From 277479f4e3b4b469f5dfa776e33cd4315380659c Mon Sep 17 00:00:00 2001
From: Dorian <dorian@Dorians-MacBook-Air.local>
Date: Thu, 19 Mar 2026 20:11:09 +0000
Subject: [PATCH] security: observer peers can't see onion address, resources,
 apps, deploy

- Onion address shows "Not visible to peers" for non-trusted nodes
- Resource usage and app list only shown for trusted nodes
- Deploy app already gated to trusted only
- Backend should also strip data in get-state (future: TASK)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 neode-ui/src/views/Federation.vue | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/neode-ui/src/views/Federation.vue b/neode-ui/src/views/Federation.vue
index 2f274803..8110c167 100644
--- a/neode-ui/src/views/Federation.vue
+++ b/neode-ui/src/views/Federation.vue
@@ -326,7 +326,8 @@
           </div>
           <div class="bg-white/5 rounded-lg p-3">
             <p class="text-xs text-white/40 mb-1">Onion Address</p>
-            <p class="text-sm text-white/80 font-mono break-all">{{ selectedNode.onion }}</p>
+            <p v-if="selectedNode.trust_level === 'trusted'" class="text-sm text-white/80 font-mono break-all">{{ selectedNode.onion }}</p>
+            <p v-else class="text-sm text-white/30 italic">Not visible to peers</p>
           </div>
           <div class="bg-white/5 rounded-lg p-3">
             <p class="text-xs text-white/40 mb-1">Trust Level</p>
@@ -347,7 +348,7 @@
             <p class="text-sm text-white/80">{{ selectedNode.added_at }}</p>
           </div>
 
-          <div v-if="selectedNode.last_state" class="bg-white/5 rounded-lg p-3">
+          <div v-if="selectedNode.trust_level === 'trusted' && selectedNode.last_state" class="bg-white/5 rounded-lg p-3">
             <p class="text-xs text-white/40 mb-2">Resource Usage</p>
             <div class="grid grid-cols-2 gap-2 text-sm text-white/70">
               <div>CPU: {{ selectedNode.last_state.cpu_usage_percent?.toFixed(1) ?? '--' }}%</div>
@@ -357,7 +358,7 @@
             </div>
           </div>
 
-          <div v-if="selectedNode.last_state?.apps?.length" class="bg-white/5 rounded-lg p-3">
+          <div v-if="selectedNode.last_state?.apps?.length && selectedNode.trust_level === 'trusted'" class="bg-white/5 rounded-lg p-3">
             <p class="text-xs text-white/40 mb-2">Apps ({{ selectedNode.last_state.apps.length }})</p>
             <div class="space-y-1">
               <div v-for="app in selectedNode.last_state.apps" :key="app.id" class="flex items-center justify-between text-sm">