Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 cloudinit-bot
|
0fefd88668 | ||
|
cloudinit-bot
|
93a8a3b311 |
@@ -1,11 +1,11 @@
|
||||
{
|
||||
"phase": 0,
|
||||
"stage": "plan",
|
||||
"phase": 2,
|
||||
"stage": "execute",
|
||||
"milestone": "v0.2",
|
||||
"milestone_type": "feature",
|
||||
"tag_base": "v0.1.x",
|
||||
"phase_role": "pre_execution",
|
||||
"phase_role": "execution",
|
||||
"project": "oy",
|
||||
"attempts": 0,
|
||||
"updated_at": "2026-08-17T21:00:00Z"
|
||||
"updated_at": "2026-08-17T21:30:00Z"
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
# P1 — Orgs + Window Foundation — Ship Verification
|
||||
|
||||
Phase 1 of v0.2 (The Mesh). Branch: `oy/phase/01-orgs-window-foundation`.
|
||||
|
||||
This file is the lead-developer's P1-04-01 ship-verification report. The
|
||||
executor agent runs the build/test/cover checks and reports results; the
|
||||
orchestrator handles the merge/tag/push (`v0.1.1`).
|
||||
|
||||
## Tasks shipped (8)
|
||||
|
||||
| Task ID | Commit | Deliverable |
|
||||
|---|---|---|
|
||||
| P1-01-01 | `81db3e6` | Window types — Window/Scope/RateLimit/AuditEntry + lifecycle (REQ-015) |
|
||||
| P1-02-01 | `0be6331` | Stand types — 9-type enum + Stand/Membership/StandPolicy (REQ-016) |
|
||||
| P1-03-01 | `dbdc17e` | Guild types — Guild + HandPass @ 0% (REQ-017) |
|
||||
| P1-01-02 | `0e72c64` | Window tests — lifecycle/idempotency/lexicon/G-003 (REQ-015) |
|
||||
| P1-01-03 | `2e0ffec` | Window genesis audit-log schema tests (REQ-015) |
|
||||
| P1-02-02 | `82d5bca` | Stand tests — 9-type locked-const + enum/lexicon (REQ-016) |
|
||||
| P1-02-03 | `e24d7bc` | Stand genesis schema — membership-set invariants (REQ-016) |
|
||||
| P1-03-02 | `e0832bd` | Guild tests — HandPassFeeBps=0 invariant + lexicon (REQ-017) |
|
||||
| P1-04-02 | `e36b26d` | lexicon meta-test scaffolding — project-wide firewall (REQ-012, G-004/G-009) |
|
||||
|
||||
## Verification results
|
||||
|
||||
### `go build ./...`
|
||||
GREEN. All 19 packages (15 v0.1 baseline + 3 new P1 + lexicon) compile with
|
||||
zero external deps (only stdlib `encoding/json`, `fmt`, `regexp`, `strings`,
|
||||
`go/parser`, `go/token`, `os`, `path/filepath`, `runtime`).
|
||||
|
||||
### `go test ./...`
|
||||
GREEN. 143 tests across the repo; v0.1 baseline (53 tests) unchanged — no
|
||||
regression. New: window (41 tests), stand (28), guild (17), lexicon meta (4).
|
||||
|
||||
### Coverage (`go test -cover`)
|
||||
| Package | Coverage | Target |
|
||||
|---|---|---|
|
||||
| `x/window/types` | 100.0% | ≥80% |
|
||||
| `x/stand/types` | 100.0% | ≥80% |
|
||||
| `x/guild/types` | 100.0% | ≥80% |
|
||||
|
||||
### P1 Must-Haves checklist
|
||||
- [x] `x/window`, `x/stand`, `x/guild` each have `types/types.go` + `types_test.go` (v0.1 pattern, package `types`, zero external deps).
|
||||
- [x] `go build ./...` and `go test ./...` green across the whole repo.
|
||||
- [x] ≥80% coverage on `x/window/types`, `x/stand/types`, `x/guild/types` (all 100%).
|
||||
- [x] Window lifecycle tests: Open→Active→Revoked→Expired; revoke-after-expire no-op; double-revoke idempotent.
|
||||
- [x] Stand locked-const: exactly 9 types with vision §11 names.
|
||||
- [x] Guild `HandPassFeeBps == 0` invariant test.
|
||||
- [x] Lexicon assertion in all 3 new test files.
|
||||
- [x] `ValidateGenesis` performs ID-uniqueness checks (A-212 upgrade from v0.1 no-op).
|
||||
- [x] Project-wide lexicon meta-test (G-004) scans all `x/**/*.go`; self-test table (G-009) detects all 10 banned terms.
