refactor: extract wallet-service into its own repo and consume it as a git dependency - #118
Open
gabitoesmiapodo wants to merge 7 commits into
Open
refactor: extract wallet-service into its own repo and consume it as a git dependency#118gabitoesmiapodo wants to merge 7 commits into
gabitoesmiapodo wants to merge 7 commits into
Conversation
Both belonged to canton-barebones only because the LocalNet did. They are part of the local loop, not of any one subproject, so they move to scripts/ alongside the rest of it. Each resolves .env from its own parent directory, which is what the move repoints, so neither grows a path argument. deploy-dar.sh now lets a caller-exported CANTON_BACKEND_TOKEN or CANTON_JSON_API_URL win over .env, matching mint-token.mjs, and drops the `set -a` that was handing the whole file (CANTON_AUTH_SECRET included) to curl. Drops the dapp/daml `deploy` alias, which pointed into the old location.
Closes the in-repo copy of wallet-service. It now ships from BootNodeDev/canton-wallet-service and arrives as a devDependency pinned to tag v0.1.1, run on the host with `pnpm exec canton-wallet-service`. The SDK overrides go with it: the service's own repository pins @canton-network/wallet-sdk, so pnpm-workspace.yaml no longer carries them. pnpm will only run a git dependency's `prepare` when it is named in allowBuilds, and it matches such a dependency by its resolved codeload tarball id, so that key carries a commit sha and has to be replaced whenever the ref moves. Reshapes the root scripts into the whole local loop, in order: mint-token, build-dar, deploy-dar, bootstrap, app:dev. build-dar drops its wrapper script for the dapp/daml build it was wrapping, and bootstrap reads .env so RPC_URL there takes effect. knip cannot see a dependency reached only through `pnpm exec` in a shell script, so the service is listed in ignoreDependencies.
The LocalNet is now @bootnodedev/canton-barebones, scaffolded once into a directory of its own, so dev-stack.sh shells out to it there: a path-shaped first argument (which also opens the menu), else a second argument, else CANTON_LOCALNET_DIR, else ~/canton-localnet. `canton-barebones start` is `docker compose up -d`, so it returns as soon as the containers exist while Splice takes minutes more to answer. The old canton:health gate went with the in-repo stack and nothing replaced it, so the DAR upload raced a participant that was not listening. `up` now waits for the app-user JSON API before building or deploying. wallet-service is gated on a 2xx /health rather than a log line another repo owns, which also catches something unrelated holding 3010 instead of letting bootstrap fail obscurely against /rpc. Both probe budgets are wall-clock, not iteration counts: a socket that accepts TCP without answering costs the full curl timeout per attempt, which made a nominal 300s wait up to three times that. One .env, at the root, because the service loads dotenv from the directory it starts in. `up` reads it rather than defaulting the URLs a second time, so the file every other step resolves config from also moves the readiness probe.
The compose file, the up/down/health/splice-common scripts and their test all drove the LocalNet that now lives in its own directory, and the compose file's only service was the wallet-service image that no longer builds here. Nothing in the loop calls any of them. canton-barebones/ itself stays in the tree: what is left of it is config and a prebuilt DAR, inert, and removing that is its own change. Also drops the `format` alias from every remaining package. `lint:fix` is `biome check --write`, which formats and fixes, so `format` was the weaker of two ways to do the same thing.
CLAUDE.md, architecture.md and the README follow the code: wallet-service and the LocalNet are external, scripts/ owns the local loop, and there is one .env at the root. Two things worth stating rather than leaving to be rediscovered. pnpm applies `overrides` only in the root running the install, so the service's own core-acs-reader hold does not travel here — the lock file alone is what keeps that transitive off the SDK's caret range, and Renovate's hold is what keeps a refresh from floating it. And a `pnpm run` alias cannot take arguments, because pnpm forwards `--` into argv, which is why mint-token bakes its subject in and deploy-dar has to strip the separator by hand. canton-barebones/README.md now says the directory is inert and points at the replacements.
v0.1.2 stops `ledgerApi` resolving a caller-supplied `resource` onto another origin, which had it forwarding CANTON_BACKEND_TOKEN to any host the dApp named. The dApp reaches that method through the wallet, so the value was attacker-controlled by design. Both halves move together, as they must: the dependency ref and the commit sha inside the allowBuilds key, which is how pnpm matches a git dependency for its `prepare` build.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
The override stayed with the extracted repo, and pnpm resolves a git dependency's transitives itself rather than reading its lock file, so this repo lands on 1.18.1 and not the 1.12.0 that repo pins.
