Update manual connection guide with rpcallowip security and add PBaaS chain discovery with friendly names

Author: vdappdev2

MANUAL_CONNECTION_GUIDE.md

@@ -40,6 +40,27 @@ Look for IP starting with `192.168.` or `10.0.`
 
 **Edit the config file** (vrsctest.conf or VRSC.conf):
 
+#### Option A: Specific IP Addresses (Recommended)
+
+Use this if you know which devices will connect to your daemon. This is **more secure** as it only allows connections from specific IP addresses.
+
+```
+rpchost=0.0.0.0
+rpcallowip=127.0.0.1
+rpcallowip=192.168.1.52
+rpcallowip=192.168.1.76
+rpcallowip=10.0.0.250
+rpcuser=your_username
+rpcpassword=your_password
+rpcport=18843
+```
+
+You can add as many `rpcallowip=` lines as needed—one for each device/IP address that should be allowed to connect. The first line (`127.0.0.1`) keeps local access working.
+
+#### Option B: Allow All Local Network IPs (Less Secure)
+
+⚠️ **Security Warning**: This allows **any device** on your local network to connect to your daemon if they know your username and password.
+
 ```
 rpchost=0.0.0.0
 rpcallowip=0.0.0.0/0
@@ -48,6 +69,11 @@ rpcpassword=your_password
 rpcport=18843
 ```
 
+Only use this if:
+- You're on a trusted private network
+- You don't know which IPs you'll connect from
+- You understand the security implications
+
 **Restart the daemon** after saving changes.
 
 ---
@@ -108,6 +134,29 @@ When connecting to a non-localhost daemon, the app will show a security warning.
 - You're on a trusted private network
 - You're using an SSH tunnel or VPN
 
+### IP Allowlisting Best Practices
+
+**Understanding `rpcallowip`:**
+- `rpcallowip=127.0.0.1` - Only allows connections from the same computer (localhost)
+- `rpcallowip=192.168.1.52` - Only allows connections from one specific IP address
+- `rpcallowip=0.0.0.0/0` - Allows connections from **any IP address** on your network
+
+**Recommended approach:**
+1. Always keep `rpcallowip=127.0.0.1` for local access
+2. Add specific `rpcallowip=` lines for each device you'll connect from
+3. Use static IPs or DHCP reservations for devices that need RPC access
+4. Avoid `0.0.0.0/0` unless you fully understand the risks
+
+**Example for multi-device setup:**
+```
+rpcallowip=127.0.0.1          # Local access
+rpcallowip=192.168.1.52       # Laptop
+rpcallowip=192.168.1.76       # Desktop in office
+rpcallowip=10.0.0.250         # Remote office VPN
+```
+
+This way, even if someone on your network discovers your RPC port is open, they can't connect unless they're using one of the allowed IP addresses.
+
 ---
 
 ## Advanced: SSH Tunnel (Encrypted)
@@ -199,11 +248,12 @@ If this fails, firewall is blocking the connection.
 ## Best Practices
 
 1. **Use strong passwords** in RPC config
-2. **Don't remember credentials** for remote connections unless it's your own server
-3. **Use SSH tunnel** when connecting over internet or untrusted networks
-4. **Set network to Private** on Windows (not Public)
-5. **Restart daemon** after any config changes
-6. **Close port 18843** in firewall when not in use for added security
+2. **Limit `rpcallowip` to specific addresses** when possible—avoid `0.0.0.0/0` unless necessary
+3. **Don't remember credentials** for remote connections unless it's your own server
+4. **Use SSH tunnel** when connecting over internet or untrusted networks
+5. **Set network to Private** on Windows (not Public)
+6. **Restart daemon** after any config changes
+7. **Close port 18843** in firewall when not in use for added security
 
 ---
 

src-tauri/src/commands/mod.rs

@@ -1,7 +1,7 @@
 // Tauri command handlers
 // These functions are called from the frontend
 
