fix(events): strip unconsumed wallet internals (balanceUdvpn/spentUdvpn/runGranter) from all admin SSE state payloads

The admin SSE handler (GET /api/events) stripped runGranter only on
'state' events; 'result' and 'progress' events forwarded the FULL state,
leaking balanceUdvpn, spentUdvpn, and runGranter — none of which
admin.html reads. (It DOES read walletAddress + balance for the wallet
header, kept current via Object.assign(state, msg.state) on
progress/result events, so those must keep flowing.)

Add a top-level sanitizeAdminState(s) helper that rest-spreads a clone
with balanceUdvpn/spentUdvpn/runGranter removed (non-mutating — the global
state is never touched), and refactor the live-event handler so ANY event
carrying data.state is sanitized uniformly (state/result/progress).
trimRowDiag still applies to data.result (result events) and data.results[]
(state events). The init send is unchanged (its own 5-field destructure).

Tests: add sanitizeAdminState unit tests (strip the three, keep
walletAddress/balance/status/totalNodes, non-mutating, non-object
passthrough) plus a string-level wiring assertion that the /api/events
handler body references sanitizeAdminState and trimRowDiag on both the
result and results paths, so a future edit dropping a strip fails loudly.

Author: Sentinel-Bluebuilder

server.js

@@ -2291,6 +2291,19 @@ function trimRowDiag(r) {
   };
 }
 
+// Strip the state fields the admin browser never consumes from a LIVE event's
+// state payload. admin.html DOES read walletAddress + balance (the wallet
+// header in applyState, kept current via `Object.assign(state, msg.state)` on
+// progress/result events) — those MUST keep flowing. But balanceUdvpn and
+// spentUdvpn are read NOWHERE in admin.html, and runGranter (subscription
+// granter address) is server-internal. Non-mutating: rest-spread a clone so the
+// global `state` is never touched.
+function sanitizeAdminState(s) {
+  if (!s || typeof s !== 'object') return s;
+  const { balanceUdvpn, spentUdvpn, runGranter, ...rest } = s;
+  return rest;
+}
+
 const rlAdminSse = sseLimit({ maxPerIp: 10, bucket: 'admin-sse' });
 app.get('/api/events', adminOnly, rlAdminSse, (req, res) => {
   res.setHeader('Content-Type', 'text/event-stream');
@@ -2310,23 +2323,23 @@ app.get('/api/events', adminOnly, rlAdminSse, (req, res) => {
   const ADMIN_BLOCK = /^(loop:|iteration:|batch:)/;
   const handler = (data) => {
     if (data && typeof data.type === 'string' && ADMIN_BLOCK.test(data.type)) return;
-    // Strip runGranter from any state payload before sending — even the admin
-    // browser doesn't need the granter address; it's purely server-internal.
-    if (data && data.type === 'state' && data.state && typeof data.state === 'object') {
-      const { runGranter, ...safeState } = data.state;
-      // state events also carry results[] (broadcastStateFresh) — trim each
-      // row's diag here too. New array of clones; do not mutate data.results.
-      const safeResults = Array.isArray(data.results) ? data.results.map(trimRowDiag) : data.results;
-      send({ ...data, state: safeState, results: safeResults });
-      return;
+    let out = data;
+    // ANY live event carrying a state payload (state, result, progress) gets the
+    // unconsumed wallet internals + server-internal granter stripped uniformly.
+    if (data && data.state && typeof data.state === 'object') {
+      out = { ...out, state: sanitizeAdminState(data.state) };
     }
     // result events forward the same row object insertBatchResult persists to
-    // raw_json — clone+trim for the wire, leave data.result untouched.
+    // raw_json — clone+trim its diag for the wire, leave data.result untouched.
     if (data && data.type === 'result' && data.result && typeof data.result === 'object') {
-      send({ ...data, result: trimRowDiag(data.result) });
-      return;
+      out = { ...out, result: trimRowDiag(data.result) };
+    }
+    // state events also carry results[] (broadcastStateFresh) — trim each row's
+    // diag too. New array of clones; do not mutate data.results.
+    if (out && Array.isArray(out.results)) {
+      out = { ...out, results: out.results.map(trimRowDiag) };
     }
-    send(data);
+    send(out);
   };
   emitter.on('update', handler);
   // 20s heartbeat comment-line — keeps the TCP connection alive through proxies

test/admin-sse-diag-trim.test.js

@@ -78,6 +78,9 @@ vm.createContext(sandbox);
 vm.runInContext(
   mustExtract(extractFn(src, 'trimRowDiag'), 'trimRowDiag', '}', 'v2rayPort'),
   sandbox);
+vm.runInContext(
+  mustExtract(extractFn(src, 'sanitizeAdminState'), 'sanitizeAdminState', '}', 'runGranter'),
+  sandbox);
 
 const KEPT = ['v2rayProto', 'v2rayTransport', 'v2raySecurity', 'v2rayPort'];
 const SENSITIVE = [
@@ -174,6 +177,73 @@ console.log('[4] rows with a falsy diag pass through unchanged');
   ok(vm.runInContext('trimRowDiag(undefined)', sandbox) === undefined, 'undefined row → undefined');
 }
 
