Files
bitcoin-wallet/web/SyncBadge.tsx
T
officer a4cf939be7 bitcoin-wallet, extracted from the platform as a plugin
Tenth plugin out, and the one whose extraction turned on a permission decision
rather than a mechanical move.

The wallet permission was kind: 'admin' — owner only, not grantable, invisible
to every other account. Plugin permissions are ALWAYS kind: 'app': mount.ts
forces it and the manifest has no field for anything else, deliberately, so
that "can a plugin escalate itself" is a question which cannot be asked. So
extraction could not preserve admin, and that was raised as a blocker before
any code moved.

It was the right change anyway, and the objection inverts. Every wallet query
is scoped by user_id, and that id comes from X-Officer-User which the platform
injects from the authenticated session — a caller cannot name someone else's.
So granting this gives an account ITS OWN wallet. Not through the API and not
with root either does it hand over anyone else's, because their seed is sealed
under a passphrase the server never stores. kind: 'admin' was single-user
thinking; grantable is how a second person gets a wallet at all.

Named bitcoin-wallet rather than wallet: it is a bitcoin wallet specifically,
and the appName drives the route, the API prefix, the table prefix and the
install key together. Tables renamed to bitcoin_wallet_* accordingly — the
prefix guard normalises the hyphen. Free only because no wallet table existed
on any server, which was checked before deciding: db:push treats a rename as a
drop plus a create.

The three custody test files moved with it and still run — 72 tests over
scrypt sealing, envelope open and bolt11. bunfig.toml's test root was widened
on 2026-08-15 after music took lyrics.test.ts and the suite silently shrank by
nine, so that trap was already closed.

68 palette classes converted, five status vocabularies hoisted into shared.ts.
Two deliberate flattenings recorded in PLUGIN.md: testnet/signet/regtest all
read as warning, and the bitcoin and lightning rails no longer differ by hue.

Deferred on purpose: watch-only data (xpubs, balances, history) stays
unencrypted so a locked wallet still shows a balance. Anyone with the database
can therefore SEE any user's balances; they can never move a coin.
2026-08-19 05:18:29 +00:00

97 lines
3.8 KiB
TypeScript
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import type { SyncState } from './shared';
import { useEffect, useState } from 'react';
import { AlertTriangle, Check, RefreshCw } from 'lucide-react';
import { toneText } from '@/components/Data/tone';
import { CHAIN_SYNC_TONE } from './shared';
// How old the numbers on screen are.
//
// This exists because "empty wallet" and "we could not reach the chain" used to render identically — as a
// zero balance — and the second one is alarming while the first is not. The sidecar now serves the last
// snapshot it managed to read and refreshes behind the response, so the number is almost always real; what
// the owner needs is its age, and a plain statement when the upstream is failing.
//
// Nothing here is a control. Refreshing is the data layer's job and it is already happening.
/** Re-render on a timer so "2 minutes ago" does not sit frozen on an idle screen. */
const TICK_MS = 15_000;
function relativeAge(syncedAt: number, now: number): string {
const seconds = Math.max(0, Math.round((now - syncedAt) / 1000));
if (seconds < 45) return 'just now';
const minutes = Math.round(seconds / 60);
if (minutes < 60) return `${minutes}m ago`;
const hours = Math.round(minutes / 60);
if (hours < 24) return `${hours}h ago`;
return `${Math.round(hours / 24)}d ago`;
}
type SyncBadgeProps = { sync: SyncState | null; className?: string };
export const SyncBadge = ({ sync, className }: SyncBadgeProps) => {
const [now, setNow] = useState(() => Date.now());
useEffect(() => {
const timer = setInterval(() => setNow(Date.now()), TICK_MS);
return () => clearInterval(timer);
}, []);
// Null from a node backend, which reads live and has no age to report. Rendering "just now" for it
// would be inventing a fact.
if (!sync) return null;
// A rescan outranks everything else here, including a stale age and an upstream error. While the node
// is searching, the number beside this badge is not "your balance" — it is "your balance so far", and
// that difference is the entire reason an imported wallet showing zero is alarming rather than boring.
const { rescan } = sync;
if (rescan?.running) {
return (
<span
className={`inline-flex items-center gap-1 text-[11px] ${toneText[CHAIN_SYNC_TONE.scanning]} ${className ?? ''}`}
title="The node is searching its whole UTXO set for this wallet’s coins. Balances stay incomplete until it finishes."
>
<RefreshCw className="h-3 w-3 animate-spin" />
Scanning the chain · {Math.min(rescan.done + 1, rescan.total)} of {rescan.total}
</span>
);
}
const failing = sync.lastError !== null;
// Never read successfully AND failing: the only case where the numbers beside this are not real. Say so
// loudly, because a zero here means "unknown", not "empty".
if (sync.syncedAt === null) {
if (!failing) return null;
return (
<span
className={`inline-flex items-center gap-1 text-[11px] ${toneText[CHAIN_SYNC_TONE.failed]} ${className ?? ''}`}
title={sync.lastError ?? undefined}
>
<AlertTriangle className="h-3 w-3" />
Could not reach the chain
</span>
);
}
const age = relativeAge(sync.syncedAt, now);
if (failing) {
return (
<span
className={`inline-flex items-center gap-1 text-[11px] ${toneText[CHAIN_SYNC_TONE.degraded]} ${className ?? ''}`}
title={sync.lastError ?? undefined}
>
<AlertTriangle className="h-3 w-3" />
{age} · chain unreachable
</span>
);
}
return (
<span className={`inline-flex items-center gap-1 text-[11px] text-muted-foreground ${className ?? ''}`}>
{sync.stale ? <RefreshCw className="h-3 w-3 animate-spin" /> : <Check className="h-3 w-3" />}
{sync.stale ? `${age} · refreshing` : age}
</span>
);
};