From efea7e2a730d4eb361850257c47233501651d4f8 Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Sun, 4 Oct 2026 15:33:25 +0200
Subject: [PATCH] indexer: track the blocklist addresses, so the default list
 is readable over 443

The project's indexers answered 'no history' for any address but the two
name beacons, so a client on a network that only lets port 443 out could
not read a blocklist at all. The indexer already tracks a set of scripthashes
and follows spends as well as payments; the table's list addresses join that
set.

buildBlocklists still prefers full servers, because a rotated or private
list is unknown to the indexers. It falls back to them only when no full
server can be reached and every subscribed list sits at its table address.
---
 src/indexer/bns-indexer.js |  8 ++++++++
 src/lib/resolver-web.js    | 14 +++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/indexer/bns-indexer.js b/src/indexer/bns-indexer.js
index c136cb6..93b529c 100644
--- a/src/indexer/bns-indexer.js
+++ b/src/indexer/bns-indexer.js
@@ -39,6 +39,13 @@ const CONFIG = {
   // Set to "" to disable TLD indexing (the /tld-list.json endpoint then 503s).
   // See Decentralized.DNS/DESIGN-tld-registry.md §7.
   tldBeacon: process.env.BNS_TLD_BEACON_SCRIPTHASH ?? (NETWORK.tldBeaconScripthash || ""),
+  // Blocklist addresses (PROTOCOL-ADDENDUM-blocklist.md), as scripthashes. A
+  // list is an ordinary address that resolvers read like a beacon; serving it
+  // here lets a client that only reaches this indexer (port 443) read the
+  // list. Defaults to the network table's lists; BNS_LIST_SCRIPTHASHES
+  // (comma-separated) replaces them, and "" disables.
+  lists: (process.env.BNS_LIST_SCRIPTHASHES ?? (NETWORK.blocklists || []).map((l) => l.scripthash).join(","))
+    .split(",").map((x) => x.trim()).filter(Boolean),
   // HTTP port for the /tld-list.json snapshot endpoint. 0 disables.
   httpPort: Number(process.env.BNS_HTTP_PORT || 0),
   httpBind: process.env.BNS_HTTP_BIND || "127.0.0.1",
@@ -394,6 +401,7 @@ async function main() {
   log(`connected to BCHN: chain=${chain.chain} blocks=${chain.blocks}`);
   const beacons = [CONFIG.beacon];
   if (CONFIG.tldBeacon) beacons.push(CONFIG.tldBeacon);
+  for (const l of CONFIG.lists) if (!beacons.includes(l)) beacons.push(l);
   log(`tracking ${beacons.length} beacon(s): ${beacons.map((b) => b.slice(0, 16) + "…").join(", ")}`);
   const src = new RpcSource(new BeaconIndex(beacons), CONFIG, rpc);
   src.load();
diff --git a/src/lib/resolver-web.js b/src/lib/resolver-web.js
index 9a4651d..ae385dd 100644
--- a/src/lib/resolver-web.js
+++ b/src/lib/resolver-web.js
@@ -919,7 +919,19 @@ export async function buildBlocklists({ network = NETWORK, lists, index = null,
   const out = new Map();
   if (!subscribed.length) return out;
   const pool = electrum ?? net.electrum.filter((s) => !net.beaconOnly.test(typeof s === "string" ? s : s.url));
-  const el = client ?? (await connectAny(pool, WS, { directIP }));
+  let el = client;
+  if (!el) {
+    try { el = await connectAny(pool, WS, { directIP }); }
+    catch (e) {
+      // No full server reachable (a network that only lets port 443 out).
+      // The project's indexers track the lists in the network table, so they
+      // can stand in — but only when every subscribed list still sits at its
+      // table address; a rotated or private list is unknown to them.
+      const tracked = new Set((net.blocklists || []).map((l) => l.beacon));
+      if (electrum || !subscribed.every((l) => tracked.has(blocklistAddress(l, index)))) throw e;
+      el = await connectAny(net.electrum, WS, { directIP });
+    }
+  }
   try {
     for (const list of subscribed) {
       const address = blocklistAddress(list, index);