・ThunderHubで焼いたマカロンがlncli printmacaroonでどう見えるか確認した。

ThunderHub macaroon permissions

---------------------------------------------------------------

get invoices invoices:read

create invoices invoices:write

get payments offchain:read

pay invoices offchain:write

get chain transactions onchain:read

send to chain address onchain:write

create chain address address:write

get wallet info info:read

stop daemon info:write

この結果によれば、offchain:wirteとonchain:writeの権限がなければそのマカロンを使うクライアントは勝手にBTCを送金することができない。

info:writeがなければ勝手にLNDを止めたりすることができない。

・lncli printmacaroonでデフォルトで作られるmacaroonのpermissionsを調べてみた。

admin.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"address:read",

"address:write",

"info:read",

"info:write",

"invoices:read",

"invoices:write",

"macaroon:generate",

"macaroon:read",

"macaroon:write",

"message:read",

"message:write",

"offchain:read",

"offchain:write",

"onchain:read",

"onchain:write",

"peers:read",

"peers:write",

"signer:generate",

"signer:read"

],

"caveats": null

}

```

chainnotifier.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"onchain:read"

],

"caveats": null

}

```

invoice.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"address:read",

"address:write",

"invoices:read",

"invoices:write",

"onchain:read"

],

"caveats": null

}

```

invoices.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"invoices:read",

"invoices:write"

],

"caveats": null

}

```

readonly.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"address:read",

"info:read",

"invoices:read",

"macaroon:read",

"message:read",

"offchain:read",

"onchain:read",

"peers:read",

"signer:read"

],

"caveats": null

}

```

router.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"offchain:read",

"offchain:write"

],

"caveats": null

}

```

signer.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"signer:generate",

"signer:read"

],

"caveats": null

}

```

walletkit.macaroon

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"address:read",

"address:write",

"onchain:read",

"onchain:write"

],

"caveats": null

}

```

・lncli listpermissions コマンドですべての RPC メソッド URI と、それらを呼び出すために必要なマカロン権限を一覧表示できる。

LND v0.18.5-betaでやると1344行ほどのJSONができる。

AddInvoiceだとinvoice:writeのpermissionを持つmacaroonを使えばインボイスを作れるようだ。

```

"/lnrpc.Lightning/AddInvoice": {

"permissions": [

{

"entity": "invoices",

"action": "write"

}

]

},

```

lncli listpermissionsからentityとactionを抜き出してみた。

```

"entity": "address",

"entity": "info",

"entity": "invoices",

"entity": "macaroon",

"entity": "message",

"entity": "offchain",

"entity": "onchain",

"entity": "peers",

"entity": "signer",

"action": "generate"

"action": "read"

"action": "write"

```

lncli とjqを組み合わせると例えば以下コマンドでinvoices:writeを必要とするRPCの一覧を表示できる。

invoices:writeだとAddInvoiceの他にホドルインボイス作成でも使ってるようだ

```

lncli listpermissions | jq -r '.method_permissions | to_entries[]

| select(.value.permissions[] | select(.entity == "invoices" and .action == "write")) | .key'

```

```

/invoicesrpc.Invoices/AddHoldInvoice

/invoicesrpc.Invoices/CancelInvoice

/invoicesrpc.Invoices/HtlcModifier

/invoicesrpc.Invoices/LookupInvoiceV2

/invoicesrpc.Invoices/SettleInvoice

/lnrpc.Lightning/AddInvoice

```

invoices:readだと以下となる。

```

/invoicesrpc.Invoices/SubscribeSingleInvoice

/lnrpc.Lightning/ListInvoices

/lnrpc.Lightning/LookupInvoice

/lnrpc.Lightning/SubscribeInvoices

