multi: add CLI flag to enable public access to uni proof courier RPCs

This commit removes the `QueryProof` and `InsertProof` RPC endpoints
from the default macaroon whitelist. It also adds a CLI flag for
whitelisting those endpoints. This macaroon whitelisting method mirrors
that used for the universe stats endpoints.

config.go

@@ -45,6 +45,8 @@ type RPCConfig struct {
 
 	MacaroonPath string
 
+	AllowPublicUniProofCourier bool
+
 	AllowPublicStats bool
 
 	LetsEncryptDir string

perms/perms.go

@@ -201,21 +201,28 @@ var (
 		"/universerpc.Universe/QueryAssetRoots": {},
 		"/universerpc.Universe/AssetLeafKeys":   {},
 		"/universerpc.Universe/AssetLeaves":     {},
-		"/universerpc.Universe/QueryProof":      {},
-		"/universerpc.Universe/InsertProof":     {},
 		"/universerpc.Universe/Info":            {},
 	}
 )
 
 // MacaroonWhitelist returns the set of RPC endpoints that don't require
 // macaroon authentication.
-func MacaroonWhitelist(allowPublicStats bool) map[string]struct{} {
+func MacaroonWhitelist(allowPublicUniProofCourier bool,
+	allowPublicStats bool) map[string]struct{} {
+
 	// Make a copy of the default whitelist.
 	whitelist := make(map[string]struct{})
 	for k, v := range defaultMacaroonWhitelist {
 		whitelist[k] = v
 	}
 
+	// Conditionally add public multiverse proof courier RPC endpoints to
+	// the whitelist.
+	if allowPublicUniProofCourier {
+		whitelist["/universerpc.Universe/QueryProof"] = struct{}{}
+		whitelist["/universerpc.Universe/InsertProof"] = struct{}{}
+	}
+
 	// Conditionally add public stats RPC endpoints to the whitelist.
 	if allowPublicStats {
 		whitelist["/universerpc.Universe/QueryAssetStats"] = struct{}{}

server.go

@@ -228,6 +228,7 @@ func (s *Server) RunUntilShutdown(mainErrChan <-chan error) error {
 
 	// Get RPC endpoints which don't require macaroons.
 	macaroonWhitelist := perms.MacaroonWhitelist(
+		s.cfg.RPCConfig.AllowPublicUniProofCourier,
 		s.cfg.RPCConfig.AllowPublicStats,
 	)
 

tapcfg/config.go

@@ -204,7 +204,8 @@ type RpcConfig struct {
 	MacaroonPath string `long:"macaroonpath" description:"Path to write the admin macaroon for tapd's RPC and REST services if it doesn't exist"`
 	NoMacaroons  bool   `long:"no-macaroons" description:"Disable macaroon authentication, can only be used if server is not listening on a public interface."`
 
-	AllowPublicStats bool `long:"allow-public-stats" description:"Disable macaroon authentication for stats RPC endpoints."`
+	AllowPublicUniProofCourier bool `long:"allow-public-uni-proof-courier" description:"Disable macaroon authentication for universe proof courier RPC endpoints."`
+	AllowPublicStats           bool `long:"allow-public-stats" description:"Disable macaroon authentication for stats RPC endpoints."`
 
 	RestCORS []string `long:"restcors" description:"Add an ip:port/hostname to allow cross origin access from. To allow all origins, set as \"*\"."`
 

tapcfg/server.go

@@ -384,22 +384,23 @@ func CreateServerFromConfig(cfg *Config, cfgLogger btclog.Logger,
 	serverCfg.SignalInterceptor = shutdownInterceptor
 
 	serverCfg.RPCConfig = &tap.RPCConfig{
-		LisCfg:            &lnd.ListenerCfg{},
-		RPCListeners:      cfg.rpcListeners,
-		RESTListeners:     cfg.restListeners,
-		GrpcServerOpts:    serverOpts,
-		RestDialOpts:      restDialOpts,
-		RestListenFunc:    restListen,
-		WSPingInterval:    cfg.RpcConf.WSPingInterval,
-		WSPongWait:        cfg.RpcConf.WSPongWait,
-		RestCORS:          cfg.RpcConf.RestCORS,
-		NoMacaroons:       cfg.RpcConf.NoMacaroons,
-		MacaroonPath:      cfg.RpcConf.MacaroonPath,
-		AllowPublicStats:  cfg.RpcConf.AllowPublicStats,
-		LetsEncryptDir:    cfg.RpcConf.LetsEncryptDir,
-		LetsEncryptListen: cfg.RpcConf.LetsEncryptListen,
-		LetsEncryptEmail:  cfg.RpcConf.LetsEncryptEmail,
-		LetsEncryptDomain: cfg.RpcConf.LetsEncryptDomain,
+		LisCfg:                     &lnd.ListenerCfg{},
+		RPCListeners:               cfg.rpcListeners,
+		RESTListeners:              cfg.restListeners,
+		GrpcServerOpts:             serverOpts,
+		RestDialOpts:               restDialOpts,
+		RestListenFunc:             restListen,
+		WSPingInterval:             cfg.RpcConf.WSPingInterval,
+		WSPongWait:                 cfg.RpcConf.WSPongWait,
+		RestCORS:                   cfg.RpcConf.RestCORS,
+		NoMacaroons:                cfg.RpcConf.NoMacaroons,
+		MacaroonPath:               cfg.RpcConf.MacaroonPath,
+		AllowPublicUniProofCourier: cfg.RpcConf.AllowPublicUniProofCourier,
+		AllowPublicStats:           cfg.RpcConf.AllowPublicStats,
+		LetsEncryptDir:             cfg.RpcConf.LetsEncryptDir,
+		LetsEncryptListen:          cfg.RpcConf.LetsEncryptListen,
+		LetsEncryptEmail:           cfg.RpcConf.LetsEncryptEmail,
+		LetsEncryptDomain:          cfg.RpcConf.LetsEncryptDomain,
 	}
 
 	return tap.NewServer(serverCfg), nil