search

lnbits / boltcards

Bolt Cards (NXP NTAG424) - LNbits extension
MIT License
14 stars 10 forks source link

Orphaned cards, when a wallet is deleted - burning uids on the server #3

Open thilohille opened 1 year ago

thilohille commented 1 year ago

If you delete a wallet without deleteing the cards first the cards are orphaned.

  1. Create a wallet.
  2. Enable Boltcards extension
  3. Create a Card UID=12345671234567
  4. Delete the wallet

That UID cannot be used on that server again. Also the card cannot be deleted using the api leaving no easy way out. grafik

Shouldnt the column "wallet" in the "cards"-table be a FOREIGN KEY with CASCADE DELETE?

grafik
gorrdy commented 1 year ago

I wouldn't check the UID at all... It only makes things harder, not easier.

It would fix this issue but also didn't force users to delete the keys from server unless they really need to. This is why there is an unique ID for each boltcard record in database. It doesn't matter if more bolt cards records (boltcards configured) does have the same UID, the server determines it with the boltcard record external_id, not the card uid.

I don't see a problem even if two users uses the same card UID (I can wipe the card but keep the keys configured, and then gitf the card to somebody to have it or just to try it for some time). Now it is not possible as mentioned in this issue.