Reference

GUI Quick Reference

eIOU GUI Quick Reference

Quick lookup card for the eIOU Wallet web interface.

Entry Points
File Locations
Controllers
POST Actions
Layout Components
Security Requirements
JavaScript Key Functions
Session Settings
Helpers
Request Flow
See Also

Entry Points

URL	File	Purpose
`/`	redirects to `/gui/`	Main wallet interface (auth + dashboard)
`/gui/`	`gui/index.html`	Main wallet interface (auth + dashboard)
`/gui/?logout`	`gui/index.html`	Logout and clear session

File Locations

Component	Inside Container	Outside Container
Entry point	`/app/eiou/www/gui/index.html`	`files/root/www/gui/index.html`
GUI source	`/app/eiou/src/gui/`	`files/src/gui/`
Controllers	`/app/eiou/src/gui/controllers/`	`files/src/gui/controllers/`
Helpers	`/app/eiou/src/gui/helpers/`	`files/src/gui/helpers/`
Layout	`/app/eiou/src/gui/layout/`	`files/src/gui/layout/`
JavaScript	`/app/eiou/src/gui/assets/js/script.js`	`files/src/gui/assets/js/script.js`
CSS	`/app/eiou/src/gui/assets/css/page.css`	`files/src/gui/assets/css/page.css`
User config	`/etc/eiou/config/defaultconfig.json`	N/A (generated at runtime)

Controllers

Controller	File	Actions	Purpose
`ContactController`	`controllers/ContactController.php`	add, accept, decline, applyContactDecisions, delete, block, unblock, edit, ping, proposeChainDrop, acceptChainDrop, rejectChainDrop, acceptCurrency, addCurrency, acceptAllCurrencies, declineCurrency	Contact management
`TransactionController`	`controllers/TransactionController.php`	sendEIOU, approveP2pTransaction, rejectP2pTransaction, getP2pCandidates, getTransactionByTxid, refundTransaction, getRefundsForTxid	Sending transactions, P2P approval, and refunds (Return to sender)
`PaymentRequestController`	`controllers/PaymentRequestController.php`	createPaymentRequest, approvePaymentRequest, declinePaymentRequest, cancelPaymentRequest, declineAllPaymentRequests, cancelAllPaymentRequests	Payment request lifecycle
`SettingsController`	`controllers/SettingsController.php`	updateSettings, listGuiBackups, createGuiBackup, verifyGuiBackup, authorizeGuiBackupDownload, downloadGuiBackup, resetToDefaults, clearDebugLogs, sendDebugReport, getDebugReportJson, submitDebugReport, analyticsConsent	User settings, encrypted backup management, debug & analytics
`PluginController`	`controllers/PluginController.php`	pluginsList, pluginsToggle, pluginsSetPublicRoutes, pluginsRequestRestart, pluginChangelog, pluginsUninstall, pluginsUpload, pluginsUploadAsUpgrade, pluginsUpgrade, pluginsUploadLimits	Plugin management (list/toggle/public-routes/upload/upgrade)

POST Actions

All POST actions require CSRF token.

Contact Actions (ContactController)

Action	Required Fields	Response
`addContact`	`address`, `name`, `fee`, `credit`, `currency`	Redirect with message
`acceptContact`	`contact_address`, `contact_name`, `contact_fee`, `contact_credit`, `contact_currency`	Redirect with message
`deleteContact`	`contact_address`	Redirect with message
`blockContact`	`contact_address`	Redirect with message
`unblockContact`	`contact_address`	Redirect with message
`editContact`	`contact_address`, `contact_name`, `contact_fee`, `contact_credit`, `contact_currency`	Redirect with message
`declineContact`	`pubkey_hash`	Redirect with message
`applyContactDecisions`	`pubkey_hash`, `decisions` (JSON), `is_new_contact`, `contact_address`, `contact_name`	Redirect with message
`declineCurrency`	`pubkey_hash`, `currency`	Redirect with message
`pingContact`	`contact_address`	JSON (AJAX)
`proposeChainDrop`	`contact_pubkey_hash`	JSON (AJAX)
`acceptChainDrop`	`proposal_id`	JSON (AJAX)
`rejectChainDrop`	`proposal_id`	JSON (AJAX)
`acceptCurrency`	`pubkey_hash`, `currency`, `fee`, `credit`	Redirect with message
`addCurrency`	`pubkey`, `currency`, `fee`, `credit`	JSON (AJAX)
`acceptAllCurrencies`	`pubkey_hash`, `currencies` (JSON), `is_new_contact`, `contact_address`, `contact_name`	JSON (AJAX)

