feat(provenance): FIX-4 — verificador attestation on-chain (cierra V3-C1 + squat)
El verificador attestation queda VIVO: una firma producida por el código REAL de Ergon (arkhe-noesis-core, postcard + mensaje domain-separado) verifica byte-fiel en el pallet Substrate. Cierra el FIX-DEFERRED del roadmap (helper de Ergon ya en árbol) + el replay cross-chain V3-C1. origin-chain-types/attestation_verify.rs (nuevo): - ATTESTATION_DOMAIN_TAG + attestation_signed_message: espejo BYTE-IDÉNTICO del oráculo (DC 076d15cc ASP-3). Mensaje = TAG ‖ genesis_hash(32) ‖ payload. - decode_signing_payload: lector postcard SECUENCIAL total y estricto del SigningPayload de Ergon (sin dep nueva en el runtime wasm frágil). Lectores varint u64/u32 con los bounds exactos de postcard (cierra el LOW de fidelidad flagged: verdict/severity/constraints son u32, máx 5 bytes / 5º ≤ 15). Cotas DoS en strings. NUNCA re-serializa (contrato ASP-3). pallet-origin-provenance: - attest_asset(signing_payload: BoundedVec<u8,512>, signature: [u8;64]): recibe los bytes postcard OPACOS + la firma; decodifica, verifica Ed25519 vía sp_io::crypto::ed25519_verify (host function, no bloatea wasm, precedente FIX-3) sobre el mensaje domain-separado con el genesis_hash de ESTA cadena. La pubkey se decodifica del payload (no param aparte). creator = el validador, anchored_at_block real (cerró los placeholders del scaffold). - Dedup-by-BLAKE3 con rechazo EXPLÍCITO (asset_id = BLAKE3 content hash, dentro del payload firmado → replay del mismo blob reusa el asset_id → AlreadyAttested). Hallazgos de la verificación adversarial (workflow ultracode, 3 lentes) cerrados de RAÍZ: - HIGH asset-id squat / provenance poisoning + MEDIUM tier-forgery: el gate era self-attested (level del payload) → cualquiera con una clave Ed25519 anclaba basura institucional bajo el hash PÚBLICO de un asset legítimo y lo envenenaba de forma inmutable. FIX: registro on-chain AuthorizedValidators (pubkey → nivel OIT) gobernado por Root (register_validator/revoke_validator); la membresía es la VERDAD, no el payload. Mismo patrón que TierProfiles de FIX-6 Stage 2a (legitimidad on-chain, no caller-supplied). Sunset a attestation-driven cuando aterrice el registro OIT de Mathi. - MEDIUM método muerto: removido el ValidationAttestation::signing_payload() SCALE divergente (producía bytes que jamás verificarían — footgun). Decisiones (autoridad Pilar 4): sp_io ed25519_verify (consistente FIX-3, estándar Substrate) · dedup-by-asset_id subsume replay exacto · golden vectors generados desde el oráculo REAL de Ergon (seed [7u8;32], genesis 0xAB) = prueba cross-runtime. PENDIENTE (gap legítimo, no bug): OriginChainAttestationSink (impl del trait ValidationAttestationSink de Ergon) es código cliente off-chain — vive en un crate bridge del monorepo (subxt), NO en el chain repo (dependency direction submódulo→monorepo prohibida). Se cablea con la integración Noesis→chain. Tests: 19 provenance (golden vectors cross-runtime + squat cerrado + revoke + anti-replay cross/intra-chain + tamper + malformed) + 72 types (decoder fuzz- equivalente a postcard + fidelidad u32) + 21 suites workspace verde. cargo +1.88. WASM: build VPS-gated (UnknownOpcode 252 ambiental, ver v0.0.58). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
davidherranandClaude Fable 5 committed
1 parent
3364994cce
commit
ce18e191d0
7 files changed
+769
-475
No files matched your search
@@ -20,21 +20,26 @@ frame-system = { workspace = true }
|
||||
# Runtime API canonical (v0.0.17 PROV-8 — verify_provenance read-only RPC query)
|
||||
sp-api = { workspace = true }
|
||||
|
||||
# Crypto canonical
|
||||
# Crypto canonical. FIX-4: sp-io host function ed25519_verify (no bloatea wasm,
|
||||
# precedente FIX-3 agent-identity) + blake3 para dedup. ed25519-dalek se mantiene
|
||||
# solo para los fixtures de test (dev-deps) — el runtime usa sp_io.
|
||||
blake3 = { workspace = true }
|
||||
ed25519-dalek = { workspace = true }
|
||||
|
||||
# FIX-4 (V3-C1): verificacion Ed25519 on-chain via host function + genesis read.
|
||||
sp-core = { workspace = true }
|
||||
sp-io = { workspace = true }
|
||||
|
||||
# SCALE codec canonical
|
||||
parity-scale-codec = { workspace = true }
|
||||
scale-info = { workspace = true }
|
||||
|
||||
[dev-dependencies]
|
||||
# Mock runtime canonical para integration tests v0.0.18 — PROV-3 E2E flow.
|
||||
# Per pallet Substrate convention: sp-io TestExternalities + sp-runtime
|
||||
# AccountId32 + frame_support construct_runtime macro.
|
||||
# Mock runtime canonical para integration tests — PROV-3 E2E flow + golden
|
||||
# vectors ASP-3. ed25519-dalek solo aqui (fixtures); el runtime usa sp_io.
|
||||
sp-core = { workspace = true, default-features = true }
|
||||
sp-io = { workspace = true, default-features = true }
|
||||
sp-runtime = { workspace = true, default-features = true }
|
||||
ed25519-dalek = { workspace = true, default-features = true }
|
||||
|
||||
[features]
|
||||
default = ["std"]
|
||||
@@ -43,6 +48,8 @@ std = [
|
||||
"frame-support/std",
|
||||
"frame-system/std",
|
||||
"sp-api/std",
|
||||
"sp-core/std",
|
||||
"sp-io/std",
|
||||
"parity-scale-codec/std",
|
||||
"scale-info/std",
|
||||
]
|
||||
|
||||
@@ -103,7 +103,14 @@ sp_api::decl_runtime_apis! {
|
||||
pub mod pallet {
|
||||
use frame_support::pallet_prelude::*;
|
||||
use frame_system::pallet_prelude::*;
|
||||
use origin_chain_types::{AssetAttestation, AssetHash, ValidationAttestation};
|
||||
use frame_support::sp_runtime::traits::{SaturatedConversion, Zero};
|
||||
use origin_chain_types::{
|
||||
attestation_signed_message, decode_signing_payload, AssetAttestation, AssetHash,
|
||||
};
|
||||
|
||||
/// Cota DoS del `signing_payload` postcard recibido (el real ~115 bytes;
|
||||
/// 512 es holgado para schema/identifier futuros sin permitir flooding).
|
||||
pub type MaxPayloadLen = ConstU32<512>;
|
||||
|
||||
/// Pallet configuration trait canonical.