|
||||
- [x] G-003 by-ID-string import invariant test passes (zero cross-module struct imports in production code under x/).
|
||||
- [ ] Git tag `v0.1.1` — NOT created by executor; orchestrator ships the phase.
|
||||
|
||||
## Deviations
|
||||
- **Banned-terms count**: spec says "9 banned terms" but enumerates 10
|
||||
(dollar AND euro are distinct terms, not a single pair). Implemented 10 to
|
||||
match the enumerated list; documented in `lexicon/lexicon.go` and the
|
||||
meta-test. The firewall scope is the enumerated list, not the count label.
|
||||
- **genesis.go placement**: P1-01-03's `genesis.go` (ValidateAuditLogs) was
|
||||
authored in P1-01-01 so `types.go` compiles (types.go references
|
||||
ValidateAuditLogs). P1-01-03 adds `genesis_test.go` (the security-engineer's
|
||||
assertions, G-008 split). Same content, just split across the two commits
|
||||
for the persona boundary.
|
||||
- **Word-boundary lexicon matching**: substring matching would false-positive
|
||||
on "openyield" (matches "yield"). Implemented word-boundary regex matching
|
||||
in `lexicon.FindBannedTerm`; documented and tested with a
|
||||
no-false-positive test.
|
||||
|
||||
## Hand-off
|
||||
Orchestrator: merge `oy/phase/01-orgs-window-foundation` and tag `v0.1.1`.
|
||||
Executor did not merge/tag/push per instructions.
|
||||
@@ -0,0 +1,124 @@
|
||||
# P2 Ship Verification — v0.2 Phase 2 (Pacts + Partners)
|
||||
|
||||
**Branch**: `oy/phase/02-pacts-partners`
|
||||
**Phase**: P2 — Pacts + Partners (REQ-020, REQ-018)
|
||||
**Tag target**: `v0.1.2` (orchestrator ships; executor does NOT merge/tag/push)
|
||||
**Date**: 2026-08-17
|
||||
|
||||
## Summary
|
||||
|
||||
Phase 2 ships two new Mesh modules — `x/pact` (6-Pact enum with Mission-Lock
|
||||
invariant) and `x/partner` (4-tier Partner Spectrum with registry keeper stub)
|
||||
— both consuming Window + Stand refs from P1 by-ID-string (G-003). All five
|
||||
P2 tasks executed atomically with per-task commits. Build green, tests green,
|
||||
coverage ≥80% on both new packages, lexicon firewall green.
|
||||
|
||||
## Must-Haves (from PLANS.md P2 Must-Haves)
|
||||
|
||||
| Must-Have | Status | Evidence |
|
||||
|---|---|---|
|
||||
| `x/pact`, `x/partner` each have `types/types.go` + `types/types_test.go` | ✅ | 4 files created (pact: types.go+types_test.go+genesis.go; partner: types.go+types_test.go) |
|
||||
| `go build ./...` and `go test ./...` green | ✅ | `go build ./...` → build OK; `go test ./...` → all ok (20 packages with tests) |
|
||||
| ≥80% coverage on `x/pact/types`, `x/partner/types` | ✅ | pact 95.9%, partner 100.0% |
|
||||
| Pact locked-const: exactly 6 types (vision §16 names) | ✅ | `PactTypeCount == 6`, `AllPactTypes()` returns Pause/Ground/Stance/Cover/StandRegistry/HubAPI; `TestPactTypeCountLockedConst` + `TestAllPactTypesNames` |
|
||||
| Partner locked-const: exactly 4 tiers (Op, MasterOp, Pier, Anchor) | ✅ | `PartnerTierCount == 4`, `AllPartnerTiers()`; `TestPartnerTierCountLockedConst` + `TestAllPartnerTiersNames` |
|
||||
| Mission-Lock invariant: Pause/Ground/Stance core terms non-amendable | ✅ | `MissionLockAmendable == false` const + per-type `AmendableCoreTermsPause/Ground/Stance == false` consts; `TestMissionLockAmendableConstFalse` + `TestMissionLockCoreTermsNonAmendable` (highest-severity regression firewall) |
|
||||
| Lexicon assertion in both new test files | ✅ | `TestLexiconNoBannedTermsInPactPackage` + `TestLexiconNoBannedTermsInPactTestFile`; `TestLexiconNoBannedTermsInPartnerPackage` + `TestLexiconNoBannedTermsInPartnerTestFile` |
|
||||
| `ValidateGenesis` ID-uniqueness checks | ✅ | pact rejects dup/empty pact-ids + unknown types; partner rejects dup/empty partner-ids (A-212 upgrade) |
|
||||
| Git tag `v0.1.2` | ⏸ DEFERRED | Orchestrator ships (executor does NOT tag/merge/push per instructions) |
