auth: fail closed on adminpass, scrub sample secrets (S3)

The master-password path (isAdmin = password === config.adminpass) logs
in as any user, skipping password, 2FA, and captcha. Worse, when
adminpass is unset an omitted password field made undefined === undefined
true, authenticating as anyone. Require both the configured value and the
supplied password to be non-empty and match exactly, across every
adminpass comparison (login, recaptcha bypass, support email, freeze).

Also scrub config.ts.sample: the sample shipped a working-looking JWT
secret, two server nsec keys, and adminpass "pwa". Replace with
fail-closed placeholders and regenerate instructions. Rotate any
deployment that ever shipped the sample values.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

4 files changed, 22 insertions, 8 deletions

diff --git a/config.ts.sample b/config.ts.sample
index 1becf362..80162f5f 100644
--- a/config.ts.sample
+++ b/config.ts.sample
@@ -12,7 +12,10 @@ export default {
     "wss://relay.nostr.bg",
     "wss://nostr.orangepill.dev"
   ],
-  jwt: "00d0ab4f7738a83feb37f661526512063c41e49278b7c32cba87314269a5788b",
+  // SECURITY: generate a fresh 32-byte secret before deploying —
+  // `openssl rand -hex 32`. This also keys @fastify/secure-session, so a
+  // published value lets anyone forge session JWTs and read the session cookie.
+  jwt: "0000000000000000000000000000000000000000000000000000000000000000",
   bitcoin: {
     host: "bc",
     wallet: "coinos",
@@ -33,10 +36,16 @@ export default {
   lightning: "/home/bun/app/data/lightning/regtest/lightning-rpc",
   lightningb: "/home/bun/app/data/lightningb/regtest/lightning-rpc",
   fee: 0.001,
-  adminpass: "pwa",
+  // SECURITY: the admin login path is disabled when this is empty (fails
+  // closed). Set a strong, unique value only if you need admin impersonation;
+  // never ship the sample value.
+  adminpass: "",
   support: "[email protected]",
-  nostrKey: "nsec1msk3dqy2pzqy2murmm5s5gejfgkjkm2zesnh266gud2wcvhcunzqlu0h90",
-  nostrKey2: "nsec17ugnsk0qrnakf7xaxzckya4xvx58q063k6q4vq2l577k4uyv9r0qmdcgm5",
+  // SECURITY: generate fresh keys — never deploy these sample values. These are
+  // the server NWC wallet-service key and the zap-receipt signer.
+  //   node -e "import('nostr-tools').then(n=>console.log(n.nip19.nsecEncode(n.generateSecretKey())))"
+  nostrKey: "nsec1replacewithafreshlygeneratedkeydonotusethissamplevalue0",
+  nostrKey2: "nsec1replacewithafreshlygeneratedkeydonotusethissamplevalue1",
   mintUrl: "http://mint:3338",
   square: {
     environment: SquareEnvironment.Sandbox,
diff --git a/routes/email.ts b/routes/email.ts
index 1b8dd9f0..eb256f1a 100644
--- a/routes/email.ts
+++ b/routes/email.ts
@@ -22,7 +22,7 @@ export default {
         })
         .json();
 
-      if (success || response === config.adminpass) {
+      if (success || (!!config.adminpass && response === config.adminpass)) {
         body.token = undefined;
 
         warn("support request from", email);
diff --git a/routes/payments.ts b/routes/payments.ts
index 9751b421..4f0e7f6e 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -625,7 +625,7 @@ export default {
       body: { secret },
     } = req;
     try {
-      if (secret !== config.adminpass) fail("unauthorized");
+      if (!config.adminpass || secret !== config.adminpass) fail("unauthorized");
       await s("freeze", true);
       res.send("ok");
     } catch (e) {
diff --git a/routes/users.ts b/routes/users.ts
index 63699777..eafcd74a 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -70,7 +70,7 @@ const verifyRecaptcha = async (response, req?) => {
         },
       })
       .json();
-    return success || response === config.adminpass;
+    return success || (!!config.adminpass && response === config.adminpass);
   } catch {
     return false;
   }
@@ -383,7 +383,12 @@ export default {
       if (ipCount === 1) await db.expire(ipKey, 10);
       if (ipCount > 30) return res.code(429).send({});
 
-      const isAdmin = password === config?.adminpass;
+      // Fail closed: an unset adminpass must never authenticate, and an omitted
+      // password field must never coincide with an unset value (undefined ===
+      // undefined). Both the configured value and the supplied one must be
+      // non-empty and match exactly.
+      const isAdmin =
+        !!config?.adminpass && !!password && password === config.adminpass;
 
       if (!isAdmin) {
         const recaptchaOk = await verifyRecaptcha(recaptcha, req);