Initial ARC Support

.codacy.yaml

@@ -35,7 +35,7 @@ engines:
       # Semgrep browser/localStorage/HTTP FPs: storage keys, hub RPC, validated probes, server paths.
       - "constants.js"
       - "services/hub.js"
-      - "electron/desktopHubProbe.js"
+      - "scripts/desktopHubProbe.js"
       - "functions/bitcoinClient.js"
       - "functions/fabricMessageEnvelope.js"
       - "functions/hubUiAlerts.js"

DEVELOPERS.md

@@ -71,6 +71,9 @@ To enable a stub Lightning backend so the L2 buttons work without a real node: `
 ### Faucet (regtest)
 The **Faucet** on the Bitcoin page sends sats from the Beacon/Hub wallet to a given address. Regtest only; max 1,000,000 sats per request. Requires the Hub wallet to have balance (e.g. from Generate Block or Beacon epochs). `POST /services/bitcoin/faucet` with body `{ address, amountSats? }`.
 
+### Watch-only xpub HTTP queries (`scantxoutset`)
+Public hubs should set **`FABRIC_BITCOIN_XPUB_QUERY_TOKEN`** (or `settings.bitcoin.xpubQueryToken`) to a long random secret. When set, canonical watch-only **`scantxoutset`** endpoints **`GET /services/bitcoin/xpub`**, **`GET /services/bitcoin/xpub/utxos`**, and **`GET /services/bitcoin/xpub/transactions`** (all require **`?xpub=`**), and legacy **`GET /services/bitcoin/wallets/:walletId`** with **`?xpub=`** when `:walletId` is not the Hub’s loaded wallet, return **403** unless the client sends the same token via **`Authorization: Bearer`**, **`?apiToken=`** / **`?xpubQueryToken=`**, or header **`X-Fabric-Xpub-Query-Token`**. Omit the env var for local-only hubs where anonymous xpub scans are acceptable.
+
 ## Recent Changes (Contributor Context)
 
 ### 1) Payjoin Service Added

actions/apiActions.js

@@ -17,7 +17,7 @@ function assertClientFetchPath (input) {
   return s;
 }
 
-async function fetchFromAPI (path, params = {},token = null) {
+async function fetchFromAPI (path, token = null) {
   const safe = assertClientFetchPath(path);
   const response = await fetch(safe, {
     method: 'GET',
@@ -64,6 +64,7 @@ async function postAPI (path, params, token = null) {
 }
 
 module.exports = {
+  assertClientFetchPath,
   fetchFromAPI,
   patchAPI,
   postAPI

actions/bridgeActions.js

@@ -24,7 +24,7 @@ const bridgeSync = () => {
     const { token } = getState().auth.token;
     try {
       // TODO: get bridge instance
-      const instance = await fetchFromAPI(`/`, null, token);
+      const instance = await fetchFromAPI(`/`, token);
       dispatch(bridgeSyncSuccess(instance));
     } catch (error) {
       dispatch(bridgeSyncFailure(error));

actions/chatActions.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const fetch = require('cross-fetch');
+const { assertClientFetchPath } = require('./apiActions');
 
 // Action Types
 const CHAT_REQUEST = 'CHAT_REQUEST';
@@ -56,7 +57,7 @@
         requestBody.file_fabric_id = file_fabric_id;
       }
 
-      const response = await fetch('/messages', {
+      const response = await fetch(assertClientFetchPath('/messages'), {
         method: 'POST',
         headers: {
           'Authorization': `Bearer ${token}`,
@@ -101,7 +102,9 @@
     }
 
     try {
-      const response = await fetch(`/messages/${message.id}`, {
+      const response = await fetch(
+        assertClientFetchPath(`/messages/${encodeURIComponent(String(message && message.id != null ? message.id : ''))}`),
+        {
         method: 'PATCH',
         headers: {
           'Authorization': `Bearer ${token}`,
@@ -134,7 +137,7 @@
     if (!params.conversation_id) params.conversation_id = state.chat.message.conversation;
 
     try {
-      const response = await fetch('/messages?' + new URLSearchParams(params), {
+      const response = await fetch(assertClientFetchPath('/messages?' + new URLSearchParams(params)), {
         method: 'GET',
         headers: {
           'Authorization': `Bearer ${token}`,
@@ -162,7 +165,7 @@
     try {
       const state = getState();
       const token = state.auth.token;
-      const response = await fetch('/documents', {
+      const response = await fetch(assertClientFetchPath('/documents'), {
         method: 'SEARCH',
         headers: {
           //        'Authorization': `Bearer ${token}`,

actions/documentActions.js

@@ -1,12 +1,12 @@
 'use strict';
 
