From d8a361bdcfaa8cc5b39d9675e74b0e1d2e42be2c Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sun, 13 Sep 2026 20:44:48 -0700
Subject: security: drop the admin endpoint surface and land pending hardening

Removes the admin-gated endpoints and the account flags they set, plus a
batch of hardening that had accumulated uncommitted in the tree. These were
deployed and verified together, so they land as one change.

admin surface:
  - drop POST /hidepay, POST /unlimit and GET /users, their handlers, and
    the now-unused admin preValidation export
  - `unlimited` was only ever written, never read; `hidepay` only appeared
    in output projections. Both flags go, along with their whitelist,
    public-fields and type entries.

request log:
  - redactBody now recurses. It only masked top-level keys, so a body that
    nests credentials one level down wrote them to the log in plaintext,
    and pin fields were not on the list at all.

payments:
  - sendOnchain/build gate `aid` through requireAccount, so a caller can
    only spend from an account it owns
  - sendOnchain signs only a tx we composed, matched against a short-lived
    per-account build receipt
  - raise xpay retry_for to 60s; route-finding preferred a drained zero-fee
    hop and burned the whole budget on it. check()'s reversal window keeps
    its 2x margin.

ecash / invoices / webhooks:
  - resolve a token's mint through the IP-pinning fetcher instead of plain
    fetch, closing an unauthenticated SSRF path into the internal network
  - reject non-positive amounts before the balance write
  - /sign requires the caller to own the address, rather than signing under
    any address the hot wallet controls
  - webhook delivery no longer disables TLS verification; the body carries
    the merchant's shared secret

registration:
  - refuse a username the v3 registrar holds unless the caller's own nostr
    key is the holder (lib/names.ts)

liquid:
  - honour the deposit kill switch at invoice generation and at credit

elements image:
  - pin 23.3.4 and verify the release tarball checksum

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0112TGi9GGNWqji1XQ5jZRzc
---
 lib/ecash.ts | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

(limited to 'lib/ecash.ts')

diff --git a/lib/ecash.ts b/lib/ecash.ts
index c304a8b8..9ce8b4e5 100644
--- a/lib/ecash.ts
+++ b/lib/ecash.ts
@@ -1,6 +1,7 @@
 import config from "$config";
 import { g, s } from "$lib/db";
 import { lnb } from "$lib/ln";
+import { safeGot } from "$lib/safe-fetch";
 import { fail, wait } from "$lib/utils";
 import {
   CashuMint,
@@ -46,9 +47,17 @@ const withCashLock = async <T>(fn: () => Promise<T>): Promise<T> => {
   }
 };
 
+// `mint` comes straight out of an attacker-supplied cashu token, and this is
+// the first thing we do with it — so fetching it with cashu-ts's plain fetch
+// made every /cash and /ecash entry point an unauthenticated SSRF probe into
+// the internal network. Use the same IP-pinning fetcher lnurl resolution uses
+// (it rejects loopback/private/link-local/CGNAT/metadata targets and closes the
+// DNS-rebinding window by pinning the socket to the IP it validated). NUT-06
+// /v1/info is exactly what CashuMint.getInfo() would have called.
 const ext = async (mint) => {
-  const issuer = new CashuMint(mint);
-  const { pubkey: issuerPk } = await issuer.getInfo();
+  const { pubkey: issuerPk } = await safeGot(
+    `${String(mint).replace(/\/+$/, "")}/v1/info`,
+  );
   const { pubkey: ourPk } = await m.getInfo();
   return issuerPk !== ourPk;
 };
-- 
cgit v1.2.3