officer
a4cf939be7
Tenth plugin out, and the one whose extraction turned on a permission decision rather than a mechanical move. The wallet permission was kind: 'admin' — owner only, not grantable, invisible to every other account. Plugin permissions are ALWAYS kind: 'app': mount.ts forces it and the manifest has no field for anything else, deliberately, so that "can a plugin escalate itself" is a question which cannot be asked. So extraction could not preserve admin, and that was raised as a blocker before any code moved. It was the right change anyway, and the objection inverts. Every wallet query is scoped by user_id, and that id comes from X-Officer-User which the platform injects from the authenticated session — a caller cannot name someone else's. So granting this gives an account ITS OWN wallet. Not through the API and not with root either does it hand over anyone else's, because their seed is sealed under a passphrase the server never stores. kind: 'admin' was single-user thinking; grantable is how a second person gets a wallet at all. Named bitcoin-wallet rather than wallet: it is a bitcoin wallet specifically, and the appName drives the route, the API prefix, the table prefix and the install key together. Tables renamed to bitcoin_wallet_* accordingly — the prefix guard normalises the hyphen. Free only because no wallet table existed on any server, which was checked before deciding: db:push treats a rename as a drop plus a create. The three custody test files moved with it and still run — 72 tests over scrypt sealing, envelope open and bolt11. bunfig.toml's test root was widened on 2026-08-15 after music took lyrics.test.ts and the suite silently shrank by nine, so that trap was already closed. 68 palette classes converted, five status vocabularies hoisted into shared.ts. Two deliberate flattenings recorded in PLUGIN.md: testnet/signet/regtest all read as warning, and the bitcoin and lightning rails no longer differ by hue. Deferred on purpose: watch-only data (xpubs, balances, history) stays unencrypted so a locked wallet still shows a balance. Anyone with the database can therefore SEE any user's balances; they can never move a coin.
56 lines
2.5 KiB
TypeScript
56 lines
2.5 KiB
TypeScript
import type { PluginManifest } from '@@/plugins/manifest';
|
|
|
|
/**
|
|
* Wallet — a self-custodial bitcoin wallet, with the keys on the server rather than on a device.
|
|
*
|
|
* ── Read `docs/wallet-key-custody.md` before changing anything here ──
|
|
*
|
|
* The seed is sealed under a key derived from the OWNER OF THAT WALLET's passphrase by scrypt
|
|
* (N=2¹⁷), then encrypted again at rest. The server cannot open it without the passphrase, which it
|
|
* never stores. That is not incidental — it is what makes the next paragraph safe.
|
|
*
|
|
* ── This permission is GRANTABLE, and that is deliberate ──
|
|
*
|
|
* It was `kind: 'admin'` — owner only — until this extraction, which was single-user thinking. Every
|
|
* wallet query is scoped by `user_id`, and the id comes from `X-Officer-User`, injected by the platform
|
|
* from the authenticated session. A caller cannot name someone else's.
|
|
*
|
|
* So granting this to a role gives that person THEIR OWN wallet. It does not give them yours, and it
|
|
* does not give you theirs: not through the API, and not with root either, because their seed is sealed
|
|
* under a passphrase you do not have.
|
|
*
|
|
* ── The gap that is real, and deferred on purpose ──
|
|
*
|
|
* Watch-only data — xpubs, and the balances, addresses and history derived from them — is stored in the
|
|
* CLEAR, so a locked wallet still shows a balance without anyone typing a passphrase. That ergonomics
|
|
* choice is why the wallet spends its life locked. The cost: anyone with the Postgres database or a
|
|
* backup of it can read any user's balances and history. They can never move a coin.
|
|
*
|
|
* Encrypting it per-user is a future option, and it costs balance-while-locked. Recorded here rather
|
|
* than discovered later.
|
|
*
|
|
* ── No `osDependencies` ──
|
|
*
|
|
* Everything is JS. Chain data comes from Esplora or NBXplorer over `fetch`.
|
|
*/
|
|
export const manifest: PluginManifest = {
|
|
publisher: 'officerdev',
|
|
version: '1.0.0',
|
|
platform: '>=1.0.0',
|
|
|
|
label: 'Bitcoin Wallet',
|
|
summary: 'A self-custodial bitcoin wallet — keys sealed on the server, never on a device',
|
|
icon: 'Bitcoin',
|
|
color: '#f7931a',
|
|
|
|
permissions: [
|
|
{
|
|
key: 'bitcoin-wallet',
|
|
label: 'Bitcoin Wallet',
|
|
// Written to be read in the grants list, where it sits beside Photos and Music and must not look
|
|
// like them. Granting gives that account its own wallet; it never exposes anyone else's.
|
|
description: "Bitcoin wallet — each account gets its own, sealed under that account's own passphrase",
|
|
},
|
|
],
|
|
};
|