-const { fetchFromAPI } = require('./apiActions');
+const { assertClientFetchPath, fetchFromAPI } = require('./apiActions');
 const createTimeoutPromise = require('../functions/createTimeoutPromise');
 const { safeIdentityErr } = require('../functions/fabricSafeLog');
 
 
-async function fetchDocumentsFromAPI(token) {
-  return fetchFromAPI('/documents', null, token);
+async function fetchDocumentsFromAPI (token) {
+  return fetchFromAPI('/documents', token);
 }
 
 // Action types
@@ -18,10 +18,6 @@
 const FETCH_DOCUMENT_SUCCESS = 'FETCH_DOCUMENT_SUCCESS';
 const FETCH_DOCUMENT_FAILURE = 'FETCH_DOCUMENT_FAILURE';
 
-const FETCH_DOCUMENT_SECTIONS_REQUEST = 'FETCH_DOCUMENT_SECTIONS_REQUEST';
-const FETCH_DOCUMENT_SECTIONS_SUCCESS = 'FETCH_DOCUMENT_SECTIONS_SUCCESS';
-const FETCH_DOCUMENT_SECTIONS_FAILURE = 'FETCH_DOCUMENT_SECTIONS_FAILURE';
-
 const UPLOAD_DOCUMENT_REQUEST = 'UPLOAD_DOCUMENT_REQUEST';
 const UPLOAD_DOCUMENT_SUCCESS = 'UPLOAD_DOCUMENT_SUCCESS';
 const UPLOAD_DOCUMENT_FAILURE = 'UPLOAD_DOCUMENT_FAILURE';
@@ -34,18 +30,6 @@
 const CREATE_DOCUMENT_SUCCESS = 'CREATE_DOCUMENT_SUCCESS';
 const CREATE_DOCUMENT_FAILURE = 'CREATE_DOCUMENT_FAILURE';
 
-const CREATE_DOCUMENT_SECTION_REQUEST = 'CREATE_DOCUMENT_SECTION_REQUEST';
-const CREATE_DOCUMENT_SECTION_SUCCESS = 'CREATE_DOCUMENT_SECTION_SUCCESS';
-const CREATE_DOCUMENT_SECTION_FAILURE = 'CREATE_DOCUMENT_SECTION_FAILURE';
-
-const DELETE_DOCUMENT_SECTION_REQUEST = 'DELETE_DOCUMENT_SECTION_REQUEST';
-const DELETE_DOCUMENT_SECTION_SUCCESS = 'DELETE_DOCUMENT_SECTION_SUCCESS';
-const DELETE_DOCUMENT_SECTION_FAILURE = 'DELETE_DOCUMENT_SECTION_FAILURE';
-
-const EDIT_DOCUMENT_SECTION_REQUEST = 'EDIT_DOCUMENT_SECTION_REQUEST';
-const EDIT_DOCUMENT_SECTION_SUCCESS = 'EDIT_DOCUMENT_SECTION_SUCCESS';
-const EDIT_DOCUMENT_SECTION_FAILURE = 'EDIT_DOCUMENT_SECTION_FAILURE';
-
 const EDIT_DOCUMENT_REQUEST = 'EDIT_DOCUMENT_REQUEST';
 const EDIT_DOCUMENT_SUCCESS = 'EDIT_DOCUMENT_SUCCESS';
 const EDIT_DOCUMENT_FAILURE = 'EDIT_DOCUMENT_FAILURE';
@@ -63,10 +47,6 @@
 const fetchDocumentSuccess = (instance) => ({ type: FETCH_DOCUMENT_SUCCESS, payload: instance });
 const fetchDocumentFailure = (error) => ({ type: FETCH_DOCUMENT_FAILURE, payload: error });
 
-const fetchDocumentSectionsRequest = () => ({ type: FETCH_DOCUMENT_SECTIONS_REQUEST });
-const fetchDocumentSectionsSuccess = (sections) => ({ type: FETCH_DOCUMENT_SECTIONS_SUCCESS, payload: sections });
-const fetchDocumentSectionsFailure = (error) => ({ type: FETCH_DOCUMENT_SECTIONS_FAILURE, payload: error });
-
 const uploadDocumentRequest = () => ({ type: UPLOAD_DOCUMENT_REQUEST });
 const uploadDocumentSuccess = (fabric_id) => ({ type: UPLOAD_DOCUMENT_SUCCESS, payload: fabric_id });
 const uploadDocumentFailure = (error) => ({ type: UPLOAD_DOCUMENT_FAILURE, payload: error });
@@ -79,18 +59,6 @@
 const createDocumentSuccess = (results) => ({ type: CREATE_DOCUMENT_SUCCESS, payload: results });
 const createDocumentFailure = (error) => ({ type: CREATE_DOCUMENT_FAILURE, payload: error });
 
