WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

Hardened systemd deployment contract for read-only Monero observer

Browse Source
This commit is contained in:
eric
2026-10-22 10:08:15 -04:00
parent 158981e965
commit e835238d05
12 changed files with 170 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/market/custody-db-args.ts
+11 -1
View File
@@ -1,5 +1,6 @@
export const CUSTODY_DB_ACTION_ARGUMENT_COUNTS = {
migrate: 0,
'migrate-mainnet-schema': 0,
'grant-runtime': 1,
'grant-monero-observer-runtime': 1,
'grant-monero-credit-runtime': 1,
@@ -19,11 +20,20 @@ export type CustodyDbAction = keyof typeof CUSTODY_DB_ACTION_ARGUMENT_COUNTS;
export type CustodyDbArguments = { action: CustodyDbAction; argument?: string; extraArgument?: string };
export function assertCustodyDbActionAllowedOnNetwork(action: CustodyDbAction, isMainnet: boolean): void {
if (isMainnet && action !== 'grant-monero-observer-runtime') {
if (action === 'migrate-mainnet-schema' && !isMainnet) {
throw new Error('Mainnet schema migration action requires the mainnet profile');
}
if (isMainnet && action !== 'grant-monero-observer-runtime' && action !== 'migrate-mainnet-schema') {
throw new Error('Only the separately scoped Monero observation-role grant is allowed on mainnet');
}
}
export function assertMainnetSchemaMigrationAcknowledged(action: CustodyDbAction, acknowledgement: string | undefined): void {
if (action === 'migrate-mainnet-schema' && acknowledgement !== 'explicit-schema-migration-only') {
throw new Error('Mainnet schema migration requires explicit schema-migration acknowledgement');
}
}
export function parseCustodyDbArguments(args: readonly string[]): CustodyDbArguments {
const [action, ...values] = args;
if (!action || !Object.hasOwn(CUSTODY_DB_ACTION_ARGUMENT_COUNTS, action)) {