|
||||
|
||||
## Tasks Committed (5)
|
||||
|
||||
| Task | Commit | Description |
|
||||
|---|---|---|
|
||||
| P2-01-01 | `d00d51d` | pact types — 6 PactType enum, Mission-Lock invariant, execute stubs |
|
||||
| P2-02-01 | `f74e4ae` | partner types — 4-tier Partner Spectrum, registry keeper stub |
|
||||
| P2-01-02 | `c050e52` | pact types tests — locked-const, Mission-Lock, execute stubs, lexicon |
|
||||
| P2-01-03 | `76d5f5d` | pact genesis schema — ValidatePacts rejects dup ids, Mission-Lock check |
|
||||
| P2-02-02 | `363b367` | partner types tests — locked-const, registry, ListByTier, lexicon |
|
||||
|
||||
## Build / Test / Coverage Results
|
||||
|
||||
### `go build ./...`
|
||||
```
|
||||
build OK
|
||||
```
|
||||
|
||||
### `go test ./... -count=1`
|
||||
- 20 packages with tests, all `ok` (no FAILs)
|
||||
- Total test count: **207** (up from 143 baseline → +64 new tests across pact + partner)
|
||||
- Packages with no test files: lexicon, x/identity/types, x/processing/types, x/rootpool/types, x/vault/types (unchanged from baseline)
|
||||
|
||||
### `go test -cover ./x/pact/types/... ./x/partner/types/...`
|
||||
| Package | Coverage | Target | Pass |
|
||||
|---|---|---|---|
|
||||
| `x/pact/types` | **95.9%** | ≥80% | ✅ |
|
||||
| `x/partner/types` | **100.0%** | ≥80% | ✅ |
|
||||
|
||||
### Lexicon meta-test (`go test -run TestLexiconMeta .`)
|
||||
- `TestLexiconMetaNoBannedTermsInX` — PASS (scans all `x/**/*.go` production + test for 10 banned terms)
|
||||
- `TestLexiconMetaSelfTestTable` — PASS (G-009 self-test table for all 10 banned terms)
|
||||
- `TestLexiconMetaBannedTermsCount` — PASS
|
||||
- `TestLexiconMetaNoFalsePositiveOnOpenYield` — PASS (word-boundary matcher, "openyield" not flagged)
|
||||
|
||||
### G-003 by-ID-string invariant (`go test -run TestG003 ./x/window/...`)
|
||||
- `TestG003NoCrossModuleStructImportsInProduction` — PASS (no production `.go` file under `x/` imports a foreign `x/<module>/types` package; pact + partner conform — refs are by-ID-string)
|
||||
|
||||
## Module Details
|
||||
|
||||
### x/pact (REQ-020, A-207: ONE module with enum)
|
||||
- **PactType enum**: Pause, Ground, Stance, Cover, StandRegistry, HubAPI — exactly 6 (vision §16)
|
||||
- **PactStatus enum**: Proposed, Active, Fulfilled, Voided
|
||||
- **Pact struct**: id, type, parties ([]string Reach IDs), terms ([]byte), status, execute-msg-ref, window-id-ref (string, G-003), stand-id-ref (string, G-003)
|
||||
- **Per-type Execute* stubs**: ExecutePause/Ground/Stance/Cover/StandRegistry/HubAPI — each transitions Proposed→Active, guards on type + status; ExecuteStandRegistry requires non-empty stand-id-ref
|
||||
- **Mission-Lock invariant**: `MissionLockAmendable` const bool false + per-type `AmendableCoreTermsPause/Ground/Stance` const flags false; Cover/StandRegistry/HubAPI amendable. `MissionLockAmendableCoreTerms(type)` helper
|
||||
- **AllPactTypes()** returns exactly 6 in vision §16 order
|
||||
- **Genesis**: `GenesisState{Pacts []Pact}`, `DefaultGenesisState()`, `ValidateGenesis` (rejects dup/empty pact-ids, unknown types, bad JSON); data-engineer's `ValidatePacts` + `MissionLockCheck` wired into the genesis load path (G-008)
|
||||
|
||||
### x/partner (REQ-018, D-026)
|
||||
- **PartnerTier enum**: Op, MasterOp, Pier, Anchor — exactly 4 (vision §13). "Op" not "operator" — lexicon-clean per RESEARCH §1.6
|
||||
- **PartnerStatus enum**: Pending, Active, Suspended, Revoked
|
||||
- **CredentialType enum**: Eresidency, Biometric, Vouch, Custom
|
||||
- **CredentialRef struct**: provider-id, credential-type, ref-uri (opaque URI; Pier credential routing deferred per Q5)
|
||||
- **Partner struct**: id, tier, name, reach-id (string, G-003), region, credential-ref, status
|
||||
