Add Cashtab to the assetlinks.json by Fabcien · Pull Request #1112 · PayButton/paybutton-server

Fabcien · 2026-02-24T16:04:09Z

This adds Cashtab as an authorized deeplink handling app.

Summary by CodeRabbit

New Features
- Added URL handling support for the Cashtab app, enabling seamless integration with web links.

This adds Cashtab as an authorized deeplink handling app.

coderabbitai · 2026-02-24T16:04:32Z

📝 Walkthrough

Walkthrough

A new Digital Asset Link entry for com.cashtab.app is added to assetlinks.json, enabling URL delegation permissions with three SHA-256 fingerprints. No existing entries are modified, only the new entry is appended.

Changes

Cohort / File(s)	Summary
Digital Asset Links Configuration `public/.well-known/assetlinks.json`	Added new Digital Asset Link entry for com.cashtab.app with delegate_permission/common.handle_all_urls relation and three SHA-256 fingerprints for Android app verification.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

Update assetlinks.json #1107: Updates Android app fingerprints in assetlinks.json for existing app entries
feat: assetlinks json #1104: Adds Digital Asset Link entry for com.marlinwallet.app to the same assetlinks.json file

Suggested labels

enhancement (behind the scenes)

Suggested reviewers

Klakurka

Poem

🐰 A new app link hops into place,
With fingerprints three, setting the pace,
URLs delegated, permissions all clear,
CashTab now welcomed, with digital cheer! 🪙✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The pull request description is minimal but lacks required template sections like issue reference, test plan, and detailed rationale.	Expand the description to follow the template: add issue reference (#), provide a test plan for verifying deeplink handling, and include any relevant remarks.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding Cashtab to the assetlinks.json file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@public/.well-known/assetlinks.json`:
- Around line 14-23: The assetlinks.json entry for package_name
"com.cashtab.app" currently includes the sha256_cert_fingerprint
"FA:C6:17:45:DC:09:03:78:6F:B9:ED:E6:2A:96:2B:39:9F:73:48:F0:BB:6F:89:9B:83:32:66:75:91:03:3B:9C"
which also appears in the Marlin Wallet entry; confirm whether Cashtab and
Marlin intentionally share the signing key, and if not, replace that fingerprint
in the "target" block for com.cashtab.app with the correct Cashtab release
SHA-256 fingerprint(s) (or remove any stale fingerprints), then re-generate and
redeploy public/.well-known/assetlinks.json so app-link verification uses the
correct certificate(s).

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 070f7ba and 0174388.

📒 Files selected for processing (1)

public/.well-known/assetlinks.json

coderabbitai · 2026-02-24T16:08:09Z

public/.well-known/assetlinks.json

+    {
+        "relation": ["delegate_permission/common.handle_all_urls"],
+        "target": {
+            "namespace": "android_app",
+            "package_name": "com.cashtab.app",
+            "sha256_cert_fingerprints": [
+                "FA:C6:17:45:DC:09:03:78:6F:B9:ED:E6:2A:96:2B:39:9F:73:48:F0:BB:6F:89:9B:83:32:66:75:91:03:3B:9C",
+                "02:71:C6:C3:30:1F:FC:F1:E7:5E:F5:92:8D:03:A3:7C:6C:FE:33:CE:6D:22:B9:4C:8F:FF:E7:65:BE:84:04:A1",
+                "18:43:19:21:31:B6:EA:C3:DF:29:40:86:EA:96:6E:DE:21:D1:BE:F2:FD:B1:9C:C4:44:43:5F:94:22:D8:0F:22"
+            ]


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat public/.well-known/assetlinks.json

Repository: PayButton/paybutton-server

Length of output: 1273

🏁 Script executed:

find . -type f \( -name "README*" -o -name "*.md" \) | head -20

Repository: PayButton/paybutton-server

Length of output: 173

🏁 Script executed:

cat README.md

Repository: PayButton/paybutton-server

Length of output: 10201

🏁 Script executed:

git log --oneline public/.well-known/assetlinks.json | head -20

Repository: PayButton/paybutton-server

Length of output: 112

🏁 Script executed:

git show 0174388 --stat

Repository: PayButton/paybutton-server

Length of output: 22681

🏁 Script executed:

git show 0174388:public/.well-known/assetlinks.json

Repository: PayButton/paybutton-server

Length of output: 1273

🏁 Script executed:

rg -i "cashtab\|marlin" --type md --type json --type ts --type tsx -A 2 -B 2 | head -100