|
||||
///
|
||||
@@ -140,6 +147,25 @@ pub mod pallet {
|
||||
pub type Attestations<T: Config> =
|
||||
StorageMap<_, Blake2_128Concat, AssetHash, AssetAttestation, OptionQuery>;
|
||||
|
||||
/// FIX-4 (cierra el HIGH "asset-id squat"): registro on-chain de validadores
|
||||
/// Noesis autorizados → nivel OIT asignado por governance. **La membresía es
|
||||
/// la VERDAD**, no el `level` que el firmante pone en su propio payload
|
||||
/// (que era self-attested → cualquiera con una clave Ed25519 podía anclar
|
||||
/// basura institucional bajo el hash público de un asset legítimo y
|
||||
/// envenenarlo de forma inmutable). Ahora solo una pubkey REGISTRADA puede
|
||||
/// anclar; un validador registrado que ancle basura es revocable y auditable
|
||||
/// (problema de governance, no ataque anónimo). Mismo patrón que
|
||||
/// `TierProfiles` de FIX-6 Stage 2a: legitimidad on-chain, no caller-supplied.
|
||||
///
|
||||
/// **Root-only interim** (sudo Index 12 / governance). Sunset: cuando el
|
||||
/// registro OIT real de Mathi (PerceptionAdapter + DID binding) aterrice,
|
||||
/// migra a auto-registro attestation-driven. Cross-link futuro: AgentIdentity
|
||||
/// (Index 9).
|
||||
#[pallet::storage]
|
||||
#[pallet::getter(fn authorized_validator_level)]
|
||||
pub type AuthorizedValidators<T: Config> =
|
||||
StorageMap<_, Blake2_128Concat, [u8; 32], u8, OptionQuery>;
|
||||
|
||||
/// PROV-7 canonical: Events emisión canonical.
|
||||
#[pallet::event]
|
||||
#[pallet::generate_deposit(pub(super) fn deposit_event)]
|
||||
@@ -158,6 +184,19 @@ pub mod pallet {
|
||||
/// Reason canonical de rejection per RejectionReason enum.
|
||||
reason: RejectionReason,
|
||||
},
|
||||
/// FIX-4: validador Noesis autorizado (Root) con su nivel OIT. Auditable
|
||||
/// on-chain: quién quedó habilitado para anclar y a qué nivel.
|
||||
ValidatorRegistered {
|
||||
/// Ed25519 public key del validador autorizado.
|
||||
public_key: [u8; 32],
|
||||
/// Nivel OIT asignado por governance.
|
||||
level: u8,
|
||||
},
|
||||
/// FIX-4: validador revocado (Root) — ya no puede anclar.
|
||||
ValidatorRevoked {
|
||||
/// Ed25519 public key del validador revocado.
|
||||
public_key: [u8; 32],
|
||||
},
|
||||
}
|
||||
|
||||
/// Rejection reasons canonical PROV-7.
|
||||
@@ -204,102 +243,138 @@ pub mod pallet {
|
||||
AlreadyAttested,
|
||||
/// Marihan refinement Phase 2.2 noted canonical.
|
||||
MalformedValidationAttestation,
|
||||
/// FIX-4: la pubkey del firmante NO está en el registro on-chain de
|
||||
/// validadores autorizados (cierra el squat — solo validadores
|
||||
/// registrados por governance pueden anclar).
|
||||
ValidatorNotAuthorized,
|
||||
}
|
||||
|
||||
/// Dispatchables canonical (PROV-3 canonical: attest_asset).
|
||||
/// Dispatchables (PROV-3: attest_asset).
|
||||
#[pallet::call]
|
||||
impl<T: Config> Pallet<T> {
|
||||
/// PROV-3 canonical: `attest_asset` extrinsic canonical.
|
||||
/// PROV-3 + FIX-4: ancla una attestation Noesis verificada on-chain.
|
||||
///
|
||||
/// Submits a `ValidationAttestation` (Ergon Slice 7.0r struct) para
|
||||
/// anchoring canonical on-chain. Flow canonical 6-step per DC PROV-3:
|
||||
/// El validador firma OFF-CHAIN (con el helper de Ergon
|
||||
/// `attestation_signed_message`) sobre `TAG ‖ genesis_hash ‖ payload`,
|
||||
/// donde `payload` es el `SigningPayload` postcard (Slice 7.0r). El
|
||||
/// extrinsic recibe esos **bytes postcard opacos** + la firma; el pallet
|
||||
/// re-deriva el mensaje y verifica — NUNCA re-serializa (contrato ASP-3
|
||||
/// DC `076d15cc`). El `public_key` se DECODIFICA del payload (no es un
|
||||
/// parámetro aparte: la firma prueba que esa clave firmó esta attestation
|
||||
/// para esta cadena).
|
||||
///
|
||||
/// 1. PROV-4 canonical: Ed25519 signature verification canonical
|
||||
/// 2. PROV-5 canonical: validate `validator_oit.level >= 3` institutional
|
||||
/// 3. PROV-6 canonical: check `is_anchorable()` (verdict + severity)
|
||||
/// 4. PROV-2 canonical: convert ValidationAttestation → AssetAttestation
|
||||
/// 5. PROV-2 canonical: insert StorageMap canonical
|
||||
/// 6. PROV-7 canonical: emit AssetAttested event canonical
|
||||
///
|
||||
/// **SCAFFOLD v0.0.14 canonical**: real impl deferred post Ergon Cap 42+
|
||||
/// sub-crate ship + Ed25519 verification wire-up. Current canonical solo
|
||||
/// validates basic state (origin signed + not already attested) + emite
|
||||
/// placeholder event canonical.
|
||||
/// Flow (gates baratos antes del crypto caro, patrón FIX-3):
|
||||
/// 1. `ensure_signed` — el submitter (relayer/pagador del fee).
|
||||
/// 2. Decode postcard → (asset_id, public_key, level, verdict, severity).
|
||||
/// 3. **Dedup-by-BLAKE3 con RECHAZO EXPLÍCITO**: la storage key ES el
|
||||
/// `asset_id` (= BLAKE3 content hash del asset); un replay del mismo
|
||||
/// attestation firmado reusa el mismo asset_id → `AlreadyAttested`.
|
||||
/// (Decisión Pilar 4 sesión 6+: replay = rechazo explícito, no dedup
|
||||
/// silencioso.) Va ANTES del verify para no gastar crypto en replays.
|
||||
/// 4. FIX-4: gate de legitimidad ON-CHAIN — la pubkey del firmante debe
|
||||
/// estar en `AuthorizedValidators` (registro governance) con nivel
|
||||
/// >= 3. NO se confía en el `level` self-attested del payload (cierra
|
||||
/// el squat + tier-forgery).
|
||||
/// 5. PROV-6: gate anchorable (verdict Passed|Warning, severity Info|Warning).
|
||||
/// 6. FIX-4/V3-C1: Ed25519 verify via `sp_io::crypto::ed25519_verify`
|
||||
/// (host function, no bloatea wasm) sobre el mensaje domain-separado
|
||||
/// con el `genesis_hash` de ESTA cadena (cierra replay cross-chain).
|
||||
/// 7. Insert `AssetAttestation` (creator = validador, block real) + evento.
|
||||
#[pallet::call_index(0)]
|
||||
#[pallet::weight(Weight::from_parts(10_000, 0))]
|
||||
#[pallet::weight(Weight::from_parts(20_000, 0))]
|
||||
pub fn attest_asset(
|
||||
origin: OriginFor<T>,
|
||||
validation_attestation: ValidationAttestation,
|
||||
signing_payload: BoundedVec<u8, MaxPayloadLen>,
|
||||
signature: [u8; 64],
|
||||
) -> DispatchResult {
|
||||
// Verify origin canonical signed.
