From ecd83a82622a8949cc05ecbb2809faeab9571874 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 27 Jul 2026 04:09:41 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20address=20code=20review=20=E2=80=94=20re?=
 =?UTF-8?q?strict=20ReadOnlyPaths=20to=20unlock-password,=20clarify=20amou?=
 =?UTF-8?q?nt=20error=20message?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ReadOnlyPaths for nwc-lnurl.service now lists only the specific file
/var/lib/albyhub/unlock-password (least-privilege) instead of the
whole /var/lib/albyhub directory.

Amount-duplicate error message changed to "A single amount parameter is
required" (clearer for 2+ values than "Exactly one").

Test assertion updated to match new message text.
---
 app/sovran_systemsos_web/nwc_lnurl_service.py | 2 +-
 app/tests/test_wallet_connections.py          | 2 +-
 modules/nwc-wallets.nix                       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/sovran_systemsos_web/nwc_lnurl_service.py b/app/sovran_systemsos_web/nwc_lnurl_service.py
index 27d03fa..f6d358d 100644
--- a/app/sovran_systemsos_web/nwc_lnurl_service.py
+++ b/app/sovran_systemsos_web/nwc_lnurl_service.py
@@ -194,7 +194,7 @@ def _make_handler(manager: "AlbyHubManager") -> type:
                         400,
                         {
                             "status": "ERROR",
-                            "reason": "Exactly one amount parameter is required",
+                            "reason": "A single amount parameter is required",
                         },
                     )
                     return
diff --git a/app/tests/test_wallet_connections.py b/app/tests/test_wallet_connections.py
index c4bc858..5012778 100644
--- a/app/tests/test_wallet_connections.py
+++ b/app/tests/test_wallet_connections.py
@@ -1046,7 +1046,7 @@ class LnurlHandlerAmountTests(unittest.TestCase):
         code, body = sent[0]
         self.assertEqual(code, 400)
         self.assertEqual(body["status"], "ERROR")
-        self.assertIn("Exactly one", body["reason"])
+        self.assertIn("single amount", body["reason"])
 
     def test_three_amount_values_returns_400(self):
         sent = self._run_handler("/lnurlp/alice/callback?amount=1000&amount=2000&amount=3000")
diff --git a/modules/nwc-wallets.nix b/modules/nwc-wallets.nix
index 86d8a69..e19ab5c 100644
--- a/modules/nwc-wallets.nix
+++ b/modules/nwc-wallets.nix
@@ -125,7 +125,7 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
       ProtectSystem = "strict";
       ReadOnlyPaths = [
         "/var/lib/domains/lightning"
-        "/var/lib/albyhub"
+        "/var/lib/albyhub/unlock-password"
       ];
     };
   };