mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
jwinterm
7ddb586cbe
Reworked clean from the chain-audit playbook into one generic client over CryptoNoteNetwork (Monero + Wownero share the LWS API). The LWS may be remote/community-run, so every response is treated as hostile. Security (closes the audit CRITICAL/HIGH/MEDIUM findings): - The two `&str` byte-slice panics are GONE: responses are parsed via a generic post_json -> read_capped -> serde_json::from_slice path. No byte-indexing of an untrusted body anywhere; the JSON-error-column slice is deleted. - Streaming size cap (8 MiB) enforced as bytes arrive (content-length is attacker-asserted) + shared reqwest client with request/connect timeouts. No unbounded read, no slowloris. - Admin key held in a redacting `Secret` (Debug -> "***"); secret-bearing request structs drop `Debug`; #[instrument] skips view_key. - Non-success -> generic NodeError tagged with a static endpoint label + status code only; the upstream body is never interpolated into a log or error. Transport (connect) errors are logged privately, redacted publicly. - Amounts are u64 end-to-end via the fail-closed string_or_* deserializers (garbage/overflow -> Err, never panic/silent-zero); mempool sum and confirmation math use saturating ops; future-block confirmation -> 0. - Ring/decoy count clamped (MAX_DECOY_COUNT) + request/parsed fan-out capped (MAX_PARSED_VEC). 0-conf architecture: default is REST-poll (compute pending on-demand from get_address_txs, which includes mempool on current monero-lws). HTTP webhooks are NOT brought over (redundant + fragile per docs/lws-update.md); ZMQ-push stays an optional, feature-flagged unit for single/own backends wanting instant confirms. Kept the account-lifecycle calls (modify_account_status/rescan/account_scan_height) — those are the deep-sleep machinery REST-poll uses to wake/sleep accounts for scale. Dropped the /login pending flow + all dead/tip surface. Adds a shared redacting `Secret` (core::secret, grin reuses) and the reqwest `stream` feature for bounded reads. types.rs kept (the string_or_* fail-closed helpers) with secret request structs de-Debug'd and error-not-panic tests. 15 L2 tests. Adversarially reviewed (7/7 audit findings closed; future-block confirmation hardened).
118 lines
3.4 KiB
TOML
118 lines
3.4 KiB
TOML
[package]
|
|
name = "smirk-backend-core"
|
|
version = "0.3.0"
|
|
edition = "2021"
|
|
authors = ["John Winter Murphy <jw@such.software>"]
|
|
description = "Open, self-hostable backend for the Smirk non-custodial multi-chain wallet"
|
|
repository = "https://github.com/smirk-cash/smirk-backend-core"
|
|
# license: TBD — deciding MIT vs AGPL-3.0-or-later (see README). Left unset until chosen.
|
|
# Not a library for crates.io; this is a deployable server. Guard against accidental publish.
|
|
publish = false
|
|
|
|
[lib]
|
|
name = "smirk_backend_core"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "smirk-backend-core"
|
|
path = "src/main.rs"
|
|
|
|
# Additional binaries (gen_openapi, smirk-admin, ...) are auto-discovered from src/bin/*.rs.
|
|
|
|
[dependencies]
|
|
# Async Runtime
|
|
tokio = { version = "1.35", features = ["full"] }
|
|
|
|
# Web Framework
|
|
axum = { version = "0.7", features = ["ws", "macros"] }
|
|
axum-extra = { version = "0.9", features = ["typed-header"] }
|
|
tower = { version = "0.4", features = ["limit", "timeout", "load-shed", "util"] }
|
|
tower-http = { version = "0.5", features = ["cors", "trace", "compression-gzip"] }
|
|
tower_governor = "0.4"
|
|
governor = "0.6"
|
|
|
|
# Database
|
|
sqlx = { version = "0.7", features = ["runtime-tokio-rustls", "postgres", "chrono", "uuid", "ipnetwork", "migrate"] }
|
|
ipnetwork = "0.20"
|
|
|
|
# Serialization
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
|
|
# OpenAPI generation (autodocs): the public API spec is derived from the handlers
|
|
# via utoipa, then drives the generated TypeScript client. Single source of truth.
|
|
utoipa = { version = "5", features = ["chrono", "uuid"] }
|
|
|
|
# HTTP Client. `stream` enables bounded, cap-while-reading response bodies
|
|
# (content-length is attacker-asserted, so we enforce the cap as bytes arrive).
|
|
reqwest = { version = "0.11", features = ["json", "rustls-tls", "stream"] }
|
|
|
|
# Cryptography
|
|
hmac = "0.12"
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
jsonwebtoken = "9.2"
|
|
rand = "0.8"
|
|
uuid = { version = "1.6", features = ["v4", "serde"] }
|
|
urlencoding = "2.1"
|
|
base64 = "0.22"
|
|
aes-gcm = "0.10"
|
|
# Proof-of-work gate for wallet registration (ALTCHA v2, PBKDF2/SHA-256).
|
|
altcha = "0.1"
|
|
# Constant-time byte comparison for token/secret verification. Never use == on secrets.
|
|
subtle = "2.5"
|
|
# secp256k1 for Grin ECDH/ECDSA and Nostr (NIP-98) BIP-340 schnorr verification.
|
|
k256 = { version = "0.13", features = ["ecdh", "ecdsa", "schnorr"] }
|
|
# Ed25519 for website auth signature verification.
|
|
ed25519-dalek = "2.1"
|
|
|
|
# Bitcoin/Litecoin chain access — Electrum/Fulcrum only (reads, fee, broadcast).
|
|
# No Core-RPC client: a self-hosted Fulcrum relays broadcasts to its own node.
|
|
tokio-rustls = "0.25"
|
|
rustls = "0.22"
|
|
rustls-pki-types = "1.0"
|
|
webpki-roots = "0.26"
|
|
bs58 = "0.5"
|
|
|
|
# Monero/Wownero address parsing
|
|
monero = "0.20"
|
|
|
|
# ZeroMQ (LWS real-time 0-conf notifications)
|
|
zeromq = "0.4"
|
|
|
|
# MessagePack (LWS msgpack wire format)
|
|
rmp-serde = "1.3"
|
|
|
|
# URL parsing
|
|
url = "2.5"
|
|
|
|
# Configuration
|
|
dotenvy = "0.15"
|
|
|
|
# Logging
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
|
|
# Time
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
|
|
# Async utilities
|
|
futures = "0.3"
|
|
async-trait = "0.1"
|
|
|
|
# Validation
|
|
validator = { version = "0.16", features = ["derive"] }
|
|
bech32 = "0.12.0"
|
|
|
|
[dev-dependencies]
|
|
tokio-test = "0.4"
|
|
mockall = "0.12"
|
|
|
|
[profile.release]
|
|
lto = true
|
|
codegen-units = 1
|
|
panic = "unwind"
|
|
strip = true
|
|
# Trap integer overflow in release too (defense-in-depth for crypto/auth paths).
|
|
overflow-checks = true
|