github-such-software/smirk-backend-core
1
0
Fork 0
mirror of https://github.com/Such-Software/smirk-backend-core.git synced 2026-11-13 11:43:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat(capabilities): honest secret-presence downgrade + admin features view [operator §4]

Browse Source 
Make /capabilities fail-closed and add the admin features surface.

- Secret-presence downgrade (§4.2): a chain whose flag is on but whose source is
  unconfigured (btc/ltc no electrum URL, xmr/wow no LWS admin key, grin no owner
  secret) now reports enabled:false — so /capabilities never advertises a chain
  that would 404, and a missing-secret downgrade is indistinguishable from a
  deliberately-off chain. grin_relay requires serviceable Grin; nostr_identity
  requires PUBLIC_API_URL. effective_capabilities() is the single explicit mapper.
- contract_version stamp on the public document (clients soft-notice a higher
  value, ignore unknown additive keys).
- GET /admin/features (admin_guard): the resolved effective state PLUS admin-only
  downgrade reasons (the public surface hides the reason, per §4.3).
- Golden test: the public capabilities JSON, built from a fully-secret-seeded
  config, contains no secret value (asserts no "integration-test-" substring).

openapi regenerated (contract_version). Admin features view stays off the public
OpenAPI.

Deferred (documented): runtime mutation — PUT /admin/features + a DB feature-
override table + resolve() precedence + Arc hot-swap + CLI `features set`. Flags
are env/config-driven for v1; runtime tuning (and its fleet propagation, itself a
deferred LB decision) is a later addition.
This commit is contained in:
jwinterm
2026-06-27 15:35:56 -04:00
parent 51a3371be1
commit 2d0077b2b9
4 changed files with 174 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/capabilities.rs
+66 -33
View File
@@ -12,8 +12,13 @@ use axum::{extract::State, routing::get, Json, Router};
use serde::Serialize;
use tracing::instrument;
use crate::config::Config;
use crate::AppState;
/// Capabilities contract version. Bumped only on a breaking shape change; clients
/// soft-notice a higher value and ignore unknown (additive) keys.
pub const CAPABILITIES_CONTRACT_VERSION: u32 = 1;
/// Per-chain availability. `network` is the configured network for UTXO chains
/// (so the wallet derives addresses for the right one); `null` for chains whose
/// network isn't a backend setting.
@@ -48,10 +53,70 @@ pub struct FeatureCapabilities {
pub struct CapabilitiesResponse {
/// Backend version (Cargo package version).
pub version: String,
/// Capabilities contract version (additive changes do not bump it).
pub contract_version: u32,
pub chains: ChainCapabilities,
pub features: FeatureCapabilities,
}
/// Whether an enabled chain can actually be served (its infra secret/URL is
/// present). A chain whose flag is on but whose source is unconfigured reports
/// `enabled:false` — so `/capabilities` never advertises a chain that 404s, and
/// a missing-secret downgrade is indistinguishable from a deliberately-off chain.
fn chain_serviceable(config: &Config, asset: &str) -> bool {
let f = &config.features.chains;
let c = &config.chains;
match asset {
"btc" => {
f.btc && (c.btc.electrum_primary.is_some() || !c.btc.electrum_fallbacks.is_empty())
}
"ltc" => {
f.ltc && (c.ltc.electrum_primary.is_some() || !c.ltc.electrum_fallbacks.is_empty())
}
"xmr" => f.xmr && !c.xmr.lws_admin_key.is_empty(),
"wow" => f.wow && !c.wow.lws_admin_key.is_empty(),
"grin" => f.grin && !c.grin.owner_api_secret.is_empty(),
_ => false,
}
}
/// Build the public capabilities projection with the secret-presence downgrade.
pub fn effective_capabilities(config: &Config) -> CapabilitiesResponse {
let utxo_net = |on: bool, net: &str| ChainCapability {
enabled: on,
network: Some(net.to_string()),
};
CapabilitiesResponse {
version: env!("CARGO_PKG_VERSION").to_string(),
contract_version: CAPABILITIES_CONTRACT_VERSION,
chains: ChainCapabilities {
btc: utxo_net(chain_serviceable(config, "btc"), &config.chains.btc.network),
ltc: utxo_net(chain_serviceable(config, "ltc"), &config.chains.ltc.network),
xmr: ChainCapability {
enabled: chain_serviceable(config, "xmr"),
network: None,
},
wow: ChainCapability {
enabled: chain_serviceable(config, "wow"),
network: None,
},
grin: ChainCapability {
enabled: chain_serviceable(config, "grin"),
network: None,
},
},
features: FeatureCapabilities {
// The relay needs Grin chain access to be serviceable.
grin_relay: config.features.grin_relay && chain_serviceable(config, "grin"),
prices: config.features.prices,
// Nostr identity needs the canonical PUBLIC_API_URL.
nostr_identity: config.features.nostr_identity
&& config.identity.public_api_url.is_some(),
tips: config.features.tips,
},
}
}
/// Describe this instance's enabled chains and features.
#[utoipa::path(
get,
@@ -61,39 +126,7 @@ pub struct CapabilitiesResponse {
)]
#[instrument(skip(state))]
pub async fn capabilities(State(state): State<Arc<AppState>>) -> Json<CapabilitiesResponse> {
let cfg = &state.config;
let chains = &cfg.features.chains;
Json(CapabilitiesResponse {
version: env!("CARGO_PKG_VERSION").to_string(),
chains: ChainCapabilities {
btc: ChainCapability {
enabled: chains.btc,
network: Some(cfg.chains.btc.network.clone()),
},
ltc: ChainCapability {
enabled: chains.ltc,
network: Some(cfg.chains.ltc.network.clone()),
},
xmr: ChainCapability {
enabled: chains.xmr,
network: None,
},
wow: ChainCapability {
enabled: chains.wow,
network: None,
},
grin: ChainCapability {
enabled: chains.grin,
network: None,
},
},
features: FeatureCapabilities {
grin_relay: cfg.features.grin_relay,
prices: cfg.features.prices,
nostr_identity: cfg.features.nostr_identity,
tips: cfg.features.tips,
},
})
Json(effective_capabilities(&state.config))
}
/// Capability route, RELATIVE to the `/api/v1` mount point. Public (no auth).