mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
2d0077b2b9
Make /capabilities fail-closed and add the admin features surface. - Secret-presence downgrade (§4.2): a chain whose flag is on but whose source is unconfigured (btc/ltc no electrum URL, xmr/wow no LWS admin key, grin no owner secret) now reports enabled:false — so /capabilities never advertises a chain that would 404, and a missing-secret downgrade is indistinguishable from a deliberately-off chain. grin_relay requires serviceable Grin; nostr_identity requires PUBLIC_API_URL. effective_capabilities() is the single explicit mapper. - contract_version stamp on the public document (clients soft-notice a higher value, ignore unknown additive keys). - GET /admin/features (admin_guard): the resolved effective state PLUS admin-only downgrade reasons (the public surface hides the reason, per §4.3). - Golden test: the public capabilities JSON, built from a fully-secret-seeded config, contains no secret value (asserts no "integration-test-" substring). openapi regenerated (contract_version). Admin features view stays off the public OpenAPI. Deferred (documented): runtime mutation — PUT /admin/features + a DB feature- override table + resolve() precedence + Arc hot-swap + CLI `features set`. Flags are env/config-driven for v1; runtime tuning (and its fleet propagation, itself a deferred LB decision) is a later addition.