Repository: PayButton/paybutton-server

Length of output: 97

🏁 Script executed:

rg -i "cashtab\|marlin" -A 2 -B 2 | head -100

Repository: PayButton/paybutton-server

Length of output: 52

🏁 Script executed:

git log --all --oneline | grep -i "cashtab\|marlin\|assetlinks"

Repository: PayButton/paybutton-server

Length of output: 189

🏁 Script executed:

git show af2d13c --stat

Repository: PayButton/paybutton-server

Length of output: 339

🏁 Script executed:

git show af2d13c:public/.well-known/assetlinks.json

Repository: PayButton/paybutton-server

Length of output: 366

🏁 Script executed:

git show 0a91e41:public/.well-known/assetlinks.json

Repository: PayButton/paybutton-server

Length of output: 675

🏁 Script executed:

git log --all --format="%H %s" | grep -i "cashtab\|marlin"

Repository: PayButton/paybutton-server

Length of output: 145

🏁 Script executed:

git show 0a91e41 --stat

Repository: PayButton/paybutton-server

Length of output: 417

🏁 Script executed:

git show 0a91e41

Repository: PayButton/paybutton-server

Length of output: 1129

🏁 Script executed:

git log --all --oneline -- public/.well-known/assetlinks.json

Repository: PayButton/paybutton-server

Length of output: 223

Confirm whether Cashtab and Marlin Wallet intentionally share the signing certificate.

The fingerprint FA:C6:17:45:DC:09:03:78:6F:B9:ED:E6:2A:96:2B:39:9F:73:48:F0:BB:6F:89:9B:83:32:66:75:91:03:3B:9C is present in both app entries. This could be correct if they use a shared signing key, but if Cashtab has different release certificates, this will break app-link verification or grant the wrong app URL handling permissions. Please verify Cashtab's actual signing cert(s) and confirm whether the shared key is intentional.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@public/.well-known/assetlinks.json` around lines 14 - 23, The assetlinks.json entry for package_name "com.cashtab.app" currently includes the sha256_cert_fingerprint "FA:C6:17:45:DC:09:03:78:6F:B9:ED:E6:2A:96:2B:39:9F:73:48:F0:BB:6F:89:9B:83:32:66:75:91:03:3B:9C" which also appears in the Marlin Wallet entry; confirm whether Cashtab and Marlin intentionally share the signing key, and if not, replace that fingerprint in the "target" block for com.cashtab.app with the correct Cashtab release SHA-256 fingerprint(s) (or remove any stale fingerprints), then re-generate and redeploy public/.well-known/assetlinks.json so app-link verification uses the correct certificate(s).

Summary: So we can open the PayButton links using the application on Android. Note: this is required before it can work: PayButton/paybutton-server#1112 I added a debug.keystore (the same as Marlin) and updated the build settings so the debug/dev build uses the same key all the time. This makes testing deep links possible from the dev version of the app. Test Plan: pnpm test Try it on mobile. Reviewers: #bitcoin_abc, bytesofman Reviewed By: #bitcoin_abc, bytesofman Subscribers: bytesofman Differential Revision: https://reviews.bitcoinabc.org/D19605

Add Cashtab to the assetlinks.json

0174388

This adds Cashtab as an authorized deeplink handling app.

coderabbitai bot reviewed Feb 24, 2026

View reviewed changes

Fabcien self-assigned this Feb 24, 2026

Fabcien requested a review from Klakurka February 24, 2026 16:16

chedieck approved these changes Feb 24, 2026

View reviewed changes

Klakurka merged commit 419f9fc into PayButton:master Feb 24, 2026
3 checks passed

Fabcien deleted the update_assetlinks branch February 25, 2026 08:20

coderabbitai bot mentioned this pull request Feb 25, 2026

Add Cashtab dev builds to assetlinks.json #1113

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Cashtab to the assetlinks.json#1112

Add Cashtab to the assetlinks.json#1112
Klakurka merged 1 commit intoPayButton:masterfrom
Fabcien:update_assetlinks

Fabcien commented Feb 24, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Feb 24, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Fabcien commented Feb 24, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fabcien commented Feb 24, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Feb 24, 2026 •

edited

Loading