diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md index d8c89d20..09238cca 100644 --- a/.planning/REQUIREMENTS.md +++ b/.planning/REQUIREMENTS.md @@ -18,6 +18,7 @@ declared exit criteria (multinode pass + workstreams B/C/F), `.planning/codebase - [ ] **FED-04**: Mesh messaging parity — attachment send (and the rest of the mesh chat surface) behaves identically on the demo and on real nodes: the demo backend implements the same RPC surface the UI calls, transport decisions mirror the real size-based tier logic, and no demo-only modals exist - [ ] **FED-05**: Inter-node Lightning channel opening UX — the UI shows the node's shareable Lightning URI; lists trusted (federated) nodes by hostname for one-click channel opening; and lets the user browse/request channels with public nodes — using the existing design system and components, verified on the :8100 dev preview against archi-dev before deploy - [ ] **FED-06**: On-brand payment success animation — the invoice "paid" tick's circle uses the screensaver-style ring with outer EQ-segment lines (reuse `ScreensaverRing.vue`'s compact size) in place of the current success burst, applied consistently everywhere the paid tick shows +- [ ] **FED-07**: Fedimint gateway never installs with a pre-set password — gateway credentials are generated per-install via manifest-declared `generated_secrets` (or explicitly set by the user), never baked into the image/manifest; existing installs with the default password get a migration path (BLOCKER — default credentials are a security hole) ### UI Performance (PERF) @@ -100,6 +101,7 @@ Which phases cover which requirements. Updated during roadmap creation. | FED-04 | Phase 1 | Pending | | FED-05 | Phase 1 | Pending | | FED-06 | Phase 1 | Pending | +| FED-07 | Phase 1 | Pending | | PERF-01 | Phase 2 | Complete | | PERF-02 | Phase 2 | In Progress (02-02 tracer done; 02-04..02-07 extend to remaining tabs) | | PERF-03 | Phase 2 | Pending | diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 89f3b6dd..6c1cdb36 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -34,7 +34,7 @@ signed/decentralized registry and a user installs it on their node. **Goal**: Federation and mesh are tight — a structured review of the fleet/federation and mesh code feeds fixes so node removal sticks, sync converges, and mesh messaging (including attachments) behaves identically everywhere it runs **Depends on**: Nothing (first phase) -**Requirements**: FED-01, FED-02, FED-03, FED-04, FED-05, FED-06 +**Requirements**: FED-01, FED-02, FED-03, FED-04, FED-05, FED-06, FED-07 **Success Criteria** (what must be TRUE): 1. A structured code review of the federation/fleet area (`core/archipelago/src/federation`, node sync, FIPS/transport dial layer) and the mesh area (`core/archipelago/src/mesh`, mesh RPC surface) produces a findings list, and every finding is fixed or explicitly deferred with a reason @@ -43,6 +43,7 @@ signed/decentralized registry and a user installs it on their node. 4. Mesh attachment send works identically on the demo and on real nodes — same modals, same transport decisions, same success — with the demo backend implementing the same RPC surface the UI calls (no "Method not found", no demo-only chooser modal) 5. Channel-opening between nodes is first-class UI: a user can copy/share their node's Lightning URI; sees a list of trusted (federated) nodes by hostname to open a channel with in one flow; and can browse/request channels with public nodes — built with the existing design system (Teleport-to-body modals, house style), tested live on the :8100 dev preview against archi-dev, and fixed there before any deploy 6. The invoice/payment "paid" success animation is on-brand: the tick's circle is the screensaver-style ring with the outer EQ-segment lines (reuse `neode-ui/src/components/ScreensaverRing.vue`, which already ships a `compact` overlay size), replacing the current burst in the payment success pane (`neode-ui/src/components/SendBitcoinModal.vue`) and matching wherever else the paid tick appears + 7. Fedimint gateway installs have no pre-set password (BLOCKER, added 2026-07-30): a fresh install generates its gateway credentials per-install via manifest-declared `generated_secrets` (per the repo secrets invariant) or requires the user to set one — never a baked-in default; existing installs carrying the default password are migrated or flagged. NOTE: phase 1's 10 plans predate this criterion — an additional gap plan is required before phase 1 execution completes **Plans**: 10 plans diff --git a/.planning/STATE.md b/.planning/STATE.md index b2cd5f2c..30bc20f4 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -102,6 +102,7 @@ Decisions are logged in PROJECT.md (10 locked ADRs in the `` block + ### Pending Todos - [blocker/ui] Keep FIPS/Tor pills on cloud files and show them on mobile (`.planning/todos/pending/2026-07-30-keep-fips-tor-pills-on-cloud-files-and-show-them-on-mobile.md`) +- [blocker/security] Fedimint gateway must not install with a pre-set password — tracked as FED-07 / Phase 1 gap plan (`.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md`) ### Blockers/Concerns diff --git a/.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md b/.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md new file mode 100644 index 00000000..34998d08 --- /dev/null +++ b/.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md @@ -0,0 +1,21 @@ +--- +created: 2026-07-30T22:19:31.770Z +title: Fedimint gateway must not install with a pre-set password +area: security +severity: blocker +files: + - core/archipelago/src (app orchestrator / secrets materialisation) +--- + +## Problem + +Dorian reports (2026-07-30): the Fedimint gateway app installs with a password already set up — i.e. a default/pre-baked credential rather than one generated at install time or set by the user. Default credentials on a Lightning/fedimint gateway are a security hole: anyone knowing the shipped default can access the gateway. Dorian rated this a blocker. + +This also violates the repo's standing secrets invariant (CLAUDE.md): secrets must be manifest-declared (`generated_secrets`, materialised by `container::secrets`, 0600/rootless) — never hardcoded or per-app baked in. + +## Solution + +Tracked as requirement **FED-07** (Phase 1, ROADMAP success criterion 7 — needs a gap plan since phase 1's 10 plans predate it): +- Find where the fedimint gateway app's manifest/install path sets its password (check `/opt/archipelago/apps/*/manifest.yml` for the gateway, and the orchestrator's secrets materialisation). +- Move it to `generated_secrets` so each install gets a unique credential, or require explicit user setup. +- Migration path for existing installs still carrying the default password (migrations must never destroy data).