+// ─── 5. sanitizeAdminState: strip wallet internals, KEEP walletAddress/balance ─
+console.log('[5] sanitizeAdminState strips balanceUdvpn/spentUdvpn/runGranter, keeps the rest');
+{
+  const original = {
+    status: 'running', totalNodes: 120,
+    walletAddress: 'sent1wallet', balance: '12.5',
+    // unconsumed / server-internal — must be stripped:
+    balanceUdvpn: 12500000, spentUdvpn: 4200000, runGranter: 'sent1granter',
+  };
+  sandbox._state = original;
+  const safe = vm.runInContext('sanitizeAdminState(_state)', sandbox);
+
+  ok(!Object.prototype.hasOwnProperty.call(safe, 'balanceUdvpn'),
+     'DROPS balanceUdvpn (regression guard)');
+  ok(!Object.prototype.hasOwnProperty.call(safe, 'spentUdvpn'),
+     'DROPS spentUdvpn (regression guard)');
+  ok(!Object.prototype.hasOwnProperty.call(safe, 'runGranter'),
+     'DROPS runGranter (regression guard)');
+
+  // admin.html DOES read these — they MUST survive
+  ok(safe.walletAddress === 'sent1wallet', 'KEEPS walletAddress (wallet header)');
+  ok(safe.balance === '12.5', 'KEEPS balance (wallet header)');
+  ok(safe.status === 'running', 'KEEPS status');
+  ok(safe.totalNodes === 120, 'KEEPS totalNodes');
+
+  // ─── NON-MUTATION ─────────────────────────────────────────────────────────
+  ok(safe !== original, 'returns a NEW state object (not the same reference)');
+  ok(original.balanceUdvpn === 12500000, 'original balanceUdvpn UNTOUCHED');
+  ok(original.spentUdvpn === 4200000, 'original spentUdvpn UNTOUCHED');
+  ok(original.runGranter === 'sent1granter', 'original runGranter UNTOUCHED');
+}
+{
+  // non-object inputs pass through untouched (defensive)
+  ok(vm.runInContext('sanitizeAdminState(null)', sandbox) === null, 'null state → null');
+  ok(vm.runInContext('sanitizeAdminState(undefined)', sandbox) === undefined, 'undefined state → undefined');
+  ok(vm.runInContext('sanitizeAdminState("x")', sandbox) === 'x', 'non-object state passes through');
+}
+
+// ─── 6. wiring: the /api/events handler routes every payload through the sanitizers ─
+console.log('[6] /api/events handler wires sanitizeAdminState + trimRowDiag on the live path');
+{
+  // Isolate the ADMIN handler body so the init-send (its own 5-field
+  // destructure, not the helper) — and the unrelated /live handler, which also
+  // matches `const handler = (data) =>` — can't satisfy these substring checks.
+  // Anchor at the admin route then find the handler that follows it.
+  const route = src.indexOf("app.get('/api/events'");
+  ok(route !== -1, 'found the /api/events admin route in server.js');
+  const hm = /const handler = \(data\) => \{/.exec(src.slice(route));
+  ok(!!hm, 'found the live-event handler in /api/events');
+  const startAbs = route + hm.index;
+  let depth = 0, started = false, j = startAbs, body = '';
+  for (; j < src.length; j++) {
+    const c = src[j];
+    if (c === '{') { depth++; started = true; }
+    else if (c === '}') { depth--; if (started && depth === 0) { j++; break; } }
+  }
+  body = src.slice(startAbs, j);
+
+  ok(body.includes('sanitizeAdminState('),
+     'handler routes the state path through sanitizeAdminState (regression guard)');
+  // trimRowDiag must apply to BOTH the single result row and the results[] array
+  ok(/result:\s*trimRowDiag\(/.test(body),
+     'handler trims data.result via trimRowDiag (result events)');
+  ok(/\.map\(trimRowDiag\)/.test(body),
+     'handler trims results[] via trimRowDiag (state events)');
+}
+
 console.log(`\n${'='.repeat(60)}\nRESULTS: ${out.pass} passed, ${out.fail} failed (${out.pass + out.fail} total)`);
 if (out.errors.length) for (const e of out.errors) console.log(`  FAIL: ${e}`);
 console.log('='.repeat(60));