VersionedSlate and VersionedBinSlate are untagged and try V5 first, so
without a version check a V4 slate parses as V5. Only visible without a
payment proof; with one the V4 and V5 proof shapes differ enough for
serde to pick the right variant by chance.
Reject a mismatched version in the V4 and V5 deserializers, for both the
JSON and binary encodings, and set the declared version from the
conversion so it always matches the structure emitted. Add V4/V5 round
trip tests over both encodings, with and without a proof.
The V3 API examples showed V4 slates declaring version 5; they now
declare 4.
NaiveDateTime::from_timestamp_opt and DateTime::from_utc are deprecated
in favour of DateTime::from_timestamp.
Two call sites in contract::proofs converted a timestamp to a
NaiveDateTime and immediately back to the same i64; those now use the
value directly, which also removes an unwrap.
- Remove unused imports in api_impl::owner, backend, contract::utils,
v5_bin and the contract tests.
- Remove unused test bindings, and document the shared slate test
fixtures module.
- Drop the commented-out assertion block in the mwixnet contract test,
along with the height bookkeeping and import that only it used.
Brings the branch current with staging for review.
- ed25519-dalek 1.0.0-pre.4 to 2: PublicKey is now VerifyingKey, Keypair
is replaced by SigningKey, and from_bytes takes a fixed-size array.
Ported the contract proof code and the V5 slate serializers, following
the pattern staging already uses in v4_bin.
- owner_single_use and foreign_single_use now take the wallet instance
and a config path rather than an optional API handle. Updated the
contract call sites in command.rs and the contract tests.
- update_tx_slate_state moved to api_impl::types; dropped the local copy.
- Took staging's fixed-size-array form of the slate signature guards; it
is equivalent to 25a5434 and keeps the file in sync with upstream.
- The grin node is now a submodule, so a build needs
git submodule update --init.
* config: global instance
* fix: cli tests
* fix: owner api tests
* config: save tor config
* fix: owner rpc tests
* fix: set config file path on init and owner api call
* tor: store launched services, get global config at command loop, remove unused listen args, check for empty global config to set default, do not save empty tor config at owner
* api: update config in memory after successful file write
* arti: restart proxy in loop
* fix: comment for tor config save
* config: set or init, update without error
* config: scoped tor config
* build: update lock file
* config: ability to store multiple configurations at memory from config path
* tor: restart service on config change
* fix: owner api test
* foreign: pass tor config from args, stop service, error handling
* arti: move runtime wrapper to single file
* config: read existing config from file at create_config
* config: handle error on read
* arti: single dir for cache
* foreign: register config listener before launch
* config: save temp
* config: remove unused error type
* config: make path and members not optional, return an error on config creation if it exists, pass default tor config to send if not set
* arti: non public runtime wrapper
* config: migrate comments
* fix: rpc tests
* config: return from cache if exists
* config: save disabled tor config when null provided at owner and tor section was not set
* config: update tor with args at listener
* config: pass pathbuf directly on creation
* config: unique tmp file name, setting permissions and providing config version
* fix global config handling
* fix config persistence
* fix tor service restart
* fix config synchronization
* require wallet close before changing data directory
* unify global config updates
---------
Co-authored-by: wiesche <wiesche89@googlemail.com>
* tor: global client state
* tor: optimize init client thread-safety
* tor: handle config change on client init
* tor: add logging for client reuse or reinit
* tor: do not reuse arti client for requests
* tor: integrated client for listener, update tokio to last version
* tor: send transaction with integrated client
* build: code format
* tor: optimize bootstrap percent check
* tor: handle config build error
* tor: do not show slatepack address if tor not launched
* tor: handle keystore errors
* tor: keep service launched
* tor: bootstrap timeout, clean cache before client launch
* tor: post request timeout
* fix: post timeout
* build: update deps after merge
* tor: store arti runtime
* tor: do not send over tor if `manual` arg presents or `skip_send_attempt` set at config
* fix: arg name
* tor: handle arti runtime creation error
* tor: handle connection error
* tor: handle bootstrap error
* tor: handle start service name error
* tor: handle service config creation error
* tor: service proxy errors
* tor: handle service key creation emptiness
* build: format code
* build: update arti to 0.43, hyper to 0.10.1
* api: start foreign listener before tor connection
* tor: handle json parse errors
* tor: prevent to create several client runtimes, ability to recreate
* tor: return bootstrap error
* tor: handle host parse error
* tor: restart proxy on error
* tor: do not use integrated client when config value use_integrated is missing, add logging
* build: update lock file
The separate contract_setup API was dropped in favor of contract_new/contract_sign.
