Repository navigation
fix: close private order and delivery account-scope bypass before market integration - #120
LIghtJUNction wants to merge 6 commits into
Conversation
Reuse account_requirements before cached results. Preserve public dispute summaries, published contracts and current buyer/seller/panel checks. Local Python3.13.5/PostgreSQL15.19: 14 denied-operation regressions fail before the fix; 141 focused tests pass after. Exact target CI still required. Refs #71, #76, #81, #85.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
继续审查发现新CLI映射缺陷，下一提交仅在本分支修复：6个广告中的orders操作名未注册，store.package_get也错误传package_id。旧模拟客户端测试接受任意名称，没有验证Registry。 修正pay→orders.fund、dispute→orders.dispute_open（保留reason JSON）、resolve→orders.dispute_execute（必须case/已签决议）；移除不存在的refund/history/recipient-key快捷命令，提供真实contract/case读取，包读取使用id。新增显式--contract-version保留v1默认/money.redeem@2，不静默换版本。真实签名+PG回归先复现unknown_operation/schema不匹配，再校验付款/争议执行及重放；合法公开投影不冒充完整签署契约摘要。 同时纠正MARKET_CLEARING旧文档中不存在的policy/操作名、已完成#74/#75被写为缺失和“删restore标记可放行”的错误表述。生产恢复闸、自动/显式验收版本和完整CI断言均不改。当前141项账户范围回归仍保留，新的组合正在本机运行；原4299的CI不能替代后续head。 |
Stage verified source only; exact target CI required before merge. No production or collaborator branch changes.
|
最终补丁已通过普通fast-forward推送至本PR：head 新增CLI修复5文件：正确fund/dispute_open/dispute_execute与package id、显式版本、真实contract/case读取；去掉未注册快捷入口。真实Registry+签名执行器+PG回归替代仅模拟客户端的错误信心。修正bootstrap中不存在的managed-instant-v1默认策略名；仅元数据改为实际escrow-v1，不改变历史政策。指南同步真实v1/v2/v3、既有邮件/仲裁和严格恢复隔离，@4仍不冒称落地。 本地 Python3.13.5/PG15.19：账户+CLI+既有订单/交付/仲裁/通知合跑 154 passed/0 failed/error/skipped（164.20s，JUnit SHA25632666c46c9916deef4132dca5bb44e2d1560a7d91ca40a5cf66a11a36ce52bdd）；最后单行bootstrap修复后，最终CLI/默认+既有contracts 26 passed（43.44s，JUnit SHA2567d960a39cd15ec98b20ff1b0510585d354275cd56e05a74c3c81cb5e6866f906）。两组有重叠，不相加。编译、diff-check和新增测试Ruff通过；仍须39d699精确head的四分片/node-ID/conformance/build/recovery和review。 @codex review |
Correct the selftest description against check_market_e2e: it exercises published orders.buy@2 with package_digest/auto_accept, while market_lifecycle independently covers v3. Production source and tests unchanged; new default signed-acceptance version remains pending.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39d6992619
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 'create':('orders.create','json'), 'buy':('orders.buy','json'), | ||
| 'pay':('orders.fund','json'), 'get':('orders.get','order_id'), | ||
| 'list':('orders.list','json'), 'payment':('orders.payment','order_id'), | ||
| 'cancel':('orders.cancel','order_id'), 'contract':('orders.contract','order_id'), |
There was a problem hiding this comment.
When a user runs msg orders create ... and then msg orders cancel <id> without a version flag, run_command leaves the version unset, so MsgClient invokes orders.cancel@1. The create shortcut produces an order with an order_contracts row, which the v1 escrow handler rejects with order_contract_requires_v3; only orders.cancel@2 handles these current orders. Consequently, the advertised default shortcut cannot cancel orders created or funded through the adjacent CLI shortcuts unless users know to add --contract-version 2; this action should default to v2 while still honoring an explicit override.
Useful? React with 👍 / 👎.
Serial integration and scope
Refs #71, #72, #76, #78, #79, #81, #82, #83, #85. Includes #119's exact
0c6ca7cf8262e1b70f96fb3fb18d64a88a8e299bplus one narrow account-boundary fix, retaining its ancestry. This does not close umbrella or production acceptance issues.Published head 4299aca, expected complete tree 14e27437b1aa7df51096b30db6e11cc4cb84c6fd. Local code tree is identical; only commit metadata differs from local 78ffecd1. Main at preparation: 45fe238.
Reproduced security defect
A real registered Ed25519 subkey scoped only to
t_storecould buy using its owner's balance, access private orders/deliveries and submit acceptance. An already successful request also remained replayable after the same key lost account scope. Existing money balance/redeem guards did not cover order/delivery registrations.Corrected fixture inputs on unmodified 0c6ca7c: 14 tests failed because each prohibited request returned status=ok, not because of missing dependencies, invalid schema or unexpected exceptions.
Minimal implementation
plugins/orders.pyandplugins/delivery.pyusefunctools.partialto reuse the existingaccount_requirementsfor every private operation/version, before the executor reads cached results. No new manager, authorization engine or database table.market/arbitration.pyexplicitly preservesno_requirementsfor the deliberately public minimalorders.dispute_summary. Current buyer/seller/panel/listing checks still apply; owning the subject account does not bypass them.Local evidence (not target CI)
Python 3.13.5, real disposable PostgreSQL 15.19 UTF-8, actual Ed25519/age and HTTP adapters:
Publication run36411366349 only transported the SHA-256-pinned patch and checked the full tree before a normal push to this dedicated branch. The temporary workflow/encoded patch and offline asset tooling are not in this feature branch or PR. No collaborator ref was modified or force-pushed.
No deployment, production Root/PIN/keys/funding/recovery/deletion or real external delivery. New default signed-acceptance @4, full market model convergence and field acceptance remain separately tracked; this fix must not be presented as those features.