-const createSectionRequest = () => ({ type: CREATE_DOCUMENT_SECTION_REQUEST });
-const createSectionSuccess = (sections) => ({ type: CREATE_DOCUMENT_SECTION_SUCCESS, payload: sections });
-const createSectionFailure = (error) => ({ type: CREATE_DOCUMENT_SECTION_FAILURE, payload: error });
-
-const deleteSectionRequest = () => ({ type: DELETE_DOCUMENT_SECTION_REQUEST });
-const deleteSectionSuccess = (sections) => ({ type: DELETE_DOCUMENT_SECTION_SUCCESS, payload: sections });
-const deleteSectionFailure = (error) => ({ type: DELETE_DOCUMENT_SECTION_FAILURE, payload: error });
-
-const editSectionRequest = () => ({ type: EDIT_DOCUMENT_SECTION_REQUEST });
-const editSectionSuccess = (sections) => ({ type: EDIT_DOCUMENT_SECTION_SUCCESS, payload: sections });
-const editSectionFailure = (error) => ({ type: EDIT_DOCUMENT_SECTION_FAILURE, payload: error });
-
 const editDocumentRequest = () => ({ type: EDIT_DOCUMENT_REQUEST });
 const editDocumentSuccess = (document) => ({ type: EDIT_DOCUMENT_SUCCESS, payload: document });
 const editDocumentFailure = (error) => ({ type: EDIT_DOCUMENT_FAILURE, payload: error });
@@ -99,8 +67,6 @@
 const deleteDocumentSuccess = () => ({ type: DELETE_DOCUMENT_SUCCESS });
 const deleteDocumentFailure = (error) => ({ type: DELETE_DOCUMENT_FAILURE, payload: error });
 
-
-
 // Thunk action creator
 const fetchDocuments = () => {
   return async (dispatch, getState) => {
@@ -120,27 +86,14 @@
     dispatch(fetchDocumentRequest());
     const { token } = getState().auth.token;
     try {
-      const instance = await fetchFromAPI(`/documents/${encodeURIComponent(fabricID)}`, null, token);
+      const instance = await fetchFromAPI(`/documents/${encodeURIComponent(fabricID)}`, token);
       dispatch(fetchDocumentSuccess(instance));
     } catch (error) {
       dispatch(fetchDocumentFailure(error));
     }
   };
 };
 
-const fetchDocumentSections = (fabric_id) => {
-  return async (dispatch, getState) => {
-    dispatch(fetchDocumentSectionsRequest());
-    const { token } = getState().auth.token;
-    try {
-      const sections = await fetchFromAPI(`/documents/sections/${encodeURIComponent(fabric_id)}`, null, token);
-      dispatch(fetchDocumentSectionsSuccess(sections));
-    } catch (error) {
-      dispatch(fetchDocumentSectionsFailure(error));
-    }
-  };
-};
-
 const uploadDocument = (file) => {
   return async (dispatch, getState) => {
     dispatch(uploadDocumentRequest());
@@ -153,7 +106,7 @@
       data.append('name', file.name);
       data.append('file', file);
 
-      const fetchPromise = await fetch('/files', {
+      const fetchPromise = await fetch(assertClientFetchPath('/files'), {
         headers: {
           'Authorization': `Bearer ${token}`,
         },
@@ -183,7 +136,7 @@
     dispatch(searchDocumentRequest());
     const { token } = getState().auth;
     try {
-      const response = await fetch('/documents', {
+      const response = await fetch(assertClientFetchPath('/documents'), {
         headers: {
           'Accept': 'application/json',
           'Content-Type': 'application/json'
@@ -202,13 +155,12 @@
     }
   }
 }
-//this starts the document outline, its called in step 2 from document drafter
 const createDocument = (type, query) => {
   return async (dispatch, getState) => {
     dispatch(createDocumentRequest());
     const { token } = getState().auth;
     try {
-      const response = await fetch('/documents', {
+      const response = await fetch(assertClientFetchPath('/documents'), {
         headers: {
           Authorization: `Bearer ${token}`,
           'Content-Type': 'application/json'
@@ -231,93 +183,13 @@
   }
 }
 
