, + description: `${DEFAULT_DESCRIPTION} (${config.x402.priceSat} satoshis)`, maxTimeoutSeconds: DEFAULT_TIMEOUT_SECONDS } }