Address review: reject commas in wallet addrs, dedupe addr codec

- Validate() rejects a comma in the primary or any fallback wallet address,
  since they're persisted comma-separated (a comma would corrupt the column).
- Move the comma-separated encode/decode into domain (EncodeFallbackAddrs /
  DecodeFallbackAddrs) so postgres and sqlite share one implementation.
- Document the wallet-target trust boundary in walletService and log the
  effective primary wallet address at startup so operators can audit it.

Author: bitcoin-coder-bob

internal/config/config.go

@@ -781,6 +781,10 @@ func (c *Config) walletService() error {
 	// The wallet addresses are sourced from the persisted settings (seeded from
 	// env on first boot), so admin changes take effect on the next restart. Fall
 	// back to env if settings aren't available yet (e.g. the repo isn't wired).
+	//
+	// Trust boundary: the wallet gRPC target controls signing, address derivation
+	// and sweeps, so persisting it via the admin Settings API is equivalent to full
+	// operator (admin macaroon) trust — the same trust needed to change the env var.
 	arkWallet := c.WalletAddr
 	fallbackAddrs := c.WalletFallbackAddrs
 	if c.repo != nil {
@@ -813,6 +817,10 @@ func (c *Config) walletService() error {
 	c.wallet = walletSvc
 	c.network = network
 
+	// Surface the effective wallet target so operators can audit which arkd-wallet
+	// this node dialed (it may come from the DB, not the env var).
+	log.Infof("dialed primary arkd-wallet at %q on network %s", arkWallet, network.Name)
+
 	fallbacks, err := c.dialFallbackWallets(fallbackAddrs)
 	if err != nil {
 		return err

internal/core/domain/settings.go

@@ -2,6 +2,7 @@ package domain
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	arklib "github.com/arkade-os/arkd/pkg/ark-lib"
@@ -235,9 +236,41 @@ func (s Settings) Validate() error {
 			s.RoundMaxParticipantsCount, s.RoundMinParticipantsCount,
 		)
 	}
+
+	// Fallback addrs are persisted comma-separated by the SQL backends, so a comma
+	// in an address would corrupt the column on the next read.
+	if strings.Contains(s.WalletAddr, ",") {
+		return fmt.Errorf("wallet addr must not contain a comma")
+	}
+	for _, addr := range s.WalletFallbackAddrs {
+		if strings.Contains(addr, ",") {
+			return fmt.Errorf("wallet fallback addr %q must not contain a comma", addr)
+		}
+	}
 	return nil
 }
 
+// EncodeFallbackAddrs and DecodeFallbackAddrs convert WalletFallbackAddrs to and
+// from the comma-separated form the SQL backends persist it in. Decoding trims
+// whitespace and drops empty entries; an empty result is returned as nil.
+func EncodeFallbackAddrs(addrs []string) string {
+	return strings.Join(addrs, ",")
+}
+
+func DecodeFallbackAddrs(s string) []string {
+	parts := strings.Split(s, ",")
+	addrs := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if p = strings.TrimSpace(p); p != "" {
+			addrs = append(addrs, p)
+		}
+	}
+	if len(addrs) == 0 {
+		return nil
+	}
+	return addrs
+}
+
 // SettingsUpdate is a copy of the Settings repo struct, but with optional fields to easily handle
 // changes.
 type SettingsUpdate struct {

internal/core/domain/settings_test.go

@@ -138,6 +138,12 @@ func testValidateSettings(t *testing.T) {
 			zeroMaxOpReturn := validSettings
 			zeroMaxOpReturn.MaxOpReturnOutputs = 0
 
+			commaWalletAddr := validSettings
+			commaWalletAddr.WalletAddr = "host:6060,evil"
+
+			commaFallbackAddr := validSettings
+			commaFallbackAddr.WalletFallbackAddrs = []string{"host:6060,evil"}
+
 			fixtures := []struct {
 				settings    domain.Settings
 				expectedErr string
@@ -239,6 +245,15 @@ func testValidateSettings(t *testing.T) {
 					settings:    zeroMaxOpReturn,
 					expectedErr: "max op return outputs must be greater than 0",
 				},
+				{
+					settings:    commaWalletAddr,
+					expectedErr: "wallet addr must not contain a comma",
+				},
+				{
+					settings: commaFallbackAddr,
+					expectedErr: `wallet fallback addr "host:6060,evil" ` +
+						"must not contain a comma",
+				},
 			}
 
 			for _, f := range fixtures {

internal/infrastructure/db/postgres/settings_repo.go

@@ -5,7 +5,6 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"strings"
 	"sync"
 	"time"
 
@@ -14,23 +13,6 @@ import (
 	arklib "github.com/arkade-os/arkd/pkg/ark-lib"
 )
 
