Files
bitcoin-wallet/web/RescanCard.tsx
T
officer a4cf939be7 bitcoin-wallet, extracted from the platform as a plugin
Tenth plugin out, and the one whose extraction turned on a permission decision
rather than a mechanical move.

The wallet permission was kind: 'admin' — owner only, not grantable, invisible
to every other account. Plugin permissions are ALWAYS kind: 'app': mount.ts
forces it and the manifest has no field for anything else, deliberately, so
that "can a plugin escalate itself" is a question which cannot be asked. So
extraction could not preserve admin, and that was raised as a blocker before
any code moved.

It was the right change anyway, and the objection inverts. Every wallet query
is scoped by user_id, and that id comes from X-Officer-User which the platform
injects from the authenticated session — a caller cannot name someone else's.
So granting this gives an account ITS OWN wallet. Not through the API and not
with root either does it hand over anyone else's, because their seed is sealed
under a passphrase the server never stores. kind: 'admin' was single-user
thinking; grantable is how a second person gets a wallet at all.

Named bitcoin-wallet rather than wallet: it is a bitcoin wallet specifically,
and the appName drives the route, the API prefix, the table prefix and the
install key together. Tables renamed to bitcoin_wallet_* accordingly — the
prefix guard normalises the hyphen. Free only because no wallet table existed
on any server, which was checked before deciding: db:push treats a rename as a
drop plus a create.

The three custody test files moved with it and still run — 72 tests over
scrypt sealing, envelope open and bolt11. bunfig.toml's test root was widened
on 2026-08-15 after music took lyrics.test.ts and the suite silently shrank by
nine, so that trap was already closed.

68 palette classes converted, five status vocabularies hoisted into shared.ts.
Two deliberate flattenings recorded in PLUGIN.md: testnet/signet/regtest all
read as warning, and the bitcoin and lightning rails no longer differ by hue.

Deferred on purpose: watch-only data (xpubs, balances, history) stays
unencrypted so a locked wallet still shows a balance. Anyone with the database
can therefore SEE any user's balances; they can never move a coin.
2026-08-19 05:18:29 +00:00

122 lines
5.2 KiB
TypeScript
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import { useState } from 'react';
import { CheckCircle2, Loader2, Search, TriangleAlert } from 'lucide-react';
import { Button } from '@/components/ui/button';
import { Input } from '@/components/ui/input';
import { toneText } from '@/components/Data/tone';
import { ADDRESS_TYPE_LABELS, CHAIN_SYNC_TONE } from './shared';
import { useBalances, useWalletOperations } from './useWalletData';
// Search the chain for coins this wallet already owns.
//
// THIS IS THE FIX FOR AN IMPORTED WALLET THAT READS ZERO, and that symptom is why the card exists at all.
// An indexing chain source (NBXplorer in front of your own node) only watches an account from the moment
// you register it, so a seed with a history arrives at a balance of nothing: every call succeeds, no error
// is raised, the coins are simply not in the index yet. A scan walks the node's current UTXO set directly
// and finds them regardless of when the account was registered or how far back the node is pruned.
//
// It recovers SPENDABLE COINS, not history. Transactions spent before the account was registered stay
// missing — that needs a full block rescan, which is a heavier thing this does not do.
//
// Hidden entirely when the chain source cannot rescan: Esplora asks about every address on every refresh,
// so it has nothing to catch up on, and offering a button that 501s would invent a problem.
type RescanCardProps = { walletId: number };
export const RescanCard = ({ walletId }: RescanCardProps) => {
const { sync } = useBalances(walletId);
const { rescan } = useWalletOperations(walletId);
const [gapLimit, setGapLimit] = useState('');
// `sync` null is a node backend, which owns its own coins and has nothing to look for. `canRescan`
// false is Esplora. Note this cannot key off `sync.rescan` being null — that is equally what NBXplorer
// reports before its first scan, which is exactly when the card is most needed.
if (!sync?.canRescan) return null;
const state = sync.rescan;
const running = state?.running === true;
const parsed = Number(gapLimit);
const depth = gapLimit.trim() && Number.isInteger(parsed) && parsed > 0 ? parsed : null;
return (
<section className="max-w-2xl rounded-xl border border-border p-4">
<h3 className="mb-2 text-[11px] font-semibold uppercase tracking-wide text-muted-foreground">
Find missing coins
</h3>
<p className="mb-3 text-xs text-muted-foreground">
Ask the node to search its whole UTXO set for this wallet’s coins. Run this after importing a seed that already
had funds — an indexing node only watches an account from the moment it is added, so an older balance shows as
zero until it has looked. It scans all four address types, one at a time, and takes a few minutes.
</p>
<div className="flex flex-wrap items-center gap-2">
<Button
size="sm"
variant="outline"
onClick={() => rescan.mutate(depth ? { gapLimit: depth } : {})}
disabled={running || rescan.isPending}
>
{running || rescan.isPending ? (
<Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
) : (
<Search className="mr-1.5 h-3.5 w-3.5" />
)}
{running ? 'Scanning…' : 'Scan the chain'}
</Button>
{/* The one thing about a scan only the owner can know: how many addresses their old wallet handed
out and never had paid. 1000 covers anyone who clicked "new address" by hand; a wallet that
issued them in bulk needs more, and no amount of looking from here can tell which it was. */}
<label className="flex items-center gap-1.5 text-[11px] text-muted-foreground">
search depth
<Input
type="number"
min={1}
max={100000}
value={gapLimit}
placeholder="1000"
disabled={running}
onChange={(ev) => setGapLimit(ev.target.value)}
className="h-7 w-24 text-xs"
/>
</label>
</div>
{state && <Status state={state} />}
</section>
);
};
type StatusProps = { state: NonNullable<ReturnType<typeof useBalances>['sync']>['rescan'] };
const Status = ({ state }: StatusProps) => {
if (!state) return null;
if (state.running) {
const label = state.current ? ADDRESS_TYPE_LABELS[state.current] : 'queued';
return (
<p className={`mt-2 text-xs ${toneText[CHAIN_SYNC_TONE.scanning]}`}>
Scanning {label} — {state.done} of {state.total} done
{state.found > 0 && `, ${state.found} coin${state.found === 1 ? '' : 's'} found so far`}.
</p>
);
}
if (state.error) {
return (
<p className={`mt-2 flex items-start gap-1.5 text-xs ${toneText[CHAIN_SYNC_TONE.failed]}`}>
<TriangleAlert className="mt-0.5 h-3.5 w-3.5 shrink-0" />
<span>
Stopped after {state.done} of {state.total}: {state.error}
</span>
</p>
);
}
return (
<p className={`mt-2 flex items-center gap-1.5 text-xs ${toneText[CHAIN_SYNC_TONE.ok]}`}>
<CheckCircle2 className="h-3.5 w-3.5 shrink-0" />
Last scan found {state.found} coin{state.found === 1 ? '' : 's'} across {state.total} address types.
</p>
);
};