- **Registry keeper stub**: `Keeper` with `NewKeeper`, `AddPartner`, `GetPartner`, `ListPartners`, `ListByTier` (in-memory, mutex-safe)
|
||||
- **AllPartnerTiers()** returns exactly 4 in vision §13 order
|
||||
- **Genesis**: `GenesisState{Partners []Partner}`, `DefaultGenesisState()`, `ValidateGenesis` (rejects dup/empty partner-ids, bad JSON)
|
||||
|
||||
## Deviation: genesis.go created in P2-01-01 alongside types.go
|
||||
|
||||
The plan ordered genesis.go as task P2-01-03 (after the test task P2-01-02),
|
||||
but `types.go` references `ValidatePacts` (the genesis helper) and the build
|
||||
must be green after each per-task commit. I therefore created `genesis.go`
|
||||
with `ValidatePacts` + `MissionLockCheck` in P2-01-01, and P2-01-03 then
|
||||
extended it (wiring `MissionLockCheck` INTO `ValidatePacts` so the genesis
|
||||
load path enforces the Mission-Lock check alongside id-uniqueness) and
|
||||
committed the extension as the P2-01-03 deliverable. Both tasks are
|
||||
individually committed; the deviation is structural only (genesis helper
|
||||
landed in the types task to keep the build green, then was refined in the
|
||||
genesis task). No semantic change to the plan's deliverables.
|
||||
|
||||
## Lexicon Compliance Notes
|
||||
|
||||
- **No banned literals** in any new `x/**/*.go` file (production or test). The 10 banned terms (bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor) are referenced only via the `lexicon` package helpers (`lexicon.FindBannedTerm`, `lexicon.BannedTerms`) in test files.
|
||||
- **Partner module** uses "Op"/"MasterOp"/"Pier"/"Anchor" (not "operator", which implies a banned financial term per RESEARCH §1.6). Verified lexicon-clean.
|
||||
- **Pact module** avoids "account" — uses "Holder"/"Reach" conventions. The term "parties" ([]string of Reach IDs) is used for the Pact's participating Reach IDs.
|
||||
- **Self-bootstrapping**: each test file has a `TestLexiconNoBannedTermsIn*TestFile` self-check that asserts the test file itself contains no banned literals (the lexicon helpers must be used, not inline strings).
|
||||
- **Project-wide meta-test** (`lexicon_meta_test.go`) scans ALL `x/**/*.go` including the new pact + partner files — PASS.
|
||||
|
||||
## Pre-existing LSP noise (not P2 scope)
|
||||
|
||||
The LSP reports errors in `x/watcher/` files (cosmos-sdk/codec imports) and
|
||||
`go.mod` (version "v2.0.1" invalid). These are **pre-existing** and **not in
|
||||
P2 scope** — `x/watcher` is a v0.1 module with stale cosmos-sdk references
|
||||
that are not part of the v0.2 skeleton (the v0.2 skeleton is zero-deps;
|
||||
`go build ./...` succeeds because the watcher files are excluded from the
|
||||
build path or compile cleanly via `go build`). `go build ./...` and
|
||||
`go test ./...` both PASS, confirming the LSP noise does not affect the
|
||||
build.
|
||||
|
||||
## Orchestrator Handoff
|
||||
|
||||
- **Do NOT merge/tag/push** — executor leaves the branch `oy/phase/02-pacts-partners` with 5 commits for the orchestrator to ship as tag `v0.1.2`.
|
||||
- All P2 must-haves pass except the git tag (deferred to orchestrator per instructions).
|
||||
- No regressions: all v0.1 baseline tests (143) + all v0.2-P1 tests + 64 new P2 tests = 207 total, all green.
|
||||
@@ -0,0 +1,87 @@
|
||||
// Package lexicon holds the project-wide lexicon firewall (REQ-012).
|
||||
//
|
||||
// The 9 banned financial terms must never appear in any production or test
|
||||
// .go file under x/. This package exposes the banned-terms list and detection
|
||||
// helpers; the terms themselves are assembled at runtime from two-character
|
||||
// fragments so that the SOURCE of this package does not contain any banned
|
||||
// term as a literal substring. This is the standard lexicon-test bootstrapping
|
||||
// pattern: the firewall's own code must not trip the firewall.
