access: open enrollment lets any /scan/ NDEF tag through the gate #91

New issue

Open

opened 2026-09-20 13:16:51 +00:00 by padreug · 0 comments

padreug commented

2026-09-20 13:16:51 +00:00

Owner

With openEnrollment on (the posture on every gated machine today), entry parses the tapped lnurlw locally and admits any external_id. No server call is made, by design, so the single-use SUN p/c survive until Complete. The consequence: any NDEF tag whose URL contains /scan/<anything> unlocks the terminal. Money still only moves on a valid SUN, so the gate is a convenience, not a security boundary.

Options when we want it to be one:

Provisioned allow-list (already supported by authorize(); needs an enrollment flow and the hashId(external_id, salt) tooling in provision-access.sh)
Verify-at-entry: spend the entry tap on a /scan GET to prove SUN validity, then require a second tap at Complete. Costs the one-tap UX #86 was built for.
A boltcards endpoint that verifies p/c without consuming the counter is not possible with the SUN design; discard.

Recorded in the 2026-09-20 amendment of ADR-003. Decide before enabling the gate on a machine where it is meant to keep people out rather than tidy the menu.

With `openEnrollment` on (the posture on every gated machine today), entry parses the tapped lnurlw locally and admits any external_id. No server call is made, by design, so the single-use SUN p/c survive until Complete. The consequence: any NDEF tag whose URL contains `/scan/<anything>` unlocks the terminal. Money still only moves on a valid SUN, so the gate is a convenience, not a security boundary. Options when we want it to be one: 1. Provisioned allow-list (already supported by authorize(); needs an enrollment flow and the hashId(external_id, salt) tooling in provision-access.sh) 2. Verify-at-entry: spend the entry tap on a `/scan` GET to prove SUN validity, then require a second tap at Complete. Costs the one-tap UX #86 was built for. 3. A boltcards endpoint that verifies p/c without consuming the counter is not possible with the SUN design; discard. Recorded in the 2026-09-20 amendment of ADR-003. Decide before enabling the gate on a machine where it is meant to keep people out rather than tidy the menu.

padreug referenced this issue

2026-09-20 13:17:21 +00:00

fix(access): single-shot loaded card + ADR-003 amendment #92

padreug referenced this issue from a commit

2026-09-20 15:07:30 +00:00

docs: Bolt Card session contract, ADR-003 amendment for verified entry

padreug referenced this issue

2026-09-20 15:09:45 +00:00

feat(access): verified Bolt Card session at entry + hidden-by-default balance #93