Transaction Actions (TransactionController)

Action	Required Fields	Response
`sendEIOU`	`recipient` OR `manual_recipient`, `amount`, `currency`	Redirect with message
`approveP2pTransaction`	`hash`	JSON (AJAX)
`rejectP2pTransaction`	`hash`	JSON (AJAX)

Optional: address_type (when contact selected), description, best_fee (experimental best-fee routing)

Payment Request Actions (PaymentRequestController)

Action	Required Fields	Response
`createPaymentRequest`	`recipient`, `amount`, `currency`	Redirect with message
`approvePaymentRequest`	`request_id`	Redirect with message
`declinePaymentRequest`	`request_id`	Redirect with message
`cancelPaymentRequest`	`request_id`	Redirect with message
`declineAllPaymentRequests`	(none)	Redirect with message
`cancelAllPaymentRequests`	(none)	Redirect with message

Optional for create: description, address_type

Settings Actions (SettingsController)

Action	Required Fields	Response
`updateSettings`	Any of: `defaultCurrency`, `defaultFee`, `minFee`, `maxFee`, `defaultCreditLimit`, `maxP2pLevel`, `p2pExpiration`, `maxOutput`, `defaultTransportMode`, `autoRefreshEnabled`, `autoBackupEnabled`, `autoAcceptTransaction`, `contactAvatarStyle`, `amountColorScheme`, `statusColorScheme`, plus advanced settings	JSON (AJAX): 200 success, 400 validation, or 403 sensitive-access unlock required
`listGuiBackups`	(none)	JSON (AJAX) — CSRF-gated list with filename, type, size, and creation time
`createGuiBackup`	(none)	JSON (AJAX) — sensitive-access gated; creates an encrypted full-database backup
`verifyGuiBackup`	`filename`	JSON (AJAX) — sensitive-access gated; verifies a currently listed backup
`resetToDefaults`	(none)	Redirect with message — restores settings to defaults (contacts, transactions, backups untouched)
`clearDebugLogs`	(none)	Redirect with message
`sendDebugReport`	`description` (optional)	Redirect with message
`getDebugReportJson`	`description` (optional), `report_mode` (full/limited)	JSON (AJAX)
`submitDebugReport`	`description` (optional), `report_mode` (full/limited)	JSON (AJAX) — sends to support via Tor
`analyticsConsent`	`consent` (0 or 1)	JSON (AJAX)

DLQ Actions (DlqController)

Action	Required Fields	Response
`dlqRetry`	`dlq_id`, `csrf_token`	JSON (AJAX)
`dlqAbandon`	`dlq_id`, `csrf_token`	JSON (AJAX)
`dlqRetryAll`	`csrf_token`	JSON (AJAX)
`dlqAbandonAll`	`csrf_token`	JSON (AJAX)

Plugin Actions (PluginController)