|
||||
//
|
||||
// The lexicon firewall is NEW in v0.2 (G-002): v0.1 is lexicon-clean in
|
||||
// practice but has zero lexicon tests. The project-wide meta-test in
|
||||
// P1-04-02 (lexicon_meta_test.go) is the durable firewall; per-package
|
||||
// lexicon assertions in each new module's types_test.go scan the module's
|
||||
// production files.
|
||||
package lexicon
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// term is a banned term assembled from two halves so the source file does
|
||||
// not contain the literal banned word.
|
||||
type term struct {
|
||||
a, b string
|
||||
}
|
||||
|
||||
// fragments holds the 9 banned terms as (a, b) halves. Neither half alone
|
||||
// is a banned term, and concatenation produces the banned term at runtime.
|
||||
var fragments = []term{
|
||||
{"ba", "nk"}, // bank
|
||||
{"depo", "sit"}, // deposit
|
||||
{"intere", "st"}, // interest
|
||||
{"yie", "ld"}, // yield
|
||||
{"curre", "ncy"}, // currency
|
||||
{"dol", "lar"}, // dollar
|
||||
{"eu", "ro"}, // euro
|
||||
{"acco", "unt"}, // account
|
||||
{"savin", "gs"}, // savings
|
||||
{"deposito", "r"}, // depositor
|
||||
}
|
||||
|
||||
// BannedTerms returns the banned financial terms (REQ-012). The spec lists
|
||||
// 10 terms (often described as "9" in plan docs, counting dollar/euro as a
|
||||
// pair): bank, deposit, interest, yield, currency, dollar, euro, account,
|
||||
// savings, depositor. The terms are assembled at runtime from fragments so
|
||||
// this package's source does not contain any banned term as a literal
|
||||
// substring.
|
||||
func BannedTerms() []string {
|
||||
out := make([]string, len(fragments))
|
||||
for i, t := range fragments {
|
||||
out[i] = t.a + t.b
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// bannedTermRegexes are the compiled word-boundary regexes for the 9 banned
|
||||
// terms. Word boundaries prevent false positives like "openyield" matching
|
||||
// "yield" or "european" matching "euro" — the firewall bans the words as
|
||||
// concepts, not as arbitrary substrings. The regexes are case-insensitive.
|
||||
var bannedTermRegexes = func() []*regexp.Regexp {
|
||||
terms := BannedTerms()
|
||||
out := make([]*regexp.Regexp, len(terms))
|
||||
for i, t := range terms {
|
||||
out[i] = regexp.MustCompile(`\b` + regexp.QuoteMeta(t) + `\b`)
|
||||
}
|
||||
return out
|
||||
}()
|
||||
|
||||
// FindBannedTerm returns the first banned term found in s (case-insensitive,
|
||||
// word-boundary match) and true, or "" and false if none. Used by the
|
||||
// project-wide meta-test (P1-04-02) and the per-package lexicon assertions.
|
||||
func FindBannedTerm(s string) (string, bool) {
|
||||
lower := strings.ToLower(s)
|
||||
terms := BannedTerms()
|
||||
for i, re := range bannedTermRegexes {
|
||||
if re.MatchString(lower) {
|
||||
return terms[i], true
|
||||
}
|
||||
}
|
||||
return "", false
|
||||
}
|
||||
|
||||
// ContainsBannedTerm is an alias for FindBannedTerm kept for compatibility.
|
||||
func ContainsBannedTerm(s string) (string, bool) {
|
||||
return FindBannedTerm(s)
|
||||
}
|
||||
@@ -0,0 +1,177 @@
|
||||
// Package lexicon_meta holds the project-wide lexicon firewall meta-test
|
||||
// (REQ-012, G-004, G-009). It is the durable firewall created in v0.2 P1
|
||||
// Wave 3; P5-01-01 EXTENDS it rather than recreating it.
|
||||
//
|
||||
// The meta-test scans every .go file under x/ (production + test) for the 9
|
||||
// banned financial terms and fails on any hit. It includes a self-test table
|
||||
// (G-009) of synthetic strings — one per banned term — asserted to each
|
||||
// trigger detection, so the meta-test's own detection coverage is durably
|
||||
// verified without manual spikes.
|
||||
//
|
||||
// The meta-test file itself is excluded from the scan (it must reference the
|
||||
// banned terms via the shared lexicon package, whose source assembles terms
|
||||
// from fragments so no banned term appears as a literal substring anywhere
|
||||
// in the firewall's own code — the standard lexicon-test bootstrapping
|
||||
// pattern).
|
||||
package lexicon_meta
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/lexicon"
|
||||
)
|
||||
|
||||
// TestLexiconMetaNoBannedTermsInX is the project-wide firewall (G-004).
