4 files changed, 39 insertions, 22 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index 97b4c37..5650309 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -8,5 +8,5 @@ idf_component_register(SRCS "tollgate_main.c"
                             "tollgate_api.c"
                     INCLUDE_DIRS "." "${IDF_PATH}/components/lwip/include/apps"
                     REQUIRES esp_wifi esp_event esp_netif nvs_flash esp_http_server
-                             lwip json esp_http_client mbedtls log spiffs
+                             lwip json esp_http_client mbedtls esp-tls log spiffs
                     PRIV_REQUIRES esp-tls)
diff --git a/main/cashu.c b/main/cashu.c
index 8dffacc..ba6d9ef 100644
--- a/main/cashu.c
+++ b/main/cashu.c
@@ -5,7 +5,7 @@
 #include "cJSON.h"
 #include "mbedtls/base64.h"
 #include "mbedtls/sha256.h"
-#include <string.h>
+#include "esp_crt_bundle.h"
 
 static const char *TAG = "cashu";
 
@@ -78,6 +78,10 @@ esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out)
     memset(out, 0, sizeof(*out));
 
     size_t len = strlen(token_str);
+    char *nl = strchr(token_str, '\n');
+    if (nl) len = nl - token_str;
+    char *cr = strchr(token_str, '\r');
+    if (cr && (cr - token_str) < (int)len) len = cr - token_str;
     if (len <= V3_PREFIX_LEN) {
         ESP_LOGE(TAG, "Token too short");
         return ESP_FAIL;
@@ -87,11 +91,13 @@ esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out)
         return ESP_FAIL;
     }
 
-    char *json_buf = malloc(2048);
+    size_t b64_len = len - V3_PREFIX_LEN;
+    size_t decoded_size = (b64_len * 3) / 4 + 4;
+    char *json_buf = malloc(decoded_size);
     if (!json_buf) return ESP_FAIL;
     size_t json_len = 0;
-    if (b64url_decode(token_str + V3_PREFIX_LEN, len - V3_PREFIX_LEN,
-                      json_buf, 2047, &json_len) != 0) {
+    if (b64url_decode(token_str + V3_PREFIX_LEN, b64_len,
+                      json_buf, decoded_size - 1, &json_len) != 0) {
         ESP_LOGE(TAG, "Base64url decode failed");
         free(json_buf);
         return ESP_FAIL;
@@ -181,12 +187,12 @@ esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *to
 
     char *resp_buf = malloc(8192);
     if (!resp_buf) { free(post_body); return ESP_FAIL; }
-    int resp_len = 0;
 
     esp_http_client_config_t config = {
         .url = url,
         .method = HTTP_METHOD_POST,
-        .timeout_ms = 10000,
+        .timeout_ms = 15000,
+        .crt_bundle_attach = esp_crt_bundle_attach,
     };
     esp_http_client_handle_t client = esp_http_client_init(&config);
     if (!client) { free(post_body); free(resp_buf); return ESP_FAIL; }
@@ -194,20 +200,26 @@ esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *to
     esp_http_client_set_header(client, "Content-Type", "application/json");
     esp_err_t err = esp_http_client_open(client, strlen(post_body));
     if (err != ESP_OK) {
+        ESP_LOGE(TAG, "checkstate open failed: %s", esp_err_to_name(err));
         esp_http_client_cleanup(client);
         free(post_body);
         free(resp_buf);
-        return err;
+        return ESP_FAIL;
     }
-    esp_http_client_write(client, post_body, strlen(post_body));
+    int written = esp_http_client_write(client, post_body, strlen(post_body));
     free(post_body);
+    ESP_LOGI(TAG, "checkstate written %d bytes", written);
 
-    resp_len = esp_http_client_read(client, resp_buf, 8191);
+    int content_length = esp_http_client_fetch_headers(client);
     int status = esp_http_client_get_status_code(client);
+    ESP_LOGI(TAG, "checkstate headers: status=%d, content_length=%d", status, content_length);
+
+    int resp_len = esp_http_client_read(client, resp_buf, 8191);
+    ESP_LOGI(TAG, "checkstate read: resp_len=%d", resp_len);
     esp_http_client_cleanup(client);
 
     if (status != 200 || resp_len <= 0) {
-        ESP_LOGE(TAG, "checkstate returned %d", status);
+        ESP_LOGE(TAG, "checkstate failed: status=%d, resp_len=%d", status, resp_len);
         free(resp_buf);
         return ESP_FAIL;
     }
diff --git a/main/config.c b/main/config.c
index f78bc8b..b44c3c5 100644
--- a/main/config.c
+++ b/main/config.c
@@ -38,7 +38,7 @@ esp_err_t tollgate_config_init(void)
             "\"ap_ssid\":\"TollGate\","
             "\"ap_password\":\"\","
             "\"ap_channel\":1,"
-            "\"mint_url\":\"https://nofee.testnut.cashu.space\","
+            "\"mint_url\":\"https://testnut.cashu.space\","
             "\"lnurl_url\":\"https://redeem.cashu.me/.well-known/lnurlp/tollgate\","
             "\"price_per_step\":21,"
             "\"step_size_ms\":60000"
diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index b2ad647..2af04bc 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -162,17 +162,22 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         cJSON_Delete(notice);
         return ESP_OK;
     }
-    int received = httpd_req_recv(req, body, content_len);
-    if (received <= 0) {
-        free(body);
-        httpd_resp_set_status(req, "400 Bad Request");
-        httpd_resp_set_type(req, "text/plain");
-        httpd_resp_send(req, "bad request", 11);
-        return ESP_OK;
+    int received = 0;
+    int total = 0;
+    while (total < content_len) {
+        received = httpd_req_recv(req, body + total, content_len - total);
+        if (received <= 0) {
+            free(body);
+            httpd_resp_set_status(req, "400 Bad Request");
+            httpd_resp_set_type(req, "text/plain");
+            httpd_resp_send(req, "bad request", 11);
+            return ESP_OK;
+        }
+        total += received;
     }
-    body[received] = '\0';
+    body[total] = '\0';
 
-    ESP_LOGI(TAG, "Payment received: %d bytes", received);
+    ESP_LOGI(TAG, "Payment received: %d bytes", total);
 
     cashu_token_t token;
     esp_err_t err = cashu_decode_token(body, &token);
@@ -330,7 +335,7 @@ esp_err_t tollgate_api_start(void)
     config.server_port = 2121;
     config.ctrl_port = 32769;
     config.max_uri_handlers = 10;
-    config.stack_size = 16384;
+    config.stack_size = 32768;
 
     esp_err_t ret = httpd_start(&s_api_server, &config);
     if (ret != ESP_OK) {