|
||||
let _signer = ensure_signed(origin)?;
|
||||
// 1. Origin signed (submitter — paga el fee; el creator semántico es
|
||||
// el validador cuya clave está dentro del payload firmado).
|
||||
let _submitter = ensure_signed(origin)?;
|
||||
|
||||
let asset_hash = validation_attestation.asset_id;
|
||||
// 2. Decode postcard del SigningPayload real de Ergon (total, DoS-safe).
|
||||
let decoded = decode_signing_payload(&signing_payload)
|
||||
.map_err(|_| Error::<T>::MalformedValidationAttestation)?;
|
||||
let asset_hash = AssetHash::new(decoded.asset_id);
|
||||
|
||||
// PROV-2 idempotency check canonical.
|
||||
// 3. Dedup-by-BLAKE3 (asset_id) — rechazo explícito de replay, antes
|
||||
// del crypto (FIX-3 discipline).
|
||||
ensure!(
|
||||
!Attestations::<T>::contains_key(asset_hash),
|
||||
Error::<T>::AlreadyAttested
|
||||
);
|
||||
|
||||
// PROV-5 OIT level >= 3 enforcement canonical.
|
||||
// 4. FIX-4: legitimidad ON-CHAIN (cierra el squat + tier-forgery).
|
||||
// La pubkey del firmante DEBE estar en el registro de validadores
|
||||
// autorizados; el nivel es el del REGISTRO (governance), NO el
|
||||
// `level` self-attested del payload. Sin esto, cualquiera con una
|
||||
// clave Ed25519 anclaba basura institucional bajo el hash público
|
||||
// de un asset legítimo.
|
||||
let authorized_level = AuthorizedValidators::<T>::get(decoded.public_key)
|
||||
.ok_or(Error::<T>::ValidatorNotAuthorized)?;
|
||||
ensure!(authorized_level >= 3, Error::<T>::ValidatorTierInsufficient);
|
||||
|
||||
// 5. PROV-6: anchorable (Inmutable #26 — una vez anclado es inmutable).
|
||||
ensure!(decoded.is_anchorable(), Error::<T>::NotAnchorable);
|
||||
|
||||
// 6. FIX-4 (V3-C1): re-derivar el mensaje domain-separado con el
|
||||
// genesis_hash de ESTA cadena y verificar Ed25519 sobre los BYTES
|
||||
// recibidos (nunca re-serializar). Host function = no wasm bloat.
|
||||
let genesis_full = <frame_system::Pallet<T>>::block_hash(BlockNumberFor::<T>::zero());
|
||||
let genesis_ref: &[u8] = genesis_full.as_ref();
|
||||
let mut genesis_hash = [0u8; 32];
|
||||
let n = genesis_ref.len().min(32);
|
||||
genesis_hash[..n].copy_from_slice(&genesis_ref[..n]);
|
||||
|
||||
let message = attestation_signed_message(&signing_payload, &genesis_hash);
|
||||
let sig = sp_core::ed25519::Signature::from_raw(signature);
|
||||
let pubkey = sp_core::ed25519::Public::from_raw(decoded.public_key);
|
||||
ensure!(
|
||||
validation_attestation.validator_oit.is_institutional(),
|
||||
Error::<T>::ValidatorTierInsufficient
|
||||
sp_io::crypto::ed25519_verify(&sig, &message, &pubkey),
|
||||
Error::<T>::InvalidSignature
|
||||
);
|
||||
|
||||
// PROV-6 is_anchorable check canonical.
|
||||
ensure!(
|
||||
validation_attestation.is_anchorable(),
|
||||
Error::<T>::NotAnchorable
|
||||
);
|
||||
|
||||
// PROV-4 canonical: Real Ed25519 verification via ed25519-dalek (v0.0.16).
|
||||
//
|
||||
// Pattern canonical:
|
||||
// 1. Reconstruct VerifyingKey desde validator_oit.public_key (32 bytes)
|
||||
// 2. Reconstruct Signature desde attestation.signature (64 bytes)
|
||||
// 3. Compute signing_payload canonical (SCALE encoding interim Option B)
|
||||
// 4. verify_strict canonical (rejects malleable signatures + zero-keys)
|
||||
//
|
||||
// Cuando Ergon arkhe-noesis-attestation-types ship Cap 42+, swap canonical
|
||||
// a postcard encoding canonical sin breaking pallet logic — verify call site
|
||||
// remains identical canonical.
|
||||
let pubkey = ed25519_dalek::VerifyingKey::from_bytes(
|
||||
&validation_attestation.validator_oit.public_key,
|
||||
)
|
||||
.map_err(|_| Error::<T>::InvalidSignature)?;
|
||||
|
||||
let signature = ed25519_dalek::Signature::from_bytes(
|
||||
&validation_attestation.signature,
|
||||
);
|
||||
|
||||
let payload = validation_attestation.signing_payload();
|
||||
|
||||
pubkey
|
||||
.verify_strict(&payload, &signature)
|
||||
.map_err(|_| Error::<T>::InvalidSignature)?;
|
||||
|
||||
// PROV-2 canonical: convert + insert canonical.
|
||||
// SCAFFOLD: minimal AssetAttestation construction (without creator/sig
|
||||
// mapping canonical — that's Ergon sub-crate concern post Cap 42+).
|
||||
// 7. Anclar: creator = el validador (su Ed25519 pubkey), block real.
|
||||
let block_number = <frame_system::Pallet<T>>::block_number();
|
||||
let attestation = AssetAttestation {
|
||||
hash: asset_hash,
|
||||
creator: origin_chain_types::AccountId::new([0u8; 32]), // SCAFFOLD placeholder
|
||||
signature: origin_chain_types::Signature::new(validation_attestation.signature),
|
||||
anchored_at_block: 0, // SCAFFOLD — block_number wire post v0.0.16
|
||||
agent_chain: origin_chain_types::AgentChain::default(), // BoundedVec empty
|
||||
creator: origin_chain_types::AccountId::new(decoded.public_key),
|
||||
signature: origin_chain_types::Signature::new(signature),
|
||||
anchored_at_block: block_number.saturated_into::<u64>(),
|
||||
agent_chain: origin_chain_types::AgentChain::default(),
|
||||
};
|
||||
|
||||
Attestations::<T>::insert(asset_hash, attestation);
|
||||
|
||||
// PROV-7 emit event canonical.
|
||||
let block_number = <frame_system::Pallet<T>>::block_number();
|
||||
Self::deposit_event(Event::AssetAttested {
|
||||
asset_hash,
|
||||
block_number,
|
||||
});
|
||||
Self::deposit_event(Event::AssetAttested { asset_hash, block_number });
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// FIX-4: registra (o re-nivela) un validador Noesis autorizado a anclar.
|
||||
/// **Root-only** (sudo Index 12 / governance) — cierra el squat: solo
|
||||
/// validadores que governance habilita pueden anclar. Sunset a
|
||||
/// attestation-driven cuando el registro OIT de Mathi aterrice.