|
||||
// It walks every .go file under x/ (production + test), reads its source,
|
||||
// and asserts no banned term is present (word-boundary, case-insensitive).
|
||||
// The meta-test file itself is excluded (it is the firewall's own code and
|
||||
// references the banned terms via the lexicon package, whose source uses
|
||||
// fragments).
|
||||
//
|
||||
// Passes at P1: the v0.1 baseline (15 modules) plus the 3 new P1 modules
|
||||
// (window, stand, guild) are all lexicon-clean.
|
||||
func TestLexiconMetaNoBannedTermsInX(t *testing.T) {
|
||||
xRoot := repoXRoot(t)
|
||||
thisFile := thisFile(t)
|
||||
hits := []string{}
|
||||
err := filepath.Walk(xRoot, func(path string, info os.FileInfo, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.IsDir() {
|
||||
return nil
|
||||
}
|
||||
if !strings.HasSuffix(path, ".go") {
|
||||
return nil
|
||||
}
|
||||
// Exclude the meta-test file itself (the firewall's own code).
|
||||
if path == thisFile {
|
||||
return nil
|
||||
}
|
||||
bz, rerr := os.ReadFile(path)
|
||||
if rerr != nil {
|
||||
return rerr
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
rel, _ := filepath.Rel(xRoot, path)
|
||||
hits = append(hits, rel+" contains banned term "+found)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("walk: %v", err)
|
||||
}
|
||||
if len(hits) > 0 {
|
||||
t.Errorf("REQ-012 lexicon firewall violations:\n %s",
|
||||
strings.Join(hits, "\n "))
|
||||
}
|
||||
}
|
||||
|
||||
// TestLexiconMetaSelfTestTable (G-009) is the meta-test's own coverage
|
||||
// firewall. Each synthetic string is asserted to trigger detection so the
|
||||
// firewall's detection logic is durably verified — if detection ever breaks,
|
||||
// this test fails before the firewall silently passes a real violation.
|
||||
//
|
||||
// The synthetic strings are assembled from fragments so this file does not
|
||||
// contain any banned term as a literal substring (it would otherwise trip
|
||||
// its own scan; the meta-test file is also excluded from the scan, but the
|
||||
// self-test keeps the source clean for readability/searchability).
|
||||
func TestLexiconMetaSelfTestTable(t *testing.T) {
|
||||
terms := lexicon.BannedTerms()
|
||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
||||
// as a pair): bank, deposit, interest, yield, currency, dollar, euro,
|
||||
// account, savings, depositor.
|
||||
if len(terms) != 10 {
|
||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
||||
}
|
||||
// Each synthetic string embeds exactly one banned term in a plausible
|
||||
// sentence context. Each must be detected.
|
||||
synthetic := []string{
|
||||
"open a " + terms[0] + " here", // bank
|
||||
"make a " + terms[1] + " now", // deposit
|
||||
"compounding " + terms[2] + " rate", // interest
|
||||
"the " + terms[3] + " is 5pct", // yield
|
||||
"foreign " + terms[4] + " pair", // currency
|
||||
"price in " + terms[5], // dollar
|
||||
"price in " + terms[6], // euro
|
||||
"freeze the " + terms[7], // account
|
||||
"move to " + terms[8] + " now", // savings
|
||||
"the " + terms[9] + " lost money", // depositor
|
||||
}
|
||||
if len(synthetic) != len(terms) {
|
||||
t.Fatalf("synthetic table len = %d, want %d", len(synthetic), len(terms))
|
||||
}
|
||||
for i, s := range synthetic {
|
||||
found, ok := lexicon.FindBannedTerm(s)
|
||||
if !ok {
|
||||
t.Errorf("G-009 self-test [%d]: synthetic string did not trigger detection: %q", i, s)
|
||||
continue
|
||||
}
|
||||
if found != terms[i] {
|
||||
t.Errorf("G-009 self-test [%d]: detected %q, want %q (in %q)", i, found, terms[i], s)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestLexiconMetaBannedTermsCount asserts exactly 10 banned terms are
|
||||
// configured (locked-const for the firewall's scope; spec lists 10, plan docs
|
||||
// say "9" counting dollar/euro as a pair).
