jwinterm
2d0077b2b9
Make /capabilities fail-closed and add the admin features surface. - Secret-presence downgrade (§4.2): a chain whose flag is on but whose source is unconfigured (btc/ltc no electrum URL, xmr/wow no LWS admin key, grin no owner secret) now reports enabled:false — so /capabilities never advertises a chain that would 404, and a missing-secret downgrade is indistinguishable from a deliberately-off chain. grin_relay requires serviceable Grin; nostr_identity requires PUBLIC_API_URL. effective_capabilities() is the single explicit mapper. - contract_version stamp on the public document (clients soft-notice a higher value, ignore unknown additive keys). - GET /admin/features (admin_guard): the resolved effective state PLUS admin-only downgrade reasons (the public surface hides the reason, per §4.3). - Golden test: the public capabilities JSON, built from a fully-secret-seeded config, contains no secret value (asserts no "integration-test-" substring). openapi regenerated (contract_version). Admin features view stays off the public OpenAPI. Deferred (documented): runtime mutation — PUT /admin/features + a DB feature- override table + resolve() precedence + Arc hot-swap + CLI `features set`. Flags are env/config-driven for v1; runtime tuning (and its fleet propagation, itself a deferred LB decision) is a later addition.
smirk-backend-core
Open, self-hostable backend for the Smirk non-custodial, multi-chain wallet. It provides the chain-access and identity surface a Smirk wallet needs — authentication, per-chain wallet access (Bitcoin, Litecoin, Monero, Wownero, Grin), the Grin slatepack relay, and Nostr-based identity — so anyone can run their own backend and a Smirk wallet can connect to it.
Status: early, under active development. Interfaces and the database schema may change before the first tagged release. Not yet recommended for production self-hosting.
What it is
- Non-custodial. The server never holds spend keys or seeds. It brokers access to blockchain data and relays wallet-to-wallet messages.
- Open core, feature-flagged. Every feature ships in this codebase and is
toggled per deployment; the wallet reads
GET /api/v1/capabilitiesand adapts to what a given backend offers. - Identity via "Sign in with Smirk". Authentication uses a seed-derived Nostr key (NIP-98); the server stores only public keys.
- Privacy first. No PII is required to use it; operator and user privacy are explicit design goals.
Architecture
Rust + Axum, PostgreSQL via sqlx. The public HTTP contract is generated from the handlers with utoipa (OpenAPI), which in turn drives the wallet's generated TypeScript client — one source of truth, checked for drift in CI.
Quickstart
cp .env.example .env # then fill in DATABASE_URL, JWT_SECRET, node URLs
cargo run # starts the API server
A full self-hosting guide (node requirements, reverse proxy, Tor admin onion,
backups) will live in docs/ as it stabilises.
Security
Please report vulnerabilities privately — see SECURITY.md. Do not open public issues for security reports.
License
To be finalized (MIT vs AGPL-3.0-or-later). Until a LICENSE file is added,
all rights are reserved.