|
||||
#[pallet::call_index(1)]
|
||||
#[pallet::weight(Weight::from_parts(10_000, 0))]
|
||||
pub fn register_validator(
|
||||
origin: OriginFor<T>,
|
||||
public_key: [u8; 32],
|
||||
level: u8,
|
||||
) -> DispatchResult {
|
||||
ensure_root(origin)?;
|
||||
AuthorizedValidators::<T>::insert(public_key, level);
|
||||
Self::deposit_event(Event::ValidatorRegistered { public_key, level });
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// FIX-4: revoca un validador — ya no puede anclar. **Root-only.**
|
||||
#[pallet::call_index(2)]
|
||||
#[pallet::weight(Weight::from_parts(10_000, 0))]
|
||||
pub fn revoke_validator(
|
||||
origin: OriginFor<T>,
|
||||
public_key: [u8; 32],
|
||||
) -> DispatchResult {
|
||||
ensure_root(origin)?;
|
||||
AuthorizedValidators::<T>::remove(public_key);
|
||||
Self::deposit_event(Event::ValidatorRevoked { public_key });
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
@@ -320,96 +395,15 @@ mod tests_integration;
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use ed25519_dalek::{Signer, SigningKey};
|
||||
use origin_chain_types::{OitIdentity, SeverityTier, ValidationAttestation, ValidationVerdict};
|
||||
|
||||
// Compile-time + Ed25519 verify standalone tests canonical.
|
||||
// Mock runtime integration tests canonical = Phase 2.1 v0.0.17 next slice.
|
||||
|
||||
fn signed_attestation(verdict: ValidationVerdict, severity: SeverityTier) -> ValidationAttestation {
|
||||
let signing_key = SigningKey::from_bytes(&[7u8; 32]);
|
||||
let verifying_key = signing_key.verifying_key();
|
||||
|
||||
let mut att = ValidationAttestation {
|
||||
schema_version: *b"1.0.0 ",
|
||||
asset_id: origin_chain_types::AssetHash::new([1u8; 32]),
|
||||
validator_oit: OitIdentity {
|
||||
public_key: verifying_key.to_bytes(),
|
||||
level: 3,
|
||||
},
|
||||
validated_at_us: 1234567890,
|
||||
verdict,
|
||||
severity,
|
||||
constraints_checked: 42,
|
||||
signature: [0u8; 64], // placeholder, replaced post sign
|
||||
};
|
||||
|
||||
let payload = att.signing_payload();
|
||||
let signature = signing_key.sign(&payload);
|
||||
att.signature = signature.to_bytes();
|
||||
att
|
||||
}
|
||||
// FIX-4: la verificación Ed25519 real (sp_io host function sobre el mensaje
|
||||
// domain-separado, con golden vectors del oráculo de Ergon) vive en
|
||||
// `tests_integration`. El decoder postcard + el mensaje firmado se prueban
|
||||
// en `origin-chain-types::attestation_verify`. Aquí quedan compile-checks.
|
||||
|
||||
#[test]
|
||||
fn ed25519_verify_real_valid_signature_canonical() {
|
||||
// PROV-4 canonical: signed attestation canonical verifies correctamente.
|
||||
let att = signed_attestation(ValidationVerdict::Passed, SeverityTier::Info);
|
||||
let pubkey = ed25519_dalek::VerifyingKey::from_bytes(
|
||||
&att.validator_oit.public_key,
|
||||
)
|
||||
.expect("valid pubkey canonical");
|
||||
let sig = ed25519_dalek::Signature::from_bytes(&att.signature);
|
||||
let payload = att.signing_payload();
|
||||
assert!(pubkey.verify_strict(&payload, &sig).is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ed25519_verify_tampered_signature_rejected_canonical() {
|
||||
// PROV-4 canonical: tampered signature canonical rejected.
|
||||
let mut att = signed_attestation(ValidationVerdict::Passed, SeverityTier::Info);
|
||||
// Flip a bit en signature canonical.
|
||||
att.signature[0] ^= 0xFF;
|
||||
let pubkey = ed25519_dalek::VerifyingKey::from_bytes(
|
||||
&att.validator_oit.public_key,
|
||||
)
|
||||
.expect("valid pubkey canonical");
|
||||
let sig = ed25519_dalek::Signature::from_bytes(&att.signature);
|
||||
let payload = att.signing_payload();
|
||||
assert!(pubkey.verify_strict(&payload, &sig).is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ed25519_verify_tampered_payload_rejected_canonical() {
|
||||
// PROV-4 canonical: tampered payload canonical (signing_payload mismatch) rejected.
|
||||
let mut att = signed_attestation(ValidationVerdict::Passed, SeverityTier::Info);
|
||||
let original_sig = att.signature;
|
||||
// Flip a bit en asset_id (cambia signing_payload pero mantiene signature original).
|
||||
att.asset_id = origin_chain_types::AssetHash::new([99u8; 32]);
|
||||
let pubkey = ed25519_dalek::VerifyingKey::from_bytes(
|
||||
&att.validator_oit.public_key,
|
||||
)
|
||||
.expect("valid pubkey canonical");
|
||||
let sig = ed25519_dalek::Signature::from_bytes(&original_sig);
|
||||
let payload = att.signing_payload(); // payload canonical NEW (con asset_id tampered)
|
||||
assert!(pubkey.verify_strict(&payload, &sig).is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ed25519_zero_signature_fails_verify_canonical() {
|
||||
// PROV-4 canonical: all-zero signature canonical rejected por verify_strict.
|
||||
// (Note: ed25519-dalek `from_bytes` acepta all-zero pubkey/sig — son
|
||||
// valid Edwards points; el rejection canonical pasa en verify_strict.)
|
||||
let signing_key = SigningKey::from_bytes(&[7u8; 32]);
|
||||
let verifying_key = signing_key.verifying_key();
|
||||
let payload = b"any payload canonical";
|
||||
let zero_sig = ed25519_dalek::Signature::from_bytes(&[0u8; 64]);
|
||||
assert!(verifying_key.verify_strict(payload, &zero_sig).is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn pallet_scaffold_compiles_canonical() {
|
||||
// Scaffold compiles — verified by cargo check.
|
||||
// Real mock runtime integration tests = Phase 2.1 v0.0.17.
|
||||
fn pallet_compiles_canonical() {
|
||||
// Verified by cargo check. E2E del fee-path verify = tests_integration.
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
||||
@@ -1,29 +1,20 @@
|
||||
//! # Mock runtime canonical para integration tests v0.0.18
|
||||
//! # Mock runtime para integration tests
|
||||
//!
|
||||
//! Provee mock minimal `Test` runtime composition (`System` + `Provenance` solo)
|
||||
//! para E2E tests dispatchable + storage + event assertions per PROV-3 flow
|
||||
//! 6-step canonical:
|
||||
//! Mock minimal (`System` + `Provenance`) para E2E del flow PROV-3 + FIX-4:
|
||||
//! decode postcard → gates → Ed25519 verify domain-separado → anclar.
|
||||
//!
|
||||
//! 1. PROV-4 Ed25519 signature verification
|
||||
//! 2. PROV-5 validator OIT level >= 3 institutional
|
||||
//! 3. PROV-6 is_anchorable check (verdict + severity)
|
||||
//! 4. PROV-2 ValidationAttestation → AssetAttestation conversion
|
||||
//! 5. PROV-2 StorageMap insert
|
||||
//! 6. PROV-7 AssetAttested event emission
|
||||
//!
|
||||
//! ## Cross-reference canonical
|
||||
//!