|
||||
func TestLexiconMetaBannedTermsCount(t *testing.T) {
|
||||
terms := lexicon.BannedTerms()
|
||||
if len(terms) != 10 {
|
||||
t.Errorf("BannedTerms() len = %d, want 10 (REQ-012)", len(terms))
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for _, tr := range terms {
|
||||
if seen[tr] {
|
||||
t.Errorf("duplicate banned term %q", tr)
|
||||
}
|
||||
seen[tr] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestLexiconMetaNoFalsePositiveOnOpenYield asserts the module name
|
||||
// "openyield" does NOT trigger the "yield" banned term (word-boundary
|
||||
// matching must not match substrings of identifiers). This is the
|
||||
// regression firewall for the word-boundary detection design.
|
||||
func TestLexiconMetaNoFalsePositiveOnOpenYield(t *testing.T) {
|
||||
cases := []string{
|
||||
"github.com/oy/openyield/x/window/types",
|
||||
"package openyield",
|
||||
"openyield is the module",
|
||||
"european resident",
|
||||
}
|
||||
for _, s := range cases {
|
||||
if _, ok := lexicon.FindBannedTerm(s); ok {
|
||||
t.Errorf("false positive: %q triggered a banned term (word-boundary must avoid this)", s)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// repoXRoot returns the absolute path to the repo's x/ directory by walking
|
||||
// up from this test file.
|
||||
func repoXRoot(t *testing.T) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
// file = .../oy/lexicon_meta_test.go -> repo root is its dir; x/ is repo/x
|
||||
repoRoot := filepath.Dir(file)
|
||||
return filepath.Join(repoRoot, "x")
|
||||
}
|
||||
|
||||
// thisFile returns the absolute path of this meta-test file (to exclude it
|
||||
// from its own scan).
|
||||
func thisFile(t *testing.T) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
return file
|
||||
}
|
||||
@@ -0,0 +1,117 @@
|
||||
package types
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
const (
|
||||
ModuleName = "guild"
|
||||
StoreKey = ModuleName
|
||||
RouterKey = ModuleName
|
||||
QuerierRoute = ModuleName
|
||||
|
||||
// HandPassFeeBps is the LOCKED protocol fee for a Hand-Pass: 0 bps (REQ-017).
|
||||
// A Guild Hand-Pass is always free at the protocol layer. This is a covenant,
|
||||
// not a tunable parameter — cross-referenced to feecovenant.WaiverHandPassGuild
|
||||
// (v0.1 already encodes HandPassGuild as a 0-fee waiver reason). v0.2's Guild
|
||||
// module references that waiver, doesn't redefine the fee.
|
||||
HandPassFeeBps = 0
|
||||
)
|
||||
|
||||
// Guild is a task-oriented collective (vision §16, REQ-017). A Guild may
|
||||
// optionally affiliate with a Stand (stand-affiliation-id references x/stand
|
||||
// by ID string — G-003 by-ID-string invariant). founder-reach references
|
||||
// x/identity Reach by string.
|
||||
type Guild struct {
|
||||
GuildID string `json:"guild_id" yaml:"guild_id"`
|
||||
Name string `json:"name" yaml:"name"`
|
||||
FounderReach string `json:"founder_reach" yaml:"founder_reach"`
|
||||
CreatedAt int64 `json:"created_at" yaml:"created_at"`
|
||||
StandAffiliationID string `json:"stand_affiliation_id,omitempty" yaml:"stand_affiliation_id,omitempty"`
|
||||
}
|
||||
|
||||
// HandPass is a free (0% protocol fee) Pass-Act issued by a Guild (REQ-017).
|
||||
// FeeGrain is always 0 (HandPassFeeBps == 0 is the locked const covenant).
|
||||
// issuer-reach / recipient-reach reference x/identity Reach by string (G-003).
|
||||
type HandPass struct {
|
||||
PassID string `json:"pass_id" yaml:"pass_id"`
|
||||
GuildID string `json:"guild_id" yaml:"guild_id"`
|
||||
IssuerReach string `json:"issuer_reach" yaml:"issuer_reach"`
|
||||
RecipientReach string `json:"recipient_reach" yaml:"recipient_reach"`
|
||||
AmountGrain int64 `json:"amount_grain" yaml:"amount_grain"`
|
||||
Timestamp int64 `json:"timestamp" yaml:"timestamp"`
|
||||
FeeGrain int64 `json:"fee_grain" yaml:"fee_grain"` // always 0 (HandPassFeeBps == 0)
|
||||
}
|
||||
|
||||
// IssueHandPass is a stub for issuing a Hand-Pass (REQ-017). The skeleton
|
||||
// constructs a HandPass with FeeGrain = 0 (the locked covenant). Issuer
|
||||
// type-level checks (issuer must be a guild member) are NOT enforced in
|
||||
// the skeleton — flagged for v0.3 keeper logic.
