Tenth plugin out, and the one whose extraction turned on a permission decision rather than a mechanical move. The wallet permission was kind: 'admin' — owner only, not grantable, invisible to every other account. Plugin permissions are ALWAYS kind: 'app': mount.ts forces it and the manifest has no field for anything else, deliberately, so that "can a plugin escalate itself" is a question which cannot be asked. So extraction could not preserve admin, and that was raised as a blocker before any code moved. It was the right change anyway, and the objection inverts. Every wallet query is scoped by user_id, and that id comes from X-Officer-User which the platform injects from the authenticated session — a caller cannot name someone else's. So granting this gives an account ITS OWN wallet. Not through the API and not with root either does it hand over anyone else's, because their seed is sealed under a passphrase the server never stores. kind: 'admin' was single-user thinking; grantable is how a second person gets a wallet at all. Named bitcoin-wallet rather than wallet: it is a bitcoin wallet specifically, and the appName drives the route, the API prefix, the table prefix and the install key together. Tables renamed to bitcoin_wallet_* accordingly — the prefix guard normalises the hyphen. Free only because no wallet table existed on any server, which was checked before deciding: db:push treats a rename as a drop plus a create. The three custody test files moved with it and still run — 72 tests over scrypt sealing, envelope open and bolt11. bunfig.toml's test root was widened on 2026-08-15 after music took lyrics.test.ts and the suite silently shrank by nine, so that trap was already closed. 68 palette classes converted, five status vocabularies hoisted into shared.ts. Two deliberate flattenings recorded in PLUGIN.md: testnet/signet/regtest all read as warning, and the bitcoin and lightning rails no longer differ by hue. Deferred on purpose: watch-only data (xpubs, balances, history) stays unencrypted so a locked wallet still shows a balance. Anyone with the database can therefore SEE any user's balances; they can never move a coin.
122 lines
5.2 KiB
TypeScript
122 lines
5.2 KiB
TypeScript
import { useState } from 'react';
|
||
import { CheckCircle2, Loader2, Search, TriangleAlert } from 'lucide-react';
|
||
import { Button } from '@/components/ui/button';
|
||
import { Input } from '@/components/ui/input';
|
||
import { toneText } from '@/components/Data/tone';
|
||
import { ADDRESS_TYPE_LABELS, CHAIN_SYNC_TONE } from './shared';
|
||
import { useBalances, useWalletOperations } from './useWalletData';
|
||
|
||
// Search the chain for coins this wallet already owns.
|
||
//
|
||
// THIS IS THE FIX FOR AN IMPORTED WALLET THAT READS ZERO, and that symptom is why the card exists at all.
|
||
// An indexing chain source (NBXplorer in front of your own node) only watches an account from the moment
|
||
// you register it, so a seed with a history arrives at a balance of nothing: every call succeeds, no error
|
||
// is raised, the coins are simply not in the index yet. A scan walks the node's current UTXO set directly
|
||
// and finds them regardless of when the account was registered or how far back the node is pruned.
|
||
//
|
||
// It recovers SPENDABLE COINS, not history. Transactions spent before the account was registered stay
|
||
// missing — that needs a full block rescan, which is a heavier thing this does not do.
|
||
//
|
||
// Hidden entirely when the chain source cannot rescan: Esplora asks about every address on every refresh,
|
||
// so it has nothing to catch up on, and offering a button that 501s would invent a problem.
|
||
|
||
type RescanCardProps = { walletId: number };
|
||
|
||
export const RescanCard = ({ walletId }: RescanCardProps) => {
|
||
const { sync } = useBalances(walletId);
|
||
const { rescan } = useWalletOperations(walletId);
|
||
const [gapLimit, setGapLimit] = useState('');
|
||
|
||
// `sync` null is a node backend, which owns its own coins and has nothing to look for. `canRescan`
|
||
// false is Esplora. Note this cannot key off `sync.rescan` being null — that is equally what NBXplorer
|
||
// reports before its first scan, which is exactly when the card is most needed.