|
||||
//! - DC `ORIGIN_PROVENANCE_PALLET_V1` PROV-1..8 sub-decisions
|
||||
//! - `tests_integration.rs` 5 scenarios canonical E2E
|
||||
//! - `lib.rs::pallet::attest_asset` dispatchable impl real
|
||||
//! FIX-4: `new_test_ext_with_genesis` siembra `block_hash(0)` = el genesis con
|
||||
//! el que se firmaron los golden vectors (generados desde el oráculo REAL de
|
||||
//! Ergon `arkhe-noesis-core`), para probar la verificación cross-runtime.
|
||||
|
||||
#![cfg(test)]
|
||||
|
||||
use crate as origin_chain_provenance;
|
||||
use frame_support::derive_impl;
|
||||
use sp_core::H256;
|
||||
use sp_runtime::BuildStorage;
|
||||
|
||||
/// Mock block type canonical para tests.
|
||||
/// Mock block type para tests.
|
||||
type Block = frame_system::mocking::MockBlock<Test>;
|
||||
|
||||
frame_support::construct_runtime!(
|
||||
@@ -44,34 +35,52 @@ impl origin_chain_provenance::Config for Test {
|
||||
type RuntimeEvent = RuntimeEvent;
|
||||
}
|
||||
|
||||
/// Test externalities builder canonical.
|
||||
///
|
||||
/// Returns new `sp_io::TestExternalities` con frame_system genesis configurado
|
||||
/// y block_number set to 1 (PROV-7 events requieren block_number > 0 para
|
||||
/// proper testing canonical).
|
||||
pub fn new_test_ext() -> sp_io::TestExternalities {
|
||||
/// Genesis hash de los golden vectors ASP-3 (`/tmp/golden-asp3`, GENESIS=0xAB×32).
|
||||
/// El pallet lee `block_hash(0)`; el mock lo siembra con ESTE valor para que la
|
||||
/// verificación Ed25519 coincida con las firmas del oráculo.
|
||||
pub const GOLDEN_GENESIS: [u8; 32] = [0xABu8; 32];
|
||||
|
||||
/// Pubkey del validador golden (seed [7u8;32] → todos los vectores la usan).
|
||||
pub const GOLDEN_VALIDATOR_PUBKEY: [u8; 32] = [
|
||||
0xea, 0x4a, 0x6c, 0x63, 0xe2, 0x9c, 0x52, 0x0a, 0xbe, 0xf5, 0x50, 0x7b, 0x13, 0x2e, 0xc5, 0xf9,
|
||||
0x95, 0x47, 0x76, 0xae, 0xbe, 0xbe, 0x7b, 0x92, 0x42, 0x1e, 0xea, 0x69, 0x14, 0x46, 0xd2, 0x2c,
|
||||
];
|
||||
|
||||
/// Registra el validador golden con el nivel dado (vía Root) — helper de tests.
|
||||
pub fn register_golden_validator(level: u8) {
|
||||
crate::pallet::Pallet::<Test>::register_validator(
|
||||
RuntimeOrigin::root(),
|
||||
GOLDEN_VALIDATOR_PUBKEY,
|
||||
level,
|
||||
)
|
||||
.expect("Root registra el validador");
|
||||
}
|
||||
|
||||
/// Test externalities con `block_hash(0)` sembrado al genesis dado.
|
||||
pub fn new_test_ext_with_genesis(genesis: [u8; 32]) -> sp_io::TestExternalities {
|
||||
let mut ext: sp_io::TestExternalities = frame_system::GenesisConfig::<Test>::default()
|
||||
.build_storage()
|
||||
.expect("genesis canonical builds")
|
||||
.expect("genesis builds")
|
||||
.into();
|
||||
ext.execute_with(|| {
|
||||
System::set_block_number(1);
|
||||
// Siembra el hash del bloque génesis (que el pallet lee para el dominio).
|
||||
frame_system::BlockHash::<Test>::insert(0u64, H256(genesis));
|
||||
});
|
||||
ext
|
||||
}
|
||||
|
||||
/// Test signing key seed canonical (deterministic Ed25519 keypair).
|
||||
///
|
||||
/// Per ed25519-dalek pattern: seed [7u8; 32] produces deterministic verifying_key.
|
||||
/// Used across integration tests para reproducible signing.
|
||||
pub const TEST_SIGNING_SEED: [u8; 32] = [7u8; 32];
|
||||
/// Test externalities con el genesis de los golden vectors (caso por defecto).
|
||||
pub fn new_test_ext() -> sp_io::TestExternalities {
|
||||
new_test_ext_with_genesis(GOLDEN_GENESIS)
|
||||
}
|
||||
|
||||
/// Test origin account canonical (32-byte zero pattern).
|
||||
/// Submitter de prueba (un relayer cualquiera — paga el fee, no es el validador).
|
||||
pub fn alice_origin() -> RuntimeOrigin {
|
||||
RuntimeOrigin::signed(sp_runtime::AccountId32::new([1u8; 32]))
|
||||
}
|
||||
|
||||
/// Test origin account canonical (BOB pattern).
|
||||
/// Segundo submitter (BOB).
|
||||
pub fn bob_origin() -> RuntimeOrigin {
|
||||
RuntimeOrigin::signed(sp_runtime::AccountId32::new([2u8; 32]))
|
||||
}
|
||||
@@ -1,310 +1,241 @@
|
||||
//! # Integration tests canonical v0.0.18 — Mock runtime E2E
|
||||
//! # Integration tests E2E — FIX-4 verificador attestation cross-runtime
|
||||
//!
|
||||
//! 5 scenarios canonical PROV-3 attest_asset flow end-to-end via mock runtime:
|
||||
//! Prueban el dispatchable `attest_asset` contra **golden vectors generados
|
||||
//! desde el oráculo REAL de Ergon** (`arkhe-noesis-core::attestation`, en
|
||||
//! `/tmp/golden-asp3` con keypair seed [7u8;32], genesis 0xAB×32). Esto cierra
|
||||
//! el caso V3-C1: una firma producida por el código real de Ergon (postcard +
|
||||
//! mensaje domain-separado) verifica byte-fiel en el pallet Substrate.
|
||||
//!
|
||||
//! | Scenario | Verdict | Severity | OIT Level | Expected outcome |
|
||||
//! |----------|---------|----------|-----------|------------------|
|
||||
//! | passed_info_anchored | Passed | Info | 3 | ✅ AssetAttested event + storage insert |
|
||||
//! | warning_anchored | Warning | Warning | 3 | ✅ AssetAttested event + storage insert |
|
||||
//! | failed_critical_rejected | Failed | Critical | 3 | ❌ NotAnchorable error |
|
||||
//! | passed_block_security_rejected | Passed | Block | 3 | ❌ NotAnchorable error |
|
||||
//! | anonymous_level_0_rejected | Passed | Info | 0 | ❌ ValidatorTierInsufficient error |
|
||||
//!
|
||||
//! Plus 4 additional canonical:
|
||||
//! - idempotency: already attested asset rejected con `AlreadyAttested` error
|
||||
//! - tampered_signature: Ed25519 verify fails con `InvalidSignature` error
|
||||
//! - tampered_payload: signing_payload mismatch con `InvalidSignature` error
|
||||
//! - 6_step_walkthrough: explicit PROV-3 flow assertions in sequence
|
||||
//!
|
||||
//! Total: 9 integration tests canonical.
