Enforce HTTPS for LNbits (#809)

* Enforce HTTPS for LNbits

* Use URL constructor

lib/validate.js

@@ -44,6 +44,20 @@ addMethod(string, 'or', function (schemas, msg) {
   })
 })
 
+addMethod(string, 'https', function () {
+  return this.test({
+    name: 'https',
+    message: 'https required',
+    test: (url) => {
+      try {
+        return new URL(url).protocol === 'https:'
+      } catch {
+        return false
+      }
+    }
+  })
+})
+
 const titleValidator = string().required('required').trim().max(
   MAX_TITLE_LENGTH,
   ({ max, value }) => `-${Math.abs(max - value.length)} characters remaining`
@@ -424,10 +438,10 @@ export const lnAddrSchema = ({ payerData, min, max, commentAllowed } = {}) =>
 
 export const lnbitsSchema = object({
   url: process.env.NODE_ENV === 'development'
-    ? string().or(
+    ? string()
-      [string().matches(/^(http:\/\/)?localhost:\d+$/), string().url()],
+      .or([string().matches(/^(http:\/\/)?localhost:\d+$/), string().url()], 'invalid url')
-      'invalid url').required('required').trim()
+      .required('required').trim().https()
-    : string().url().required('required').trim(),
+    : string().url().required('required').trim().https(),
   adminKey: string().length(32)
 })