fix(02-review): CR-01 web5.lnd-info/profits resources must not persist to sessionStorage

Web5.vue's lndInfoRes and profitsRes defaulted to persist:true (via
useCachedResource's default), writing live LND wallet balances and
channel balances to sessionStorage in plaintext -- a T-02-01 violation.
Add explicit persist:false to both, matching the "never defaulted"
rule this phase established everywhere else. Also updates Home.vue's
comment, which previously documented this as a known unfixed gap.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-07-31 04:17:38 -04:00
co-authored by Claude
parent 921f450edf
commit 57989dfc58
2 changed files with 6 additions and 5 deletions
+4 -5
View File
@@ -535,12 +535,11 @@ const cloudFolderDisplay = computed(() => cloudFolderCount.value !== null ? Stri
// Web5.vue's own two resources (web5.networking-profits, web5.lnd-info)
// were read and are NOT shared here: web5.networking-profits is an
// unrelated dataset (routing/content-sale profit totals), and
// web5.lnd-info's default persist:true (Web5.vue is out of this plan's
// file scope to fix) would leak balance data to sessionStorage via its own
// independent refresh cycle regardless of what Home declares for the same
// key — sharing that key would either corrupt Web5.vue's differently-shaped
// web5.lnd-info now declares persist: false explicitly (fixed, CR-01) so its
// independent refresh cycle can never leak balance data to sessionStorage
// sharing that key would still either corrupt Web5.vue's differently-shaped
// entry.data (a real number here vs. its typed balance object there) or
// silently fail to close the sessionStorage gap this task exists to close.
// require Home to also opt into persist: false for no benefit.
// Home's own wallet fetch is also a strictly broader 7-call composite
// (lnd.getinfo + ecash/fedimint/ark balances + 3 histories), not the same
// single-call dataset. See 02-06-SUMMARY.md for the full finding.