|
||||
//!
|
||||
//! ## Own fixtures pattern
|
||||
//!
|
||||
//! Per audit canonical sesión 3+ (`AUDIT_CHARON_SESION_3_STATE_V1.md`), Ergon
|
||||
//! E2E fixture diary claim aspirational sin shipped commit verified.
|
||||
//! Charon construye own fixtures basados en vendor copy `ValidationAttestation`
|
||||
//! real existente en `origin-chain-types/src/attestation.rs`. Cuando Ergon
|
||||
//! ship `arkhe-noesis-attestation-types` sub-crate Cap 42+, fixtures can swap.
|
||||
//! Vectores (hex):
|
||||
//! - PAYLOAD1/SIG1: asset [1×32], atelier level 3, Passed/Info → ANCLA.
|
||||
//! - PAYLOAD2/SIG2: asset [2×32], atelier level 3, Warning/Warning → ANCLA.
|
||||
//! - PAYLOAD3/SIG3: asset [3×32], atelier level 3, Failed/Critical → NotAnchorable.
|
||||
//! - PAYLOAD4/SIG4: asset [4×32], anonymous level 0, Passed/Info → TierInsufficient.
|
||||
|
||||
#![cfg(test)]
|
||||
|
||||
use crate::mock::{alice_origin, bob_origin, new_test_ext, Provenance, RuntimeEvent, System, Test, TEST_SIGNING_SEED};
|
||||
use crate::{Attestations, Error, Event};
|
||||
use ed25519_dalek::{Signer, SigningKey};
|
||||
use frame_support::{assert_noop, assert_ok};
|
||||
use origin_chain_types::{
|
||||
AssetHash, OitIdentity, SeverityTier, ValidationAttestation, ValidationVerdict,
|
||||
extern crate alloc;
|
||||
|
||||
use crate::mock::{
|
||||
alice_origin, bob_origin, new_test_ext, new_test_ext_with_genesis, register_golden_validator,
|
||||
Provenance, RuntimeEvent, RuntimeOrigin, System, Test, GOLDEN_GENESIS, GOLDEN_VALIDATOR_PUBKEY,
|
||||
};
|
||||
use crate::{Attestations, Error, Event};
|
||||
use frame_support::{assert_noop, assert_ok, BoundedVec};
|
||||
|
||||
// ─── Fixture builders canonical ──────────────────────────────────────
|
||||
// ── Golden vectors (oráculo Ergon real) ──────────────────────────────
|
||||
const PAYLOAD1: &str = "05312e302e300101010101010101010101010101010101010101010101010101010101010101146174656c6965725f63616e6f6e6963616c5f763103ea4a6c63e29c520abef5507b132ec5f9954776aebebe7b92421eea691446d22cd285d8cc0400002a";
|
||||
const SIG1: &str = "e155043ad90df787d73e8ba4c3ee961427ecb228637ade77e19bd9b57bb727dcdf3c247462aa8e6facf5697887f3e08f96af1c5f2fdcab10fcfbd2daabe73204";
|
||||
const PAYLOAD2: &str = "05312e302e300202020202020202020202020202020202020202020202020202020202020202146174656c6965725f63616e6f6e6963616c5f763103ea4a6c63e29c520abef5507b132ec5f9954776aebebe7b92421eea691446d22c8080f9c0c1c48203010107";
|
||||
const SIG2: &str = "34aa4a272ea6b264a1a38af912a9dfee9e77a3d37f0ae2427634d9aa0e5582eca741787904b8d0199614f93c14f2d5f3b7a53e1414d29d7ee272e985591fee05";
|
||||
const PAYLOAD3: &str = "05312e302e300303030303030303030303030303030303030303030303030303030303030303146174656c6965725f63616e6f6e6963616c5f763103ea4a6c63e29c520abef5507b132ec5f9954776aebebe7b92421eea691446d22c8080f9c0c1c48203020203";
|
||||
const SIG3: &str = "2c91a93223a105e528ac17879bc6561444ab8af3aac5b0857d781cb6d2c2e52eca6e6ec6673c174dc3cdf28733add7a0dce23e2f543288721e3ad84ddb77fa05";
|
||||
const PAYLOAD4: &str = "05312e302e30040404040404040404040404040404040404040404040404040404040404040413616e6f6e796d6f75735f63616e6f6e6963616c00ea4a6c63e29c520abef5507b132ec5f9954776aebebe7b92421eea691446d22c8080f9c0c1c48203000001";
|
||||
const SIG4: &str = "53898be4c2dfea096fb991a9d37b2ffe078f8ff2a20003612bb6930eefd0ddeeb0056a48b4a55453c519eb75bbfb5d6b05295a5f91050f53087125145b392702";
|
||||
|
||||
/// Build canonical signed ValidationAttestation con (verdict, severity, oit_level)
|
||||
/// parameters. Deterministic Ed25519 signature.
|
||||
///
|
||||
/// asset_id es derivado de seed para uniqueness per scenario.
|
||||
fn build_signed_attestation(
|
||||
asset_seed: u8,
|
||||
verdict: ValidationVerdict,
|
||||
severity: SeverityTier,
|
||||
oit_level: u8,
|
||||
) -> ValidationAttestation {
|
||||
let signing_key = SigningKey::from_bytes(&TEST_SIGNING_SEED);
|
||||
let verifying_key = signing_key.verifying_key();
|
||||
|
||||
let mut att = ValidationAttestation {
|
||||
schema_version: *b"1.0.0 ",
|
||||
asset_id: AssetHash::new([asset_seed; 32]),
|
||||
validator_oit: OitIdentity {
|
||||
public_key: verifying_key.to_bytes(),
|
||||
level: oit_level,
|
||||
},
|
||||
validated_at_us: 1_234_567_890,
|
||||
verdict,
|
||||
severity,
|
||||
constraints_checked: 42,
|
||||
signature: [0u8; 64], // placeholder, replaced post sign
|
||||
};
|
||||
|
||||
let payload = att.signing_payload();
|
||||
let signature = signing_key.sign(&payload);
|
||||
att.signature = signature.to_bytes();
|
||||
att
|
||||
fn unhex(s: &str) -> alloc::vec::Vec<u8> {
|
||||
(0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
|
||||
}
|
||||
|
||||
/// Build canonical fixture passed_info (most common anchorable scenario).