```

LNの主だった機能のRPCはoffchainが必要ぽいので抜き出してみた。

offchain:write

チャネルの開閉、ペイメントの送信までやってるみたい。

デフォルトのmacaroonでoffchain:writeを持ってるのはadminとrouterの2つだけ。openchannel,closechannelはonchain:writeのpermissionも必要なようだ。

```

/autopilotrpc.Autopilot/ModifyStatus

/autopilotrpc.Autopilot/SetScores

/lnrpc.Lightning/AbandonChannel

/lnrpc.Lightning/BatchOpenChannel

/lnrpc.Lightning/ChannelAcceptor

/lnrpc.Lightning/CloseChannel

/lnrpc.Lightning/DeleteAllPayments

/lnrpc.Lightning/DeletePayment

/lnrpc.Lightning/FundingStateStep

/lnrpc.Lightning/OpenChannel

/lnrpc.Lightning/OpenChannelSync

/lnrpc.Lightning/RestoreChannelBackups

/lnrpc.Lightning/SendCustomMessage

/lnrpc.Lightning/SendPayment

/lnrpc.Lightning/SendPaymentSync

/lnrpc.Lightning/SendToRoute

/lnrpc.Lightning/SendToRouteSync

/lnrpc.Lightning/UpdateChannelPolicy

/routerrpc.Router/HtlcInterceptor

/routerrpc.Router/ResetMissionControl

/routerrpc.Router/SendPayment

/routerrpc.Router/SendPaymentV2

/routerrpc.Router/SendToRoute

/routerrpc.Router/SendToRouteV2

/routerrpc.Router/SetMissionControlConfig

/routerrpc.Router/UpdateChanStatus

/routerrpc.Router/XAddLocalChanAliases

/routerrpc.Router/XDeleteLocalChanAliases

/routerrpc.Router/XImportMissionControl

/wtclientrpc.WatchtowerClient/AddTower

/wtclientrpc.WatchtowerClient/DeactivateTower

/wtclientrpc.WatchtowerClient/RemoveTower

/wtclientrpc.WatchtowerClient/TerminateSession

```

```

"/lnrpc.Lightning/OpenChannel": {

"permissions": [

{

"entity": "onchain",

"action": "write"

},

{

"entity": "offchain",

"action": "write"

}

]

},

```

offchain:read

readの方はチャネルやインボイスの状態を確認するためのpermissionのようだ。

```

/lnrpc.Lightning/ChannelBalance

/lnrpc.Lightning/ClosedChannels

/lnrpc.Lightning/DecodePayReq

/lnrpc.Lightning/ExportAllChannelBackups

/lnrpc.Lightning/ExportChannelBackup

/lnrpc.Lightning/FeeReport

/lnrpc.Lightning/ForwardingHistory

/lnrpc.Lightning/GetDebugInfo

/lnrpc.Lightning/ListAliases

/lnrpc.Lightning/ListChannels

/lnrpc.Lightning/ListPayments

/lnrpc.Lightning/LookupHtlcResolution

/lnrpc.Lightning/PendingChannels

/lnrpc.Lightning/SubscribeChannelBackups

/lnrpc.Lightning/SubscribeChannelEvents

/lnrpc.Lightning/SubscribeCustomMessages

/lnrpc.Lightning/VerifyChanBackup

/routerrpc.Router/BuildRoute

/routerrpc.Router/EstimateRouteFee

/routerrpc.Router/GetMissionControlConfig

/routerrpc.Router/QueryMissionControl

/routerrpc.Router/QueryProbability

/routerrpc.Router/SubscribeHtlcEvents

/routerrpc.Router/TrackPayment

/routerrpc.Router/TrackPaymentV2

/routerrpc.Router/TrackPayments

/wtclientrpc.WatchtowerClient/GetTowerInfo

/wtclientrpc.WatchtowerClient/ListTowers

/wtclientrpc.WatchtowerClient/Policy

/wtclientrpc.WatchtowerClient/Stats

```

・おまけ1

RPCメソッド名にopenを含む要素を抽出するコマンド

```

lncli listpermissions | jq '.method_permissions | to_entries[] | select(.key | test("open"; "i"))'

```

```

{

"key": "/lnrpc.Lightning/BatchOpenChannel",

"value": {

"permissions": [

{

"entity": "onchain",

"action": "write"

},

{

"entity": "offchain",

"action": "write"

}

]

}

}

{

"key": "/lnrpc.Lightning/OpenChannel",

"value": {

"permissions": [

{

"entity": "onchain",

"action": "write"

},

{

"entity": "offchain",

"action": "write"

}

]

}

}

{

"key": "/lnrpc.Lightning/OpenChannelSync",

"value": {

"permissions": [

{

"entity": "onchain",

"action": "write"

},

{

"entity": "offchain",

"action": "write"

}

]

}

}

```

・おまけ２

thunderhubで作ったmacaroonはテキストで出力されコピペして使うもので、macaroonファイルになってない。

HEXをmacaroonファイルにするには以下コマンドでできる。HEXをコピペして置換する。またYOURSの箇所を自分でわかりやすい名称に置換すると良い。

```

echo -n "HEX" | xxd -r -p > YOURS.macaroon

```

thunderhubで"Create Invoices, Get Invoices, Get Wallet Info, Get Payments, Pay Invoices"をチェックして作ったmacaroonのpermissionsは以下となる。

```

{

"version": 2,

"location": "lnd",

"root_key_id": "0",

"permissions": [

"info:read",

"invoices:read",

"invoices:write",

"offchain:read",

"offchain:write"

],

"caveats": null

}

```

offchain:writeはあるがonchain:writeがないのでチャネル開閉はできないはず。

Agreed. Puts into question what the space stands for.

bitcoin & couchsurfing community have something in common.