fix(02-review): CR-01 web5.lnd-info/profits resources must not persist to sessionStorage
Web5.vue's lndInfoRes and profitsRes defaulted to persist:true (via useCachedResource's default), writing live LND wallet balances and channel balances to sessionStorage in plaintext -- a T-02-01 violation. Add explicit persist:false to both, matching the "never defaulted" rule this phase established everywhere else. Also updates Home.vue's comment, which previously documented this as a known unfixed gap. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -535,12 +535,11 @@ const cloudFolderDisplay = computed(() => cloudFolderCount.value !== null ? Stri
|
||||
// Web5.vue's own two resources (web5.networking-profits, web5.lnd-info)
|
||||
// were read and are NOT shared here: web5.networking-profits is an
|
||||
// unrelated dataset (routing/content-sale profit totals), and
|
||||
// web5.lnd-info's default persist:true (Web5.vue is out of this plan's
|
||||
// file scope to fix) would leak balance data to sessionStorage via its own
|
||||
// independent refresh cycle regardless of what Home declares for the same
|
||||
// key — sharing that key would either corrupt Web5.vue's differently-shaped
|
||||
// web5.lnd-info now declares persist: false explicitly (fixed, CR-01) so its
|
||||
// independent refresh cycle can never leak balance data to sessionStorage —
|
||||
// sharing that key would still either corrupt Web5.vue's differently-shaped
|
||||
// entry.data (a real number here vs. its typed balance object there) or
|
||||
// silently fail to close the sessionStorage gap this task exists to close.
|
||||
// require Home to also opt into persist: false for no benefit.
|
||||
// Home's own wallet fetch is also a strictly broader 7-call composite
|
||||
// (lnd.getinfo + ecash/fedimint/ark balances + 3 histories), not the same
|
||||
// single-call dataset. See 02-06-SUMMARY.md for the full finding.
|
||||
|
||||
Reference in New Issue
Block a user