|
||||
fn fixture_passed_info(asset_seed: u8) -> ValidationAttestation {
|
||||
build_signed_attestation(asset_seed, ValidationVerdict::Passed, SeverityTier::Info, 3)
|
||||
fn payload(s: &str) -> BoundedVec<u8, crate::pallet::MaxPayloadLen> {
|
||||
BoundedVec::try_from(unhex(s)).expect("payload within bound")
|
||||
}
|
||||
|
||||
// ─── Scenario 1: passed_info anchored canonical ──────────────────────
|
||||
fn sig(s: &str) -> [u8; 64] {
|
||||
unhex(s).try_into().expect("64-byte sig")
|
||||
}
|
||||
|
||||
// ── Camino feliz: firma real de Ergon ancla on-chain ─────────────────
|
||||
|
||||
#[test]
|
||||
fn scenario_1_passed_info_anchored_canonical() {
|
||||
fn golden_passed_info_anchors_cross_runtime() {
|
||||
new_test_ext().execute_with(|| {
|
||||
let attestation = fixture_passed_info(1);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
// PROV-3 attest_asset extrinsic canonical
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), attestation.clone()));
|
||||
|
||||
// PROV-2 storage insert verified
|
||||
let stored = Attestations::<Test>::get(asset_hash);
|
||||
assert!(stored.is_some(), "PROV-2 canonical: AssetAttestation inserted in StorageMap");
|
||||
let stored_unwrap = stored.unwrap();
|
||||
assert_eq!(stored_unwrap.hash, asset_hash);
|
||||
assert_eq!(stored_unwrap.signature.as_bytes(), &attestation.signature);
|
||||
|
||||
// PROV-7 event emitted canonical
|
||||
System::assert_last_event(RuntimeEvent::Provenance(Event::AssetAttested {
|
||||
asset_hash,
|
||||
register_golden_validator(3); // governance habilita al validador
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), sig(SIG1)));
|
||||
let hash = origin_chain_types::AssetHash::new([1u8; 32]);
|
||||
let stored = Attestations::<Test>::get(hash).expect("anclado");
|
||||
// creator = el VALIDADOR (su pubkey Ed25519), no el submitter.
|
||||
assert_eq!(stored.creator.as_bytes(), &GOLDEN_VALIDATOR_PUBKEY[..]);
|
||||
// block real (no el placeholder 0 del scaffold).
|
||||
assert_eq!(stored.anchored_at_block, 1);
|
||||
System::assert_has_event(RuntimeEvent::Provenance(Event::AssetAttested {
|
||||
asset_hash: hash,
|
||||
block_number: 1,
|
||||
}));
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Scenario 2: warning anchored canonical (non-blocking) ────────────
|
||||
|
||||
#[test]
|
||||
fn scenario_2_warning_anchored_canonical() {
|
||||
fn golden_warning_warning_anchors() {
|
||||
new_test_ext().execute_with(|| {
|
||||
let attestation = build_signed_attestation(
|
||||
2,
|
||||
ValidationVerdict::Warning,
|
||||
SeverityTier::Warning,
|
||||
3,
|
||||
);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), attestation));
|
||||
|
||||
assert!(Attestations::<Test>::get(asset_hash).is_some());
|
||||
System::assert_last_event(RuntimeEvent::Provenance(Event::AssetAttested {
|
||||
asset_hash,
|
||||
block_number: 1,
|
||||
}));
|
||||
register_golden_validator(3);
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), payload(PAYLOAD2), sig(SIG2)));
|
||||
assert!(Attestations::<Test>::contains_key(origin_chain_types::AssetHash::new([2u8; 32])));
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Scenario 3: failed_critical rejected canonical (PROV-6) ──────────
|
||||
// ── FIX-4: legitimidad ON-CHAIN (cierra squat + tier-forgery) ────────
|
||||
|
||||
#[test]
|
||||
fn scenario_3_failed_critical_rejected_canonical() {
|
||||
fn unregistered_validator_rejected_closes_squat() {
|
||||
// Firma VÁLIDA + level 3 en el payload, pero la pubkey NO está registrada
|
||||
// → rechazo. Cierra el squat: un atacante anónimo no ancla nada.
|
||||
new_test_ext().execute_with(|| {
|
||||
let attestation = build_signed_attestation(
|
||||
3,
|
||||
ValidationVerdict::Failed,
|
||||
SeverityTier::Critical,
|
||||
3,
|
||||
);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
// PROV-6 is_anchorable canonical check fails (Failed verdict + Critical severity)
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), attestation),
|
||||
Error::<Test>::NotAnchorable
|
||||
Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), sig(SIG1)),
|
||||
Error::<Test>::ValidatorNotAuthorized
|
||||
);
|
||||
|
||||
// Storage NOT inserted
|
||||
assert!(Attestations::<Test>::get(asset_hash).is_none());
|
||||
assert!(!Attestations::<Test>::contains_key(origin_chain_types::AssetHash::new([1u8; 32])));
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Scenario 4: passed_block security rejected canonical (PROV-6) ────
|
||||
|
||||
#[test]
|
||||
fn scenario_4_passed_block_security_rejected_canonical() {
|
||||
fn registered_but_low_level_rejected() {
|
||||
new_test_ext().execute_with(|| {
|
||||
// Passed verdict pero Block severity (security violation override)
|
||||
let attestation = build_signed_attestation(
|
||||
4,
|
||||
ValidationVerdict::Passed,
|
||||
SeverityTier::Block,
|
||||
3,
|
||||
);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
// PROV-6 is_anchorable rejects Block severity even with Passed verdict
|
||||
register_golden_validator(1); // registrado, pero nivel < 3
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), attestation),
|
||||
Error::<Test>::NotAnchorable
|
||||
);
|
||||
|
||||
assert!(Attestations::<Test>::get(asset_hash).is_none());
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Scenario 5: anonymous_level_0 rejected canonical (PROV-5) ────────
|
||||
|
||||
#[test]
|
||||
fn scenario_5_anonymous_level_0_rejected_canonical() {
|
||||
new_test_ext().execute_with(|| {
|
||||
// Valid verdict + severity, pero OIT level 0 (anonymous) — PROV-5 reject
|
||||
let attestation = build_signed_attestation(
|
||||
5,
|
||||
ValidationVerdict::Passed,
|
||||
SeverityTier::Info,
|
||||
0, // ANONYMOUS — institutional level >= 3 required
|
||||
);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
// PROV-5 validator OIT tier check canonical fails
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), attestation),
|
||||
Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), sig(SIG1)),
|
||||
Error::<Test>::ValidatorTierInsufficient
|
||||
);
|
||||
|
||||
assert!(Attestations::<Test>::get(asset_hash).is_none());
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Additional canonical: idempotency ────────────────────────────────
|
||||
#[test]
|
||||
fn registry_level_overrides_payload_self_claimed_level() {
|
||||
// PAYLOAD4 declara identifier "anonymous" + level 0 EN EL PAYLOAD, pero la
|
||||
// pubkey está registrada a nivel 3 → ancla. La VERDAD es el registro, no el
|
||||
// self-attested del payload (esto es exactamente lo que cierra el forgery).
|
||||
new_test_ext().execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), payload(PAYLOAD4), sig(SIG4)));
|
||||
assert!(Attestations::<Test>::contains_key(origin_chain_types::AssetHash::new([4u8; 32])));
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn additional_idempotency_already_attested_rejected_canonical() {
|
||||
fn register_validator_is_root_only() {
|
||||
new_test_ext().execute_with(|| {
|
||||
let attestation = fixture_passed_info(6);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
// First attest_asset succeeds canonical
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), attestation.clone()));
|
||||
assert!(Attestations::<Test>::get(asset_hash).is_some());
|
||||
|
||||
// Second attest_asset (same hash) — idempotency canonical rejects
|
||||
// Signed origin → BadOrigin (solo governance habilita validadores).
