From 57989dfc58f243d4baf7de0d6ce67ef647e581bf Mon Sep 17 00:00:00 2001 From: archipelago Date: Fri, 31 Jul 2026 00:39:17 -0400 Subject: [PATCH] fix(02-review): CR-01 web5.lnd-info/profits resources must not persist to sessionStorage Web5.vue's lndInfoRes and profitsRes defaulted to persist:true (via useCachedResource's default), writing live LND wallet balances and channel balances to sessionStorage in plaintext -- a T-02-01 violation. Add explicit persist:false to both, matching the "never defaulted" rule this phase established everywhere else. Also updates Home.vue's comment, which previously documented this as a known unfixed gap. Co-Authored-By: Claude --- neode-ui/src/views/Home.vue | 9 ++++----- neode-ui/src/views/web5/Web5.vue | 2 ++ 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/neode-ui/src/views/Home.vue b/neode-ui/src/views/Home.vue index 78e3627d..01435faf 100644 --- a/neode-ui/src/views/Home.vue +++ b/neode-ui/src/views/Home.vue @@ -535,12 +535,11 @@ const cloudFolderDisplay = computed(() => cloudFolderCount.value !== null ? Stri // Web5.vue's own two resources (web5.networking-profits, web5.lnd-info) // were read and are NOT shared here: web5.networking-profits is an // unrelated dataset (routing/content-sale profit totals), and -// web5.lnd-info's default persist:true (Web5.vue is out of this plan's -// file scope to fix) would leak balance data to sessionStorage via its own -// independent refresh cycle regardless of what Home declares for the same -// key — sharing that key would either corrupt Web5.vue's differently-shaped +// web5.lnd-info now declares persist: false explicitly (fixed, CR-01) so its +// independent refresh cycle can never leak balance data to sessionStorage — +// sharing that key would still either corrupt Web5.vue's differently-shaped // entry.data (a real number here vs. its typed balance object there) or -// silently fail to close the sessionStorage gap this task exists to close. +// require Home to also opt into persist: false for no benefit. // Home's own wallet fetch is also a strictly broader 7-call composite // (lnd.getinfo + ecash/fedimint/ark balances + 3 histories), not the same // single-call dataset. See 02-06-SUMMARY.md for the full finding. diff --git a/neode-ui/src/views/web5/Web5.vue b/neode-ui/src/views/web5/Web5.vue index 3195f8d4..db004627 100644 --- a/neode-ui/src/views/web5/Web5.vue +++ b/neode-ui/src/views/web5/Web5.vue @@ -140,6 +140,7 @@ function showToast(text: string) { const profitsRes = useCachedResource({ key: 'web5.networking-profits', fetcher: (signal) => rpcClient.call({ method: 'wallet.networking-profits', signal, dedup: true, maxRetries: 1 }), + persist: false, // routing/content-sale profit totals — financial data (T-02-01) }) const profitsBreakdown = computed(() => profitsRes.data.value @@ -297,6 +298,7 @@ const lndInfoRes = useCachedResource<{ }>({ key: 'web5.lnd-info', fetcher: (signal) => rpcClient.call({ method: 'lnd.getinfo', signal, dedup: true, maxRetries: 1 }), + persist: false, // wallet balance — must never land in sessionStorage (T-02-01) }) // connectWallet() can still "disconnect" the (hidden) wallet card UI-side. const walletManuallyDisconnected = ref(false)