-// splitFallbackAddrs decodes the comma-separated wallet_fallback_addrs column
-// back into a slice, trimming whitespace and dropping empty entries (so it
-// normalizes the same way the env parser does); an empty result is returned as nil.
-func splitFallbackAddrs(s string) []string {
-	parts := strings.Split(s, ",")
-	addrs := make([]string, 0, len(parts))
-	for _, p := range parts {
-		if p = strings.TrimSpace(p); p != "" {
-			addrs = append(addrs, p)
-		}
-	}
-	if len(addrs) == 0 {
-		return nil
-	}
-	return addrs
-}
-
 type settingsRepository struct {
 	db      *sql.DB
 	querier *queries.Queries
@@ -114,7 +96,7 @@ func (r *settingsRepository) Get(ctx context.Context) (*domain.Settings, error)
 		AssetTxMaxWeightRatio:         row.AssetTxMaxWeightRatio,
 		NoteUriPrefix:                 row.NoteUriPrefix,
 		WalletAddr:                    row.WalletAddr,
-		WalletFallbackAddrs:           splitFallbackAddrs(row.WalletFallbackAddrs),
+		WalletFallbackAddrs:           domain.DecodeFallbackAddrs(row.WalletFallbackAddrs),
 		ScheduledSession:              scheduledSession,
 		BatchFees: domain.BatchFees{
 			OnchainInputFee:   row.BatchOnchainInputFee,
@@ -155,7 +137,7 @@ func (r *settingsRepository) Upsert(
 		AssetTxMaxWeightRatio:         settings.AssetTxMaxWeightRatio,
 		NoteUriPrefix:                 settings.NoteUriPrefix,
 		WalletAddr:                    settings.WalletAddr,
-		WalletFallbackAddrs:           strings.Join(settings.WalletFallbackAddrs, ","),
+		WalletFallbackAddrs:           domain.EncodeFallbackAddrs(settings.WalletFallbackAddrs),
 		BatchOnchainInputFee:          settings.BatchFees.OnchainInputFee,
 		BatchOffchainInputFee:         settings.BatchFees.OffchainInputFee,
 		BatchOnchainOutputFee:         settings.BatchFees.OnchainOutputFee,

internal/infrastructure/db/postgres/settings_seed.go

@@ -5,7 +5,6 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/arkade-os/arkd/internal/core/domain"
@@ -143,7 +142,7 @@ func seedParams(settings domain.Settings) queries.UpsertSettingsParams {
 		AssetTxMaxWeightRatio:         settings.AssetTxMaxWeightRatio,
 		NoteUriPrefix:                 settings.NoteUriPrefix,
 		WalletAddr:                    settings.WalletAddr,
-		WalletFallbackAddrs:           strings.Join(settings.WalletFallbackAddrs, ","),
+		WalletFallbackAddrs:           domain.EncodeFallbackAddrs(settings.WalletFallbackAddrs),
 		BatchOnchainInputFee:          settings.BatchFees.OnchainInputFee,
 		BatchOffchainInputFee:         settings.BatchFees.OffchainInputFee,
 		BatchOnchainOutputFee:         settings.BatchFees.OnchainOutputFee,

internal/infrastructure/db/sqlite/settings_repo.go

@@ -5,7 +5,6 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"strings"
 	"sync"
 	"time"
 
@@ -14,23 +13,6 @@ import (
 	arklib "github.com/arkade-os/arkd/pkg/ark-lib"
 )
 
-// splitFallbackAddrs decodes the comma-separated wallet_fallback_addrs column
-// back into a slice, trimming whitespace and dropping empty entries (so it
-// normalizes the same way the env parser does); an empty result is returned as nil.
-func splitFallbackAddrs(s string) []string {
-	parts := strings.Split(s, ",")
-	addrs := make([]string, 0, len(parts))
-	for _, p := range parts {
-		if p = strings.TrimSpace(p); p != "" {
-			addrs = append(addrs, p)
-		}
-	}
-	if len(addrs) == 0 {
-		return nil
-	}
-	return addrs
-}
-
 type settingsRepository struct {
 	db      *sql.DB
 	querier *queries.Queries
@@ -114,7 +96,7 @@ func (r *settingsRepository) Get(ctx context.Context) (*domain.Settings, error)
 		AssetTxMaxWeightRatio:         float32(row.AssetTxMaxWeightRatio),
 		NoteUriPrefix:                 row.NoteUriPrefix,
 		WalletAddr:                    row.WalletAddr,
-		WalletFallbackAddrs:           splitFallbackAddrs(row.WalletFallbackAddrs),
+		WalletFallbackAddrs:           domain.DecodeFallbackAddrs(row.WalletFallbackAddrs),
 		ScheduledSession:              scheduledSession,
 		BatchFees: domain.BatchFees{
 			OnchainInputFee:   row.BatchOnchainInputFee,
@@ -154,7 +136,7 @@ func (r *settingsRepository) Upsert(
 		AssetTxMaxWeightRatio:         float64(settings.AssetTxMaxWeightRatio),
 		NoteUriPrefix:                 settings.NoteUriPrefix,
 		WalletAddr:                    settings.WalletAddr,
-		WalletFallbackAddrs:           strings.Join(settings.WalletFallbackAddrs, ","),
+		WalletFallbackAddrs:           domain.EncodeFallbackAddrs(settings.WalletFallbackAddrs),
 		BatchOnchainInputFee:          settings.BatchFees.OnchainInputFee,
 		BatchOffchainInputFee:         settings.BatchFees.OffchainInputFee,
 		BatchOnchainOutputFee:         settings.BatchFees.OnchainOutputFee,

internal/infrastructure/db/sqlite/settings_seed.go

@@ -5,7 +5,6 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/arkade-os/arkd/internal/core/domain"
@@ -143,7 +142,7 @@ func seedParams(settings domain.Settings) queries.UpsertSettingsParams {
 		AssetTxMaxWeightRatio:         float64(settings.AssetTxMaxWeightRatio),
 		NoteUriPrefix:                 settings.NoteUriPrefix,
 		WalletAddr:                    settings.WalletAddr,
-		WalletFallbackAddrs:           strings.Join(settings.WalletFallbackAddrs, ","),
+		WalletFallbackAddrs:           domain.EncodeFallbackAddrs(settings.WalletFallbackAddrs),
 		BatchOnchainInputFee:          settings.BatchFees.OnchainInputFee,
 		BatchOffchainInputFee:         settings.BatchFees.OffchainInputFee,
 		BatchOnchainOutputFee:         settings.BatchFees.OnchainOutputFee,