Action	Required Fields	Response
`pluginsList`	`csrf_token`	JSON (AJAX)
`pluginsToggle`	`name`, `enabled`, `csrf_token`	JSON (AJAX) — carries `public_routes_gated` + `public_routes_message` when the enabled plugin’s public routes are gated
`pluginsSetPublicRoutes`	`name`, `enabled`, `csrf_token`	JSON (AJAX) — `public_routes_enabled`, `public_routes_state` (`live`/`plugin_off`/`node_off`/`none`)
`pluginsRequestRestart`	`csrf_token`	JSON (AJAX)
`pluginChangelog`	`name`, `csrf_token`	JSON (AJAX)
`pluginsUninstall`	`name`, `csrf_token`	JSON (AJAX)
`pluginsUpload`	file upload, `csrf_token`	JSON (AJAX)
`pluginsUploadAsUpgrade`	file upload, `name`, `csrf_token`	JSON (AJAX)
`pluginsUpgrade`	`name`, `csrf_token`	JSON (AJAX)
`pluginsUploadLimits`	`csrf_token`	JSON (AJAX)

Layout Components

Component	File	Tab	Purpose
Main layout	`layout/wallet.html`	—	Page structure, tab bar, includes all sections
Auth form	`layout/authenticationForm.html`	—	Login form
Banner	`layout/walletSubParts/banner.html`	—	Dynamic image banner carousel from `/gui/assets/banners/`
Header	`layout/walletSubParts/header.html`	—	Page header
Notifications	`layout/walletSubParts/notifications.html`	—	Toast/alert messages, pending contact/currency banners, Tor status, update available, tx drop proposal banners
Wallet info	`layout/walletSubParts/walletInformation.html`	Dashboard	Balance (blue), fee earnings (amber/gold), available credit (blue-purple); addresses with Copy + QR buttons; ⓘ icons open info modal on tap
Send form	`layout/walletSubParts/eiouForm.html`	Send	New eIOU form with two sub-tabs (`setSendMode`): Send eIOU (universal; contact or raw P2P address; Best Fee Route) and Request Payment (contact-only; manual-address + Best Fee Route hidden; submits `createPaymentRequest`, gated until a contact is picked). Address type dropdown sorted Tor > HTTPS > HTTP. Openable prefilled from the contact modal’s Send/Request buttons
Payment requests	`layout/walletSubParts/paymentRequestsSection.html`	Send	Incoming requests (Approve & Pay / Decline) and outgoing requests (Cancel); rendered below the Send form
Contact form	`layout/walletSubParts/contactForm.html`	Contacts	Add contact form with QR scan button; placeholder “Enter Tor (.onion) or HTTP(S) address”
Contact section	`layout/walletSubParts/contactSection.html`	Contacts	Contact lists; detail modal (4 tabs: Info, Transactions, Status, Settings) with Copy + QR on addresses, single-line pubkey, connection/tx drop in Status tab
Transaction history	`layout/walletSubParts/transactionHistory.html`	Activity	Transaction list
DLQ section	`layout/walletSubParts/dlqSection.html`	Activity	Dead letter queue management
Plugins section	`layout/walletSubParts/pluginsSection.html`	Plugins	Plugin list, enable/disable, per-plugin public-routes toggle, upload/upgrade
Settings	`layout/walletSubParts/settingsSection.html`	Settings	Settings form plus encrypted backup create/list/verify
Debug	`layout/walletSubParts/debugSection.html`	Settings	Debug logs & system info (below settings form)
Quick actions	`layout/walletSubParts/quickActions.html`	(unused)	Retained but not rendered — navigation is tab-based
Floating buttons	`layout/walletSubParts/floatingButtons.html`	—	Back-to-top, etc.
Analytics consent	`layout/walletSubParts/analyticsConsentModal.html`	—	One-time analytics opt-in modal

Security Requirements

CSRF Token (Required for all POST)

<!-- In form -->
<input type="hidden" name="csrf_token" value="<?php echo $csrfToken; ?>">

<!-- Or use helper -->
<?php echo $secureSession->getCSRFField(); ?>

JavaScript AJAX with CSRF

fetch(window.location.href, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: 'action=pingContact&contact_address=' + encodeURIComponent(address) +
          '&csrf_token=' + encodeURIComponent(csrfToken)
});

