[docs] baking command line to create macaroon with similar rights as admin.macaroon has

[tlindi]

I tried to find information what the admin.macaroon contains to create customs macaroon for 3rd party application usage.

I could not find such example anywhere. So I checked what rights admin.macaroon contained and composed command line to bake the similar manually.

From this sample it is easy to modify and limit the access of certain accounting apps like BTCpay or LNbits to a certain amount, as operator might desire so. Usually those applications recommend to "copy admin.macaroon" to application. I'd prefer to bake custom macaroon for each use case.

I got the an idea about sharing this example to the world, and I was thinking to open issue for this specific information is not available.

But - what would be the issue type I should open?

Or could I just PR my suggestion of small addition to documentation, which can be seen here:
master...tlindi:lnd:admin-macaroon-recreate-sample

Br, tlindi

[guggero]

Since you can list the permissions of a macaroon with lncli printmacaroon it's easy to find out what the admin macaroon contains, so I guess that's why it was never explicitly specified. Also, documentation of that kind tends to be outdated quickly whenever a new permission is added. So we usually just link to the code where the permissions reside.

You're welcome to create a PR though if you think it's helpful to have that documented.
I don't really understand why you'd want to create what's essentially a copy of the admin macaroon if you can just copy the file? Because by default newly baked macaroons are always derived from the same master key as the pre-generated admin.macaroon, you cannot invalidate/revoke those manual copies individually, so there is no improvement in the security by doing it.
If you want to be able to revoke specific macaroons, then you should use the --root_key_id and give each macaroon its own ID. Then you can invalidate all macaroons ever issued for a certain root key ID with lncli deletemacaroonid.

Also, when you're creating custom macaroons, consider not adding the macaroon:generate and macaroon:write permissions, as that allows anyone with that macaroon to bake a new one (potentially with more permissions than before).

Maybe you can add the two hints above to your documentation PR as well?

[tlindi]

Thank you. Makes sence.

I'll test functionality of --root_key_id and deleting macaroons with lncli deletemacaroonid and update my version of docs accordingly. And then PR. Do you think it would be good to open Draft PR - or should I go straight with PR?

[guggero]

If it's just documentation, you can open a PR directly (and include [skip ci] in the commit message to skip most of the CI steps that are irrelevant for documentation changes).