aiolabs/chatelet
9
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: strip checkin_instructions from public room dicts (privacy leak)

Browse source 
The AUTH_NONE RPC room endpoints (chatelet_room_list/_get) stripped wallet
but NOT checkin_instructions — which was added in #5 after this code, so the
operator's private access details (address, gate code) were leaking to any
guest. Centralize a public_room_dict(room) helper (strips wallet +
checkin_instructions) and route both doors through it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019VUQCfdqiLSsFS2jcGnaFD
This commit is contained in:
Padreug 2026-07-20 01:39:39 +02:00
commit 4d6dba5487
2 changed files with 18 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
transport_rpcs.py
View file

@ -196,6 +196,9 @@ def _to_dict(obj) -> dict:
def _public_room(room) -> dict:
d = _to_dict(room)
d.pop("wallet", None) # wallet id is operator-internal, not for guests
return d
# Shared with the HTTP door; strips wallet id AND checkin_instructions
# (the latter was leaking to guests before — added after this file's
# original public dict).
from .models import public_room_dict
return public_room_dict(room)