Remove the two commented-out contract_setup stubs left in the owner RPC trait and
impl, and drop the README action-list items they (and earlier fixes) resolved: the
'remove setup API/CLI' item, the make_outputs-nanogrins item (now done), and the
move-test-utilities item (the per-scenario contract_*.rs tests already cover it).
Addresses PR #754 review (owner_rpc.rs, README.md).
When downgrading a payment proof with no sender address (current -> V5/V4) we emit
an all-zero placeholder key. Replace the speculative TODOs with the invariant: it
can never be accepted as a real sender because verification binds the sender
address into the signed message (contract::proofs::verify_promise_signature and
the legacy verify_payment_proof via payment_proof_message), so a proof only
validates against the address the verifier supplies.
Addresses PR #754 review (slate.rs).
contract view derived its result without checking the slate. Reject an Unknown
slate state and an out-of-range num_participants (mirroring context::create), so
a malformed or tampered slate can't feed a bogus view to a caller/UI. Also fix
num_sigs, which counted participants still missing a signature rather than the
signatures present.
Addresses PR #754 review (view.rs).
revoke builds the self-spend via new(), which used a random slate id, so a crash
between new() and sign() left an orphaned self-spend and a retry created another
one. Derive the self-spend slate id deterministically from the revoked slate
(blake2b, already a dependency) and let contract::new take an optional slate id;
a retry then reuses the in-progress context via get_or_create instead of
orphaning a fresh self-spend. The other new() caller passes None (random id).
Adds a unit test that the derived id is deterministic and distinct.
revoke cancels the original tx (unlocking its inputs) before the replacement
self-spend is built, and the steps commit separately, so a crash in between left
the inputs Unspent with no self-spend while a retry silently did nothing.
- Find the contributed inputs by tx id whether they are still Locked (original tx
active) or already Unspent (a prior revoke cancelled them but the self-spend did
not finish), instead of Locked-only.
- Cancel only when the tx is still in a cancellable state, so a resumed or repeated
revoke skips the cancel and re-spends the Unspent inputs.
- Once the self-spend completes the inputs reference its tx id, so a later revoke
is a no-op.
Adds a regression test that interrupts a revoke after the cancel and confirms the
next revoke resumes and produces the self-spend.
Addresses PR #754 review (revoke.rs).
save_step wrote the tx file (store_tx) before the atomic batch commit, so a DB
failure could leave the stored tx out of sync with wallet state. Move store_tx
to after batch.commit() (and after the post-commit signing-context check),
matching the core convention in internal::selection. #755 keeps stored txs as
files for all flows, so this reorder closes the desync window without diverging
from core.
Addresses PR #754 review (utils.rs).
The serde deserialize helpers copied fixed-length byte arrays
(b.copy_from_slice(&bytes[0..N])) without checking the decoded length, so a
slatepack with a short pubkey/signature/uuid field panicked the wallet during
deserialization. The binary path was hardened in 25dab9f; do the same for the
JSON modules: reject any field whose decoded length is not exactly N. Adds a
regression test that exercised the panic.
De-panic the contract paths flagged in review plus several found alongside them:
- new: use unsigned_abs (abs() panics on i64::MIN).
- proofs: surface InvoiceProof serialization errors instead of expect(); bounds-
check the participant index before indexing participant_data.
- utils/slate: propagate the error when a context input is missing from the db
instead of unwrapping.
- revoke: return an error when a locked input has no cached commitment.
- selection: checked i64/u64 conversions so large amounts can't wrap into a
wrong (possibly negative) change.
- types: checked sum of output amounts.
Addresses PR #754 review (new.rs, proofs.rs, utils.rs, selection.rs).
OutputSelectionArgs.make_outputs was a comma-separated grin string parsed inside
libwallet via amount_from_hr_string. Move that parsing to the CLI boundary and
carry explicit nanogrin u64 amounts through the API and Context instead:
- OutputSelectionArgs.make_outputs: Option<String> -> Option<Vec<u64>>;
output_amounts() becomes a plain accessor, num_custom_outputs() uses len().
- The CLI (wallet_args) parses grin -> nanogrin per amount; ContractNewArgs and
ContractSetupArgs carry Vec<u64> and copy it through.
- Update the two tests that supplied make_outputs as a string.
Addresses PR #754 review (types.rs, wallet_args.rs).
Reconcile the contract feature with #755, which replaced the WalletBackend
trait with a concrete WalletBackend<C,K> struct (libwallet/src/backend.rs) and
removed impls/src/backends/lmdb.rs.
- Port the contract module and contract API entry points from the trait form
(T: WalletBackend<'a,C,K>) to the concrete struct.
- Re-home next_child_for and a parent_id+log_id get_tx_log_entry onto backend.rs.
- Re-apply the self-spend tx-log filters, cancel-loop, v5 payment-proof fields,
and Context contract fields onto staging's rewritten files.