-use crate::rpc::{VerusRpcClient, RpcCredentials, ChainConfig, SupportedChain, ChainDiscovery, CredentialManager, CurrencyDefinition};
+use crate::rpc::{VerusRpcClient, RpcCredentials, ChainConfig, ChainDiscovery, CredentialManager, CurrencyDefinition};
 use serde_json::{json, Value};
 use tauri::State;
 use std::sync::Arc;
@@ -517,15 +517,6 @@ pub async fn store_credentials(
     host: String,
     port: u16
 ) -> Result<bool, String> {
-    let chain = match chain_name.as_str() {
-        "vrsc" => SupportedChain::Vrsc,
-        "vrsctest" => SupportedChain::VrscTest,
-        "varrr" => SupportedChain::Varrr,
-        "vdex" => SupportedChain::Vdex,
-        "chips" => SupportedChain::Chips,
-        _ => return Err("Unsupported chain".to_string()),
-    };
-
     let credentials = RpcCredentials {
         username,
         password,
@@ -538,25 +529,16 @@ pub async fn store_credentials(
         .map_err(|e| e.to_string())?;
 
     let cred_manager = CredentialManager::new();
-    cred_manager.store_credentials(&chain, &credentials)
+    cred_manager.store_credentials(&chain_name.to_lowercase(), &credentials)
         .map_err(|e| e.to_string())?;
 
     Ok(true)
 }
 
 #[tauri::command]
 pub async fn load_credentials(chain_name: String) -> Result<Value, String> {
-    let chain = match chain_name.as_str() {
-        "vrsc" => SupportedChain::Vrsc,
-        "vrsctest" => SupportedChain::VrscTest,
-        "varrr" => SupportedChain::Varrr,
-        "vdex" => SupportedChain::Vdex,
-        "chips" => SupportedChain::Chips,
-        _ => return Err("Unsupported chain".to_string()),
-    };
-
     let cred_manager = CredentialManager::new();
-    match cred_manager.load_credentials(&chain) {
+    match cred_manager.load_credentials(&chain_name.to_lowercase()) {
         Ok(credentials) => {
             // Return credentials but redact the password for security
             let safe_creds = serde_json::json!({
@@ -573,30 +555,13 @@ pub async fn load_credentials(chain_name: String) -> Result<Value, String> {
 
 #[tauri::command]
 pub async fn clear_credentials(chain_name: String) -> Result<bool, String> {
-    let chain = match chain_name.as_str() {
-        "vrsc" => SupportedChain::Vrsc,
-        "vrsctest" => SupportedChain::VrscTest,
-        "varrr" => SupportedChain::Varrr,
-        "vdex" => SupportedChain::Vdex,
-        "chips" => SupportedChain::Chips,
-        _ => return Err("Unsupported chain".to_string()),
-    };
-
     let cred_manager = CredentialManager::new();
-    cred_manager.clear_credentials(&chain)
+    cred_manager.clear_credentials(&chain_name.to_lowercase())
         .map_err(|e| e.to_string())?;
 
     Ok(true)
 }
 
-#[tauri::command]
-pub async fn list_stored_chains() -> Result<Value, String> {
-    let cred_manager = CredentialManager::new();
-    let chains = cred_manager.list_stored_chains();
-    let chain_names: Vec<String> = chains.iter().map(|c| c.to_string().to_string()).collect();
-    Ok(serde_json::to_value(chain_names).unwrap())
-}
-
 #[tauri::command]
 pub async fn get_expected_config_paths() -> Result<String, String> {
     Ok(crate::rpc::ChainConfig::get_expected_paths())

src-tauri/src/lib.rs

@@ -6,7 +6,7 @@ use commands::{
     get_info, get_wallet_info, get_mining_info, z_get_total_balance, get_blockchain_info,
     list_identities, get_identity, get_identity_content, verify_message, verify_hash, list_currencies, get_currency, get_currency_converters, get_currency_state, get_offers, list_open_offers, close_offers, make_offer, take_offer,
     discover_chains, get_discovered_chains, connect_to_chain, test_and_connect_manual, store_credentials,
-    load_credentials, clear_credentials, list_stored_chains, get_expected_config_paths,
+    load_credentials, clear_credentials, get_expected_config_paths,
     get_block_count, list_address_groupings, estimate_conversion, convert_currency, send_currency,
     convert_to_verusidx, register_name_commitment, register_identity, revoke_identity, recover_identity, update_identity, set_identity_timelock,
     list_transactions, get_currency_balance, get_new_address, get_addresses_by_account,
@@ -49,7 +49,6 @@ pub fn run() {
             store_credentials,
             load_credentials,
             clear_credentials,
-            list_stored_chains,
             get_expected_config_paths,
             get_block_count,
             list_address_groupings,