This was referenced Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #116
wallet-service had three forked copies (here, the devnet droplet, cn-darkpools), which is why the droplet's Canton Coin faucet is broken. It now ships from one canonical repo.
Cross-repo dependency: this branch needs BootNodeDev/canton-wallet-service at tag
v0.1.2(commit7803269), already pushed and public. The dependency ref inpackage.jsonand the commit sha inside theallowBuildskey inpnpm-workspace.yamlhave to move together; changing only one breaks the install.Changes
v0.1.2and runs viapnpm exec canton-wallet-servicedev-stack.shdrives the external@bootnodedev/canton-barebonesLocalNet from its own directory.envconfigures wallet-service, the token mint and the DAR uploadmint-token,build-dar,deploy-dar,bootstrap,app:devpnpm testalso runs thescripts/node testsReview guide
Start with
scripts/dev-stack.sh: it is the whole rewired loop and the only substantive logic in this diff. Then check the dependency ref inpackage.jsonagainst the commit sha insidepnpm-workspace.yaml'sallowBuildskey — they must name the same tag, and a mismatch breaks the install.Skimmable: the doc rewrites in
README.md,CLAUDE.mdandarchitecture.md.Not worth reviewing: the deleted
canton-barebones/wallet-service/files, which moved verbatim to the new repo, andpnpm-lock.yaml. The token-leak fix is in canton-wallet-servicev0.1.2, not here — review it there.Deviations
canton:*root scripts are deleted: dead oncedev-stack.shdrives the external tool, so "canton-barebones/ otherwise untouched" no longer heldscripts/, which is where deletingcanton-barebones/scripts/left themv0.1.2rather than the first tag, because review of the extracted repo found three defectsv0.1.2fix 1: the Dockerfile omittedpnpm-workspace.yaml, sodocker buildfailed withERR_PNPM_LOCKFILE_CONFIG_MISMATCH(the lockfile records the overrides that file holds)v0.1.2fix 2: the README's install sequence produced no binary, since pnpm blocks a git dependency'sprepareby default and nodist/is committedv0.1.2fix 3, token exfiltration inledgerApi: it resolved the caller'sresourcewithnew URL(resource, jsonApiUrl), and an absolute or protocol-relative value makesURLdiscard the base, so the outboundAuthorization: Bearer CANTON_BACKEND_TOKENwent to a host the caller chose, plus SSRF to any internal host the service can reach.resourceis the dApp's parameter, forwarded by the wallet, so it is attacker-controlled by design. Now refused with-32602before any request is made; verified at the wire level, the pre-fix build leaked the token to a listener and the fixed build sends nothingAcceptance criteria
New repo —
BootNodeDev/canton-wallet-servicecanton-barebones/wallet-service, behaviour unchangedpnpm installbinentrycanton-wallet-servicepoints atdist/server.js, entry carries a shebangpreparescript builds it, so installing produces adist/engines.nodeand.nvmrcmirror this repo's>=24.15.0COPY package.json@canton-network/wallet-sdkpinned to1.3.1,@canton-network/core-acs-readerto1.12.0This repo
canton-barebones/wallet-service/deletedgit+ssh://git@github.com/BootNodeDev/canton-wallet-service.git#<ref>pnpm-workspace.yamlpackage entry removed, SDK overrides no longer needed herebiome.jsonoverride and thewallet-service:devscript removedwallet-serviceservice block removed fromcanton-barebones/docker-compose.yamlscripts/dev-stack.shstarts it withpnpm exec canton-wallet-servicearchitecture.mdand root README drop or repoint the wallet-service rowscanton-barebones/otherwise untouched — see DeviationsEnd-to-end
@bootnodedev/canton-barebonestoolTest plan
Automated tests
pnpm installfrom the repo rootpnpm lint,pnpm typecheck,pnpm build,pnpm test,pnpm knip,pnpm docs:check,pnpm run check:anatomygit push --dry-runand expect the pre-push hook (typecheck plus gitleaks) to passManual verification
Breaking changes
Local workflow only:
canton:up,canton:down,canton:health,canton:token,wallet-service:devandformatare gone, andcanton-barebones/.envbecomes a root.env.Migration: copy
.env.exampleto.env, scaffold a LocalNet withnpx @bootnodedev/canton-barebones init, then drive the stack through./scripts/dev-stack.sh.Checklist
Screenshots
None.