lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 1 Actions Packages Projects Releases 63 Wiki Activity

fix(02-review): CR-01 web5.lnd-info/profits resources must not persist to sessionStorage

Browse Source 
Web5.vue's lndInfoRes and profitsRes defaulted to persist:true (via
useCachedResource's default), writing live LND wallet balances and
channel balances to sessionStorage in plaintext -- a T-02-01 violation.
Add explicit persist:false to both, matching the "never defaulted"
rule this phase established everywhere else. Also updates Home.vue's
comment, which previously documented this as a known unfixed gap.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
archipelago 2026-07-31 00:39:17 -04:00
parent 921f450edf
commit 57989dfc58
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
neode-ui/src/views/Home.vue
View File

@ -535,12 +535,11 @@ const cloudFolderDisplay = computed(() => cloudFolderCount.value !== null ? Stri
// Web5.vue's own two resources (web5.networking-profits, web5.lnd-info)
// were read and are NOT shared here: web5.networking-profits is an
// unrelated dataset (routing/content-sale profit totals), and
// web5.lnd-info's default persist:true (Web5.vue is out of this plan's
// file scope to fix) would leak balance data to sessionStorage via its own
// independent refresh cycle regardless of what Home declares for the same
// key — sharing that key would either corrupt Web5.vue's differently-shaped
// web5.lnd-info now declares persist: false explicitly (fixed, CR-01) so its
// independent refresh cycle can never leak balance data to sessionStorage —
// sharing that key would still either corrupt Web5.vue's differently-shaped
// entry.data (a real number here vs. its typed balance object there) or
// silently fail to close the sessionStorage gap this task exists to close.
// require Home to also opt into persist: false for no benefit.
// Home's own wallet fetch is also a strictly broader 7-call composite
// (lnd.getinfo + ecash/fedimint/ark balances + 3 histories), not the same
// single-call dataset. See 02-06-SUMMARY.md for the full finding.

2
neode-ui/src/views/web5/Web5.vue
View File

@ -140,6 +140,7 @@ function showToast(text: string) {
const profitsRes = useCachedResource<ProfitsData>({
key: 'web5.networking-profits',
fetcher: (signal) => rpcClient.call<ProfitsData>({ method: 'wallet.networking-profits', signal, dedup: true, maxRetries: 1 }),
persist: false, // routing/content-sale profit totals — financial data (T-02-01)
})
const profitsBreakdown = computed<ProfitsData | null>(() =>
profitsRes.data.value
@ -297,6 +298,7 @@ const lndInfoRes = useCachedResource<{
}>({
key: 'web5.lnd-info',
fetcher: (signal) => rpcClient.call({ method: 'lnd.getinfo', signal, dedup: true, maxRetries: 1 }),
persist: false, // wallet balance — must never land in sessionStorage (T-02-01)
})
// connectWallet() can still "disconnect" the (hidden) wallet card UI-side.
const walletManuallyDisconnected = ref(false)