Add private recovery API for validated inputs by huitseeker · Pull Request #2407 · 0xMiden/node

huitseeker · 2026-07-29T22:38:22Z

Summary

After #2393, validators store transaction inputs under a Golden threshold key. The demo also needs a private way to find these records and ask each validator for a decryption share.

Operators can now start an optional HTTP admin service on a separate listener. GET /admin/transactions returns all stored records as hex-encoded JSON in insertion order. Each entry includes the transaction ID, encrypted inputs, nonce, encrypted content key, and decryption context.

POST /admin/decryption-share accepts an encrypted content key and its decryption context. It returns this validator's hex-encoded Golden share.

The public validator service does not receive the Golden secret share. The admin service has no caller authentication, so operators must control access to its port. A later TEE flow will add caller checks and a share release policy.

Tests recover one validator's stored TransactionInputs with shares from two other validators in the same Golden setup. Recovery tools receive the public Golden setup through deployment configuration.

Changelog

[[entry]]
scope = "validator"
impact = "added"
description = "Operators can list stored private inputs and issue Golden decryption shares through a private admin API."

igamigo

Not the most in-depth review for now, but leaving some comments

kkovaacs

I assume this is a temporary feature just for the demo, right?

In that context this looks good to me.

Mirko-von-Leipzig · 2026-07-30T07:37:49Z

+    ) -> Result<Vec<u8>, PrivateRecordError>
+    where
+        R: RngCore + CryptoRng,
+        P: PrivateRecordSharePolicy + ?Sized,


Why do we need this policy thing? Surely we have exactly one.

Mirko-von-Leipzig · 2026-07-30T07:39:19Z

+            return Err(PrivateRecordError::ShareDenied);
+        }
+
+        self.issue_decryption_share(rng, record.encrypted_record_key(), request.context())


Why do we have two pub methods?

Mirko-von-Leipzig · 2026-07-30T07:40:35Z

This could just be called load_all_transactions imo. Currently it implies there exist public or unvalidated transactions.

Mirko-von-Leipzig · 2026-07-30T07:45:36Z

    CHECK (length(encrypted_record) >= 16),
    CHECK (length(encrypted_record_key) > 0)
-) WITHOUT ROWID;
+);


Why are we adding back ROWID?

Mirko-von-Leipzig · 2026-07-30T07:46:22Z

+/// Loads all validated private transactions in insertion order.
+pub(crate) fn load_validated_private_transactions(


Similar nit:

Suggested change

/// Loads all validated private transactions in insertion order.

pub(crate) fn load_validated_private_transactions(

/// Loads all validated private transactions in insertion order.

pub(crate) fn load_all_transactions(

Mirko-von-Leipzig · 2026-07-30T07:48:02Z

        listen: std::net::SocketAddr,

+        /// Socket address at which to serve the private administration API.
+        #[arg(long = "admin-listen", env = ENV_ADMIN_LISTEN, value_name = "LISTEN")]


Suggested change

#[arg(long = "admin-listen", env = ENV_ADMIN_LISTEN, value_name = "LISTEN")]

#[arg(long = "admin.listen", env = ENV_ADMIN_LISTEN, value_name = "LISTEN")]

Mirko-von-Leipzig · 2026-07-30T07:52:45Z

+            target: LOG_TARGET,
+            {
+                service.name = "miden-validator-admin",
+                validator.admin_listen = %endpoint,
+            },
+            "Validator admin server ready",
+        );


@kkovaacs is there some sort of standard for this?

@kkovaacs is there some sort of standard for this?

Not really. We do have a standard log line that is logged when starting up a service, but this is just an additional API that is exposed by the validator service.

Mirko-von-Leipzig · 2026-07-30T07:58:15Z

+    pub async fn serve(self, shutdown: CancellationToken) -> anyhow::Result<()> {
+        let listener = TcpListener::bind(self.address)
+            .await
+            .context("failed to bind validator admin address")?;


Nit: we don't really need to prefix things with validator, this is already in the validator context.

Suggested change

.context("failed to bind validator admin address")?;

.context("failed to bind admin address")?;

huitseeker requested review from Dominik1999, Mirko-von-Leipzig, bobbinth and kkovaacs July 29, 2026 22:38

huitseeker mentioned this pull request Jul 29, 2026

Use the validator admin API as the only private recovery interface #2408

Open

huitseeker marked this pull request as ready for review July 29, 2026 22:49

igamigo reviewed Jul 29, 2026

View reviewed changes

Comment thread bin/validator/src/db/migrations/002_validated_transaction_insertion_order.sql Outdated

Comment thread bin/validator/src/db/sql/insert_transaction.sql Outdated

Comment thread proto/proto/internal/validator_admin.proto Outdated

huitseeker marked this pull request as draft July 30, 2026 00:17

huitseeker changed the title ~~Add private recovery RPCs for validated inputs~~ Add private recovery API for validated inputs Jul 30, 2026

huitseeker marked this pull request as ready for review July 30, 2026 00:31

kkovaacs approved these changes Jul 30, 2026

View reviewed changes

Dominik1999 mentioned this pull request Jul 30, 2026

fix(validator): give each compose validator a distinct Golden secret share #2411

Merged

Mirko-von-Leipzig approved these changes Jul 30, 2026

View reviewed changes

huitseeker added 6 commits July 30, 2026 08:15

feat(validator): add private decryption share RPC

5328eb3

feat(validator): list private records over admin RPC

a9225d7

fix(validator): rank legacy private records in one pass

e676237

refactor(validator): serve recovery API as JSON

9df8ae9

fix(ci): inherit shared Axum dependency

96465cf

refactor(validator): simplify admin recovery surface

396e12f

huitseeker force-pushed the admin-private-record-share-rpc branch from df32357 to 396e12f Compare July 30, 2026 12:17

		/// Loads all validated private transactions in insertion order.
		pub(crate) fn load_validated_private_transactions(

	#[arg(long = "admin-listen", env = ENV_ADMIN_LISTEN, value_name = "LISTEN")]
	#[arg(long = "admin.listen", env = ENV_ADMIN_LISTEN, value_name = "LISTEN")]

	.context("failed to bind validator admin address")?;
	.context("failed to bind admin address")?;

Uh oh!

Conversation

huitseeker commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changelog

Uh oh!

igamigo left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kkovaacs left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

huitseeker commented Jul 29, 2026 •

edited

Loading

igamigo left a comment •

edited

Loading