fix: fail closed without vss auth

[ben-kaufman]

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

• 1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
• 2. regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

• Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

[greptile-apps]

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

• Requires LNURL-auth when initializing both application and LDK VSS clients.
• Prevents Lightning node construction through fixed-header VSS when authentication is absent.
• Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
    Check -->|Yes| Error["Throw VssAuthRequired"]
    Check -->|No| Auth["Construct authenticated VSS client"]
    Auth --> Backup["Application backup persistence"]
    Auth --> LDK["LDK channel-state persistence"]

Loading

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

[jvsena42]

@ben-kaufman conflict

[ben-kaufman]

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

[ovitrif]

#1164 bumps vss-rust-client-ffi to 0.5.23

[ovitrif]

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.