From a7fc7959eeb58fa7230c7e0869012f03ad2b23b7 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 28 Aug 2026 11:11:32 -0700 Subject: fund: authenticated recovery of a rotated fund's old link MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a fund's secret id has been rotated (invalidating an exfiltrated id list), its old id 404s. Let a legit owner who bookmarked the old link find the fund again — but reveal the new id ONLY to an authenticated manager of the new fund, via a `fund:rotated:` -> newid map. An anonymous caller or a non-owner gets the same "fund not found" as before, so an attacker replaying a leaked old id learns nothing (an open old->new redirect would defeat the rotation). The /fund/:id route now runs `optional` auth so req.user is available without requiring it; bearer funds with no managers are intentionally not recoverable this way. rotate-funds.ts records the mapping on any future rotation. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01DKkev76U4YRnRAqM6jqbae --- index.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'index.ts') diff --git a/index.ts b/index.ts index 9ce509c2..755aa827 100644 --- a/index.ts +++ b/index.ts @@ -79,7 +79,7 @@ app.post("/payments", auth, payments.create); app.get("/payments", auth, payments.list); app.get("/payments/:hash", payments.get); app.post("/parse", auth, payments.parse); -app.get("/fund/:id", payments.fund); +app.get("/fund/:id", optional, payments.fund); // app.get("/fund/:name/withdraw", auth, payments.withdraw); app.get("/fund/:name/managers", payments.managers); app.post("/fund/managers", auth, payments.addManager); -- cgit v1.2.3