- Adapt to fallible iter()/tx_log_iter() and self-consuming batch commit.
Full suite green (53 binaries / 191 tests).
* wallet: update lmdb from store crate, migrate single backend from trait to struct, update tests cargo deps and design doc
* backend: do not panic on iter and directory creation
* return iterator errors
* build: update to last node revision
* fix: height selection for scan, remove unused mutability for wallet
* wallet: remove unused mutability conversion
* tx: store slate state at database
* build: cargo fmt
* fix: do not return error when slate not found on tx slate state update
* lmdb: do not collect all tx log records at iterator, show read errors at log
* fix: save slate state, return error if slate not found
* tx: specify amount of bad txs on slate state update error
---------
Co-authored-by: Joerg <wiesche89@googlemail.com>
Comment-only follow-ups to the review:
- selection: a negative change output is already rejected; drop the stale TODO.
- utils: note the per-participant kernel fee is rounded up (overpay bounded to
under one unit per participant), and that add_outputs/parent_key_id are handled
by the sign step and the stored Context.
- types: drop the "custom outputs imply payjoin" TODO; make_outputs is valid
without a payjoin (e.g. a receiver splitting its output), so the check would be
incorrect.
Addresses PR #754 review (selection.rs, utils.rs, types.rs).
Comment/doc cleanups from review; the only behavior-adjacent change is the
get_net_change signature.
- get_net_change takes the slate id instead of the whole slate.
- replace the owner-API contract methods' `/// TODO` placeholders with real docs.
- narrow or remove now-resolved TODOs (slate proof fns, context, utils stored_tx,
a doc-comment that should be //, wallet_args parse notes); reword the rest as
concrete FUTURE notes.
- prune the contract actions README of items already fixed.
Addresses PR #754 review (comment hygiene).
revoke left the canceled slate's private context in place when the contract
had not been signed (signing already deletes it). Look up the revoked slate id
from its tx log entry and delete the context after cancelling, if one still
exists. Resolves the stale revoke TODOs about the cancelled context.
Addresses PR #754 review (revoke.rs).
contract view hardcoded agreed_net_change to None. When a local context exists
we've agreed on the net change, so read it from the context and report it
(None when there's no context); other errors propagate.
Addresses PR #754 review (view.rs).
The separate contract_setup step is superseded by contract_sign, which runs
setup internally. Remove the dead commented-out function (libwallet, controller,
api), its CLI subcommand (grin-wallet.yml), and its dispatch arm (wallet_args).
The contract_sign path and the parse_contract_setup_args parser are unaffected.
Addresses PR #754 review (command.rs, owner.rs).
ContractNewArgsAPI and ContractView carried a target_slate_version that was only
ever None and never read; the emitted slatepack version is chosen from the slate
content. Remove it. The legacy InitTxArgs/IssueInvoiceTxArgs fields are unrelated
and untouched.
Addresses PR #754 review (types.rs).
Adds the two regression tests requested in review:
- verify_selection_consistency: same/default args are accepted; changed
non-default args after setup are rejected.
- my_fee_contribution: a single participant pays the whole kernel cost, two
participants each pay ceil(kernel/2), and the shares cover the full cost.
Also resolves the related TODOs (selection.rs "test that this works",
utils.rs fee-encoding compatibility note).
Addresses PR #754 review (selection.rs, utils.rs).
add_keys added our participant info without checking the slate wasn't already
full, so a tampered slate could exceed num_participants. Block adding when the
participant set is already full and we aren't already in it (re-adding our own
info stays idempotent).
Addresses PR #754 review (slate.rs).
generate_invoice_signature derived the receiver's proof address from the active
account's parent key. Like the output-derivation fix, use context.parent_key_id
so the proof address belongs to the contract's account, not whatever account is
active.
Addresses PR #754 review (proofs.rs, utils.rs).
The committed-fee-exceeded check returned a GenericError. Use the existing
Error::Fee variant and fold the "cancel and retry" hint into the message.
Addresses PR #754 review (selection.rs).
A large u64 amount could wrap when cast `as i64`. Convert with i64::try_from in
the CLI net-change derivation and in contract view, returning an error instead.
get_net_change / to_api_args now return Result (the two arg panics become
errors too), and the to_api_args call moves out of the owner-session closure.
Addresses PR #754 review (command.rs, view.rs).
num_participants is divided into the kernel cost, so 0 caused a divide-by-zero
(inf -> garbage fee). Validate it in context::create, the common setup path for
every party: the initiator's value comes from args and the signer's from the
slate, so this also rejects a tampered slate. Only 1 (self-spend) and 2
(standard) are supported today; lift the upper bound when multi-party contracts
are implemented.
Addresses PR #754 review (wallet_args.rs:1039).
jwinterm