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(bob_origin(), attestation),
|
||||
Provenance::register_validator(alice_origin(), GOLDEN_VALIDATOR_PUBKEY, 3),
|
||||
sp_runtime::DispatchError::BadOrigin
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn revoked_validator_cannot_anchor() {
|
||||
new_test_ext().execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
assert_ok!(Provenance::revoke_validator(RuntimeOrigin::root(), GOLDEN_VALIDATOR_PUBKEY));
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), sig(SIG1)),
|
||||
Error::<Test>::ValidatorNotAuthorized
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
// ── Gate anchorable ──────────────────────────────────────────────────
|
||||
|
||||
#[test]
|
||||
fn golden_failed_critical_rejected_not_anchorable() {
|
||||
new_test_ext().execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), payload(PAYLOAD3), sig(SIG3)),
|
||||
Error::<Test>::NotAnchorable
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
// ── Crypto: tamper + anti-replay cross-chain (V3-C1) ─────────────────
|
||||
|
||||
#[test]
|
||||
fn tampered_signature_rejected() {
|
||||
new_test_ext().execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
let mut bad = sig(SIG1);
|
||||
bad[0] ^= 0xFF;
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), bad),
|
||||
Error::<Test>::InvalidSignature
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn tampered_payload_rejected() {
|
||||
new_test_ext().execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
// PAYLOAD2 con SIG1: la firma no corresponde a estos bytes.
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), payload(PAYLOAD2), sig(SIG1)),
|
||||
Error::<Test>::InvalidSignature
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn wrong_genesis_rejected_anti_replay_cross_chain() {
|
||||
// V3-C1: la MISMA attestation firmada para la cadena 0xAB no verifica en
|
||||
// una cadena con genesis distinto (0xCC) — el genesis_hash liga la firma.
|
||||
new_test_ext_with_genesis([0xCCu8; 32]).execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), sig(SIG1)),
|
||||
Error::<Test>::InvalidSignature
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
// ── Replay intra-chain: rechazo EXPLÍCITO (decisión Pilar 4) ─────────
|
||||
|
||||
#[test]
|
||||
fn replay_same_attestation_rejected_explicitly() {
|
||||
new_test_ext().execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), sig(SIG1)));
|
||||
// Re-submit del MISMO attestation firmado (incluso por otro submitter):
|
||||
// mismo asset_id (BLAKE3 content hash) → rechazo explícito.
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(bob_origin(), payload(PAYLOAD1), sig(SIG1)),
|
||||
Error::<Test>::AlreadyAttested
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Additional canonical: tampered signature (PROV-4) ────────────────
|
||||
// ── Malformed payload ────────────────────────────────────────────────
|
||||
|
||||
#[test]
|
||||
fn additional_tampered_signature_rejected_canonical() {
|
||||
fn malformed_payload_rejected() {
|
||||
new_test_ext().execute_with(|| {
|
||||
let mut attestation = fixture_passed_info(7);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
// Flip bit en signature canonical post-sign
|
||||
attestation.signature[0] ^= 0xFF;
|
||||
|
||||
// PROV-4 Ed25519 verify canonical fails
|
||||
let mut bytes = unhex(PAYLOAD1);
|
||||
bytes.push(0x99); // trailing byte → decoder estricto rechaza
|
||||
let bad = BoundedVec::try_from(bytes).unwrap();
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), attestation),
|
||||
Error::<Test>::InvalidSignature
|
||||
Provenance::attest_asset(alice_origin(), bad, sig(SIG1)),
|
||||
Error::<Test>::MalformedValidationAttestation
|
||||
);
|
||||
|
||||
assert!(Attestations::<Test>::get(asset_hash).is_none());
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Additional canonical: tampered payload (PROV-4) ──────────────────
|
||||
|
||||
#[test]
|
||||
fn additional_tampered_payload_rejected_canonical() {
|
||||
fn empty_payload_rejected() {
|
||||
new_test_ext().execute_with(|| {
|
||||
let mut attestation = fixture_passed_info(8);
|
||||
let original_asset_hash = attestation.asset_id;
|
||||
|
||||
// Tamper asset_id post-sign — cambia signing_payload pero mantiene signature original
|
||||
attestation.asset_id = AssetHash::new([99u8; 32]);
|
||||
let new_asset_hash = attestation.asset_id;
|
||||
|
||||
// PROV-4 signing_payload mismatch canonical, Ed25519 verify fails
|
||||
let empty = BoundedVec::try_from(alloc::vec::Vec::new()).unwrap();
|
||||
assert_noop!(
|
||||
Provenance::attest_asset(alice_origin(), attestation),
|
||||
Error::<Test>::InvalidSignature
|
||||
Provenance::attest_asset(alice_origin(), empty, [0u8; 64]),
|
||||
Error::<Test>::MalformedValidationAttestation
|
||||
);
|
||||
|
||||
// Ninguno de los dos hashes está en storage
|
||||
assert!(Attestations::<Test>::get(original_asset_hash).is_none());
|
||||
assert!(Attestations::<Test>::get(new_asset_hash).is_none());
|
||||
});
|
||||
}
|
||||
|
||||
// ─── Additional canonical: 6-step PROV-3 walkthrough explicit ─────────
|
||||
// ── Determinismo: el genesis correcto SÍ ancla ───────────────────────
|
||||
|
||||
#[test]
|
||||
fn additional_6_step_prov_3_walkthrough_canonical() {
|
||||
new_test_ext().execute_with(|| {
|
||||
let attestation = fixture_passed_info(9);
|
||||
let asset_hash = attestation.asset_id;
|
||||
|
||||
// Pre-flight assertions canonical
|
||||
assert!(
|
||||
attestation.is_anchorable(),
|
||||
"PRE-flight PROV-6: fixture anchorable canonical"
|
||||
);
|
||||
assert!(
|
||||
attestation.validator_oit.is_institutional(),
|
||||
"PRE-flight PROV-5: validator institutional canonical"
|
||||
);
|
||||
assert!(
|
||||
Attestations::<Test>::get(asset_hash).is_none(),
|
||||
"PRE-flight PROV-2: storage empty para asset_hash canonical"
|
||||
);
|
||||
|
||||
// Step 1: PROV-4 canonical Ed25519 signature verification (implicit via dispatchable)
|
||||
// Step 2: PROV-5 canonical validate validator_oit.level >= 3 institutional
|
||||
// Step 3: PROV-6 canonical check is_anchorable (verdict + severity)
|
||||
// Step 4: PROV-2 canonical convert ValidationAttestation → AssetAttestation
|
||||
// Step 5: PROV-2 canonical StorageMap insert
|
||||
// Step 6: PROV-7 canonical emit AssetAttested event
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), attestation.clone()));
|
||||
|
||||
// Post-flight assertions canonical
|
||||
let stored = Attestations::<Test>::get(asset_hash)
|
||||
.expect("POST-flight PROV-2: AssetAttestation persisted canonical");
|
||||
assert_eq!(stored.hash, asset_hash, "POST-flight: hash preserved");
|
||||
assert_eq!(
|
||||
stored.signature.as_bytes(),
|
||||
&attestation.signature,
|
||||
"POST-flight: signature preserved canonical"
|
||||
);
|
||||
|
||||
System::assert_last_event(RuntimeEvent::Provenance(Event::AssetAttested {
|
||||
asset_hash,
|
||||
block_number: 1,
|
||||
}));
|
||||
fn correct_genesis_verifies() {
|
||||
new_test_ext_with_genesis(GOLDEN_GENESIS).execute_with(|| {
|
||||
register_golden_validator(3);
|
||||
assert_ok!(Provenance::attest_asset(alice_origin(), payload(PAYLOAD1), sig(SIG1)));
|
||||
});
|
||||
}
|
||||
Reference in new issue
Block a user