JavaScript Key Functions

Function	Purpose	Usage
`refreshWalletData()`	Manual page refresh	Refresh button
`initializeSendForm()`	Setup send form (auto-called)	DOMContentLoaded
`openEditContactModal(address, name, fee, credit, currency)`	Open edit modal	Contact edit button
`closeEditContactModal()`	Close edit modal	Modal close button
`openTransactionModal(index)`	Show transaction details	Transaction list item
`escapeHtml(text)`	XSS prevention	Sanitize user input
`openContactModal(contact)`	Show contact detail modal	Contact card click
`openContactByContactId(id, tab)`	Open modal by contact ID	Notification banner
`pingContact()`	Check status + reload page	Contact modal button
`proposeChainDrop()`	Propose dropping missing tx	Tx drop section
`acceptChainDrop()`	Accept incoming proposal	Tx drop section
`rejectChainDrop()`	Reject incoming proposal	Tx drop section
`reloadAndReopenContactModal()`	Reload page, reopen modal	After AJAX actions
`safeStorageSet(key, value)`	Tor-safe sessionStorage	Store preferences
`safeStorageGet(key)`	Tor-safe sessionStorage	Retrieve preferences
`safeStorageRemove(key)`	Tor-safe sessionStorage	Clear preferences
`copyToClipboard(text, button)`	Copy text to clipboard	Address/key copy buttons
`filterContacts(query)`	Filter contact cards by name	Contact search input
`toggleShowAllContacts()`	Toggle between 16 and all contacts	Show more button
`initContactsDisplay()`	Initialize contact grid with scroll/filter	DOMContentLoaded
`updateAmountPrecisionHint()`	Show min amount hint for selected currency	Send form currency change
`initializeCurrencyAcceptHandlers()`	Set up accept forms for pending currencies	DOMContentLoaded
`showInfoModal(el)`	Show tap-friendly info modal from an element’s `title` attribute	ⓘ icon click
`toggleAddressQr(el)`	Toggle QR code display for an address	QR button on addresses
`generateQrSvg(text, size)`	Generate SVG QR code from text	Used by `toggleAddressQr`
`showSelectedContactAddress()`	Update address display and regenerate QR when type changes	Contact modal address dropdown
`showToast(message, type, duration)`	Display a temporary toast notification	Internal notifications

Constants

Constant	Value	Purpose
`OPERATION_TIMEOUT_MS`	15000	Stalled operation detection
`storageAvailable`	boolean	Tor Browser storage check

Session Settings

Setting	Session Key	Expiry
Authentication	`$_SESSION['authenticated']`	30 min inactivity
CSRF token	`$_SESSION['csrf_token']`	1 hour
Session regeneration	`$_SESSION['last_regeneration']`	5 min
In-progress txids	`$_SESSION['in_progress_txids']`	Session lifetime
Known txids	`$_SESSION['known_txids']`	Session lifetime
DLQ tracking	`$_SESSION['known_dlq_ids']`	Session lifetime

Parameter	Value
Name	`EIOU_WALLET_SESSION_<nodeHash>` (per-node suffix; see GUI_REFERENCE)
HttpOnly	`true`
SameSite	`Strict`
Secure	Auto (HTTPS only when available)

Helpers

Helper	File	Purpose
`ViewHelper`	`helpers/ViewHelper.php`	HTML sanitization, formatting
`MessageHelper`	`helpers/MessageHelper.php`	Flash messages, CLI output parsing
`ContactDataBuilder`	`helpers/ContactDataBuilder.php`	Contact data formatting
`Session`	`includes/Session.php`	Auth, CSRF, session management

Request Flow

1. index.html
   -> Session check
   -> Auth form (if not authenticated)
   -> CSRF verification (POST only)
   -> Functions.php (route POST actions)
   -> wallet.html (render view)