|
||
if (!sync?.canRescan) return null;
|
||
|
||
const state = sync.rescan;
|
||
const running = state?.running === true;
|
||
const parsed = Number(gapLimit);
|
||
const depth = gapLimit.trim() && Number.isInteger(parsed) && parsed > 0 ? parsed : null;
|
||
|
||
return (
|
||
<section className="max-w-2xl rounded-xl border border-border p-4">
|
||
<h3 className="mb-2 text-[11px] font-semibold uppercase tracking-wide text-muted-foreground">
|
||
Find missing coins
|
||
</h3>
|
||
<p className="mb-3 text-xs text-muted-foreground">
|
||
Ask the node to search its whole UTXO set for this wallet’s coins. Run this after importing a seed that already
|
||
had funds — an indexing node only watches an account from the moment it is added, so an older balance shows as
|
||
zero until it has looked. It scans all four address types, one at a time, and takes a few minutes.
|
||
</p>
|
||
|
||
<div className="flex flex-wrap items-center gap-2">
|
||
<Button
|
||
size="sm"
|
||
variant="outline"
|
||
onClick={() => rescan.mutate(depth ? { gapLimit: depth } : {})}
|
||
disabled={running || rescan.isPending}
|
||
>
|
||
{running || rescan.isPending ? (
|
||
<Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
|
||
) : (
|
||
<Search className="mr-1.5 h-3.5 w-3.5" />
|
||
)}
|
||
{running ? 'Scanning…' : 'Scan the chain'}
|
||
</Button>
|
||
|
||
{/* The one thing about a scan only the owner can know: how many addresses their old wallet handed
|
||
out and never had paid. 1000 covers anyone who clicked "new address" by hand; a wallet that
|
||
issued them in bulk needs more, and no amount of looking from here can tell which it was. */}
|
||
<label className="flex items-center gap-1.5 text-[11px] text-muted-foreground">
|
||
search depth
|
||
<Input
|
||
type="number"
|
||
min={1}
|
||
max={100000}
|
||
value={gapLimit}
|
||
placeholder="1000"
|
||
disabled={running}
|
||
onChange={(ev) => setGapLimit(ev.target.value)}
|
||
className="h-7 w-24 text-xs"
|
||
/>
|
||
</label>
|
||
</div>
|
||
|
||
{state && <Status state={state} />}
|
||
</section>
|
||
);
|
||
};
|
||
|
||
type StatusProps = { state: NonNullable<ReturnType<typeof useBalances>['sync']>['rescan'] };
|
||
|
||
const Status = ({ state }: StatusProps) => {
|
||
if (!state) return null;
|
||
|
||
if (state.running) {
|
||
const label = state.current ? ADDRESS_TYPE_LABELS[state.current] : 'queued';
|
||
return (
|
||
<p className={`mt-2 text-xs ${toneText[CHAIN_SYNC_TONE.scanning]}`}>
|
||
Scanning {label} — {state.done} of {state.total} done
|
||
{state.found > 0 && `, ${state.found} coin${state.found === 1 ? '' : 's'} found so far`}.
|
||
</p>
|
||
);
|
||
}
|
||
|
||
if (state.error) {
|
||
return (
|
||
<p className={`mt-2 flex items-start gap-1.5 text-xs ${toneText[CHAIN_SYNC_TONE.failed]}`}>
|
||
<TriangleAlert className="mt-0.5 h-3.5 w-3.5 shrink-0" />
|
||
<span>
|
||
Stopped after {state.done} of {state.total}: {state.error}
|
||
</span>
|
||
</p>
|
||
);
|
||
}
|
||
|
||
return (
|
||
<p className={`mt-2 flex items-center gap-1.5 text-xs ${toneText[CHAIN_SYNC_TONE.ok]}`}>
|
||
<CheckCircle2 className="h-3.5 w-3.5 shrink-0" />
|
||
Last scan found {state.found} coin{state.found === 1 ? '' : 's'} across {state.total} address types.
|
||
</p>
|
||
);
|
||
};
|