fix: consume vss-client 0.5.23

[ovitrif]

This PR bumps the VSS Android client from 0.5.21 to 0.5.23.

Description

0.5.23 includes synonymdev/vss-rust-client-ffi#20. Unauthenticated client setup now returns AuthError instead of encrypting with a public all-zero key.

Related: synonymdev/audit#55 (BITKIT-SEC-003).

Companion iOS PR: synonymdev/bitkit-ios#673

Preview

N/A

QA Notes

Manual Tests

• 1. regression: Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.

Automated Checks

• Local compileDevDebugKotlin, VssBackupClientTest, and detekt passed against 0.5.23.

[greptile-apps]

Greptile Summary

This PR makes VSS initialization fail closed when LNURL authentication is unavailable and upgrades the Android VSS client to the release that rejects unauthenticated encryption.

• Removes unauthenticated backup-client and fixed-header Lightning-node fallbacks.
• Adds a typed error for missing VSS authentication.
• Updates vss-client-android from 0.5.21 to 0.5.23 and records the security change.

Confidence Score: 5/5

The PR appears safe to merge, with authenticated VSS enforced consistently across backup and Lightning persistence setup.

The changed setup paths reject blank LNURL-auth configuration before constructing a VSS client, while existing callers capture and propagate the resulting typed failure through their normal lifecycle handling.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated backup fallback and requires a non-blank LNURL-auth endpoint before client initialization.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Applies the same fail-closed authentication requirement to LDK remote persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Prevents node construction through the fixed-header VSS fallback when LNURL authentication is unavailable.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
gradle/libs.versions.toml	Upgrades the VSS Android client from 0.5.21 to 0.5.23.
changelog.d/next/consume-vss.security.md	Documents removal of unauthenticated VSS encryption fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Setup["Backup or Lightning setup"] --> Check{"LNURL-auth URL blank?"}
    Check -- Yes --> Error["Throw VssAuthRequired"]
    Check -- No --> Auth["Initialize authenticated VSS client"]
    Auth --> VSS["Encrypted VSS persistence"]

Loading

_{Reviews (1): Last reviewed commit: "fix: consume vss-client 0.5.23" | Re-trigger Greptile}