Telegram-Market/telegram-shop
1
1
Fork 0
Code Issues 43 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

Super Admin: Seed Phrase Viewer with QR Code #125

New Issue
Open
opened 2026-07-09 14:23:20 +00:00 by NW · 0 comments
NW commented 2026-07-09 14:23:20 +00:00
Owner
Copy Link

Overview

Implement a seed phrase viewer in the admin web panel that allows super admins to view and export seed phrases for any user wallet, displayed as both text and QR code.

Current State

  • Seed phrases stored encrypted in crypto_wallets.mnemonic column
  • Decryption uses WalletService.decryptMnemonic() or decrypt() from src/utils/encryption.js
  • Currently only accessible via CSV export (/wallets/export-seeds) which requires commission payment
  • No in-page viewing capability

Requirements

  1. Per-wallet seed phrase reveal: Click on any wallet row to reveal seed phrase in a modal
  2. QR code generation: Display seed phrase as QR code for easy scanning by hardware wallets
  3. Super admin only access: Gated behind super admin role check
  4. Audit logging: Every seed phrase view logged with admin ID, timestamp, user ID, wallet type
  5. Auto-hide after 60s timeout: Prevent shoulder surfing
  6. Copy-to-clipboard button
  7. Download QR as PNG button
  8. Per-user view: Show seed phrase for each wallet on click

Acceptance Criteria

  • Clicking wallet row shows seed phrase in secure modal
  • QR code generated using qrcode npm package (already in deps)
  • Non-super-admin users see Access Denied
  • Every view action logged to audit_log
  • Seed phrase auto-hides after 60s with visual countdown
  • Copy and download buttons work
  • QR code is high resolution (512x512 minimum)

Technical Implementation

  • Add route: GET /wallets/seed/:walletId (super admin only)
  • Add route: GET /wallets/seed-qr/:walletId (super admin only, returns QR PNG)
  • Add JS to wallets.ejs for reveal modal
  • Use existing qrcode package
  • Add requireSuperAuth middleware to these routes
## Overview Implement a seed phrase viewer in the admin web panel that allows super admins to view and export seed phrases for any user wallet, displayed as both text and QR code. ## Current State - Seed phrases stored encrypted in crypto_wallets.mnemonic column - Decryption uses WalletService.decryptMnemonic() or decrypt() from src/utils/encryption.js - Currently only accessible via CSV export (/wallets/export-seeds) which requires commission payment - No in-page viewing capability ## Requirements 1. Per-wallet seed phrase reveal: Click on any wallet row to reveal seed phrase in a modal 2. QR code generation: Display seed phrase as QR code for easy scanning by hardware wallets 3. Super admin only access: Gated behind super admin role check 4. Audit logging: Every seed phrase view logged with admin ID, timestamp, user ID, wallet type 5. Auto-hide after 60s timeout: Prevent shoulder surfing 6. Copy-to-clipboard button 7. Download QR as PNG button 8. Per-user view: Show seed phrase for each wallet on click ## Acceptance Criteria - [ ] Clicking wallet row shows seed phrase in secure modal - [ ] QR code generated using qrcode npm package (already in deps) - [ ] Non-super-admin users see Access Denied - [ ] Every view action logged to audit_log - [ ] Seed phrase auto-hides after 60s with visual countdown - [ ] Copy and download buttons work - [ ] QR code is high resolution (512x512 minimum) ## Technical Implementation - Add route: GET /wallets/seed/:walletId (super admin only) - Add route: GET /wallets/seed-qr/:walletId (super admin only, returns QR PNG) - Add JS to wallets.ejs for reveal modal - Use existing qrcode package - Add requireSuperAuth middleware to these routes
NW added this to the Super Admin Panel & Product Evolution milestone 2026-07-09 14:23:20 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
phase::1
Phase 1: Security
 phase::1
Phase 1
 phase::1
Phase 1
 phase::2
Phase 2: Architecture
 phase::2
Phase 2
 phase::3
Phase 3: Admin API
 phase::3
Phase 3
 phase::4
Phase 4: Web UI
 phase::4
Phase 4
 phase::5
Phase 5: Quality
 phase::5
Phase 5
 priority::critical
Critical priority
 priority::critical
Critical priority
 priority::high
High priority
 priority::high
High priority
 priority::medium
Medium priority
 priority::medium
Medium priority
 type::bug
Bug fix
 type::bug
Bug
 type::feature
New feature
 type::feature
Feature
 type::infra
Infrastructure
 type::infra
Infrastructure
 type::refactor
Code refactoring
 type::refactor
Refactoring
 type::security
Security issue
 type::security
Security
 type::testing
Testing
 type::testing
Testing
No Label
Milestone
No items
No Milestone Super Admin Panel & Product Evolution
Projects
Clear projects
No project
Assignees
Clear assignees
NW
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Telegram-Market/telegram-shop#125
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?