From d3e51fac178a90b098c6151c9281ad988bb06fe0 Mon Sep 17 00:00:00 2001
From: cyberguru1 <hamzacypher34@gmail.com>
Date: Sat, 13 Jun 2026 18:24:10 -0500
Subject: [PATCH] config: add super macaroon startup flags and path validation

Introduce configuration flags to enable baking a super macaroon on
startup. Add --bake-super-macaroon (none, read-only, read-write) and
--super-macaroon-path.

Also add validation logic to ensure that the configured super macaroon
path ends with the expected '.macaroon' suffix, rejecting startup early
otherwise.
---
 config.go | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/config.go b/config.go
index fc6fd7f9..038f39ef 100644
--- a/config.go
+++ b/config.go
@@ -27,6 +27,7 @@ import (
 	"github.com/lightninglabs/lightning-terminal/db/sqlc"
 	"github.com/lightninglabs/lightning-terminal/firewall"
 	"github.com/lightninglabs/lightning-terminal/firewalldb"
+	"github.com/lightninglabs/lightning-terminal/macaroons"
 	mid "github.com/lightninglabs/lightning-terminal/rpcmiddleware"
 	"github.com/lightninglabs/lightning-terminal/session"
 	"github.com/lightninglabs/lightning-terminal/subservers"
@@ -96,6 +97,22 @@ const (
 	// autogenerated lit macaroon.
 	DefaultMacaroonFilename = "lit.macaroon"
 
+	// DefaultSuperMacaroonFilename is the default file name for the
+	// autogenerated super macaroon.
+	DefaultSuperMacaroonFilename = "super.macaroon"
+
+	// noneChoice is the none choice for the bake-super-macaroon
+	// configuration option.
+	noneChoice = "none"
+
+	// readOnlyChoice is the read-only choice for the bake-super-macaroon
+	// configuration option.
+	readOnlyChoice = "read-only"
+
+	// defaultBakeSuperMacaroon is the default value for the
+	// bake-super-macaroon configuration option.
+	defaultBakeSuperMacaroon = noneChoice
+
 	defaultFirstLNCConnTimeout = 10 * time.Minute
 
 	// DatabaseBackendSqlite is the name of the SQLite database backend.
@@ -169,6 +186,12 @@ var (
 	defaultSqliteDatabasePath = filepath.Join(
 		DefaultLitDir, DefaultNetwork, defaultSqliteDatabaseFileName,
 	)
+
+	// DefaultSuperMacaroonPath is the default full path of the super
+	// macaroon.
+	DefaultSuperMacaroonPath = filepath.Join(
+		DefaultLitDir, DefaultNetwork, DefaultSuperMacaroonFilename,
+	)
 )
 
 // Config is the main configuration struct of lightning-terminal. It contains
@@ -203,6 +226,9 @@ type Config struct {
 
 	MacaroonPath string `long:"macaroonpath" description:"Path to write the macaroon for litd's RPC and REST services if it doesn't exist."`
 
+	BakeSuperMacaroon string `long:"bake-super-macaroon" description:"Bake a super macaroon on startup if it doesn't exist." choice:"none" choice:"read-only" choice:"read-write"`
+	SuperMacaroonPath string `long:"super-macaroon-path" description:"Path to write the auto-baked super macaroon. This must include both the directory and the name of the macaroon file itself (which must end with the .macaroon suffix)."`
+
 	FirstLNCConnDeadline time.Duration `long:"firstlncconndeadline" description:"The duration after a new LNC session will be revoked if no connection is made with it. This only applies for the first connection which is made using the pairing phrase. "`
 
 	// DatabaseBackend is the database backend we will use for storing all
@@ -543,6 +569,8 @@ func defaultConfig() *Config {
 		LetsEncryptListen:  defaultLetsEncryptListen,
 		LetsEncryptDir:     defaultLetsEncryptDir,
 		MacaroonPath:       DefaultMacaroonPath,
+		SuperMacaroonPath:  DefaultSuperMacaroonPath,
+		BakeSuperMacaroon:  defaultBakeSuperMacaroon,
 		DatabaseBackend:    DatabaseBackendSqlite,
 		Sqlite: &db.SqliteConfig{
 			DatabaseFileName: defaultSqliteDatabasePath,
@@ -732,6 +760,32 @@ func loadAndValidateConfig(ctx context.Context,
 		return nil, err
 	}
 
+	if cfg.BakeSuperMacaroon != defaultBakeSuperMacaroon {
+		if cfg.SuperMacaroonPath == DefaultSuperMacaroonPath {
+			cfg.SuperMacaroonPath = filepath.Join(
+				litDir, cfg.Network,
+				DefaultSuperMacaroonFilename,
+			)
+		}
+
+		err = macaroons.HasMacaroonSuffix(
+			cfg.SuperMacaroonPath,
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		// Clean and expand the super macaroon path
+		cfg.SuperMacaroonPath = lncfg.CleanAndExpandPath(
+			cfg.SuperMacaroonPath,
+		)
+		dir := filepath.Dir(cfg.SuperMacaroonPath)
+		if err := makeDirectories(dir); err != nil {
+			return nil, fmt.Errorf("unable to create super "+
+				"macaroon directory %v: %w", dir, err)
+		}
+	}
+
 	err = cfg.DevConfig.Validate()
 	if err != nil {
 		return nil, err