-//this creates a new document section, it needs document fabricID, the order number that section will have and its title
-//can be called in step 3 when the user, and in the document view edit mode.
-const createDocumentSection = (fabricID, target, title, content = null) => {
-  return async (dispatch, getState) => {
-    dispatch(createSectionRequest());
-    const { token } = getState().auth;
-    try {
-      const response = await fetch(
-        `/documents/${encodeURIComponent(fabricID)}/section/${encodeURIComponent(target)}`,
-        {
-        headers: {
-          Authorization: `Bearer ${token}`,
-          'Content-Type': 'application/json'
-        },
-        method: 'POST',
-        body: JSON.stringify({ title, content })
-      });
-
-      const sections = await response.json();
-
-      dispatch(createSectionSuccess(sections));
-    } catch (error) {
-      console.error('Error fetching data:', safeIdentityErr(error));
-      dispatch(createSectionFailure(error.message));
-    }
-  }
-}
-
-const deleteDocumentSection = (fabricID, target) => {
-  return async (dispatch, getState) => {
-    dispatch(deleteSectionRequest());
-    const { token } = getState().auth;
-    try {
-      const response = await fetch(
-        `/documents/${encodeURIComponent(fabricID)}/section/delete/${encodeURIComponent(target)}`,
-        {
-        headers: {
-          Authorization: `Bearer ${token}`,
-          'Content-Type': 'application/json'
-        },
-        method: 'PATCH',
-      });
-
-      const sections = await response.json();
-
-      dispatch(deleteSectionSuccess(sections));
-    } catch (error) {
-      console.error('Error fetching data:', safeIdentityErr(error));
-      dispatch(deleteSectionFailure(error.message));
-    }
-  }
-}
-
-//this edits the document section, first we wont be editing content
-const editDocumentSection = (fabricID, target, title, content = null) => {
-  return async (dispatch, getState) => {
-    dispatch(editSectionRequest());
-    const { token } = getState().auth;
-    try {
-      const response = await fetch(
-        `/documents/${encodeURIComponent(fabricID)}/section/${encodeURIComponent(target)}`,
-        {
-        headers: {
-          Authorization: `Bearer ${token}`,
-          'Content-Type': 'application/json'
-        },
-        method: 'PATCH',
-        body: JSON.stringify({ title, content })
-      });
-
-      const obj = await response.json();
-
-      dispatch(editSectionSuccess(obj));
-    } catch (error) {
-      console.error('Error fetching data:', safeIdentityErr(error));
-      dispatch(editSectionFailure(error.message));
-    }
-  }
-}
-
-const editDocument = (fabricID,title) => {
+const editDocument = (fabricID, title) => {
   return async (dispatch, getState) => {
     dispatch(editDocumentRequest());
     const { token } = getState().auth;
     try {
       const response = await fetch(
-        `/documents/${encodeURIComponent(fabricID)}`,
+        assertClientFetchPath(`/documents/${encodeURIComponent(fabricID)}`),
         {
         headers: {
           Authorization: `Bearer ${token}`,
@@ -337,15 +209,13 @@
   }
 }
 
-//this sets the document status to deleted
-//remember to add the last migration
 const deleteDocument = (fabricID) => {
   return async (dispatch, getState) => {
     dispatch(deleteDocumentRequest());
     const { token } = getState().auth;
     try {
       const response = await fetch(
-        `/documents/delete/${encodeURIComponent(fabricID)}`,
+        assertClientFetchPath(`/documents/delete/${encodeURIComponent(fabricID)}`),
         {
         headers: {
           Authorization: `Bearer ${token}`,
@@ -370,13 +240,9 @@
 module.exports = {
   fetchDocument,
   fetchDocuments,
-  fetchDocumentSections,
   uploadDocument,
   searchDocument,
   createDocument,
-  createDocumentSection,
-  deleteDocumentSection,
-  editDocumentSection,
   editDocument,
   deleteDocument,
   FETCH_DOCUMENT_REQUEST,
@@ -385,9 +251,6 @@
   FETCH_DOCUMENTS_REQUEST,
   FETCH_DOCUMENTS_SUCCESS,
   FETCH_DOCUMENTS_FAILURE,
-  FETCH_DOCUMENT_SECTIONS_REQUEST,
-  FETCH_DOCUMENT_SECTIONS_SUCCESS,
-  FETCH_DOCUMENT_SECTIONS_FAILURE,
   UPLOAD_DOCUMENT_REQUEST,
   UPLOAD_DOCUMENT_SUCCESS,
   UPLOAD_DOCUMENT_FAILURE,
@@ -397,15 +260,6 @@
   CREATE_DOCUMENT_REQUEST,
   CREATE_DOCUMENT_SUCCESS,
   CREATE_DOCUMENT_FAILURE,
-  CREATE_DOCUMENT_SECTION_REQUEST,
-  CREATE_DOCUMENT_SECTION_SUCCESS,
-  CREATE_DOCUMENT_SECTION_FAILURE,
-  DELETE_DOCUMENT_SECTION_REQUEST,
-  DELETE_DOCUMENT_SECTION_SUCCESS,
-  DELETE_DOCUMENT_SECTION_FAILURE,
-  EDIT_DOCUMENT_SECTION_REQUEST,
-  EDIT_DOCUMENT_SECTION_SUCCESS,
-  EDIT_DOCUMENT_SECTION_FAILURE,
   EDIT_DOCUMENT_REQUEST,
   EDIT_DOCUMENT_SUCCESS,
   EDIT_DOCUMENT_FAILURE,