|
||||
func IssueHandPass(passID, guildID, issuerReach, recipientReach string, amountGrain int64, timestamp int64) HandPass {
|
||||
return HandPass{
|
||||
PassID: passID,
|
||||
GuildID: guildID,
|
||||
IssuerReach: issuerReach,
|
||||
RecipientReach: recipientReach,
|
||||
AmountGrain: amountGrain,
|
||||
Timestamp: timestamp,
|
||||
FeeGrain: 0, // HandPassFeeBps == 0 (locked covenant)
|
||||
}
|
||||
}
|
||||
|
||||
// Params for the guild module (skeleton — no tunables in v0.2).
|
||||
type Params struct{}
|
||||
|
||||
func DefaultParams() Params { return Params{} }
|
||||
|
||||
// GenesisState defines the guild module genesis state (REQ-017).
|
||||
// Guilds + HandPasses are the two top-level sets; ValidateGenesis enforces
|
||||
// guild-id uniqueness and pass-id uniqueness.
|
||||
type GenesisState struct {
|
||||
Params Params `json:"params" yaml:"params"`
|
||||
Guilds []Guild `json:"guilds" yaml:"guilds"`
|
||||
HandPasses []HandPass `json:"hand_passes" yaml:"hand_passes"`
|
||||
}
|
||||
|
||||
func DefaultGenesisState() *GenesisState {
|
||||
return &GenesisState{
|
||||
Params: DefaultParams(),
|
||||
Guilds: []Guild{},
|
||||
HandPasses: []HandPass{},
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||
// no-op): rejects duplicate guild-ids and duplicate pass-ids. Also enforces
|
||||
// the 0-fee covenant on genesis HandPasses (FeeGrain must be 0).
|
||||
func ValidateGenesis(bz json.RawMessage) error {
|
||||
var gs GenesisState
|
||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
||||
return fmt.Errorf("guild: invalid genesis: %w", err)
|
||||
}
|
||||
seenGuild := make(map[string]bool, len(gs.Guilds))
|
||||
for _, g := range gs.Guilds {
|
||||
if g.GuildID == "" {
|
||||
return fmt.Errorf("guild: empty guild-id")
|
||||
}
|
||||
if seenGuild[g.GuildID] {
|
||||
return fmt.Errorf("guild: duplicate guild-id %q", g.GuildID)
|
||||
}
|
||||
seenGuild[g.GuildID] = true
|
||||
}
|
||||
seenPass := make(map[string]bool, len(gs.HandPasses))
|
||||
for _, p := range gs.HandPasses {
|
||||
if p.PassID == "" {
|
||||
return fmt.Errorf("guild: empty pass-id")
|
||||
}
|
||||
if seenPass[p.PassID] {
|
||||
return fmt.Errorf("guild: duplicate pass-id %q", p.PassID)
|
||||
}
|
||||
seenPass[p.PassID] = true
|
||||
if p.FeeGrain != 0 {
|
||||
return fmt.Errorf("guild: HandPass %q has non-zero FeeGrain (HandPassFeeBps == 0 covenant)", p.PassID)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,264 @@
|
||||
package types_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/lexicon"
|
||||
"github.com/oy/openyield/x/guild/types"
|
||||
)
|
||||
|
||||
// TestHandPassFeeBpsLockedConst asserts the LOCKED 0-fee covenant (REQ-017).
|
||||
// A Guild Hand-Pass is always free at the protocol layer. This is a
|
||||
// regression firewall: changing HandPassFeeBps breaks this test.
|
||||
func TestHandPassFeeBpsLockedConst(t *testing.T) {
|
||||
if types.HandPassFeeBps != 0 {
|
||||
t.Errorf("HandPassFeeBps = %d, expected 0 (REQ-017 LOCKED 0pct covenant)", types.HandPassFeeBps)
|
||||
}
|
||||
}
|
||||
|
||||
// TestIssueHandPassFeeAlwaysZero asserts IssueHandPass constructs a HandPass
|
||||
// with FeeGrain = 0 (the locked covenant), regardless of the amount.
|
||||
func TestIssueHandPassFeeAlwaysZero(t *testing.T) {
|
||||
hp := types.IssueHandPass("p1", "g1", "reach:issuer", "reach:recipient", 10000, 1234)
|
||||
if hp.FeeGrain != 0 {
|
||||
t.Errorf("IssueHandPass FeeGrain = %d, expected 0 (HandPassFeeBps == 0)", hp.FeeGrain)
|
||||
}
|
||||
// Even a large amount has zero fee (0% covenant).
|
||||
hp2 := types.IssueHandPass("p2", "g1", "reach:i", "reach:r", 1_000_000_000, 1234)
|
||||
if hp2.FeeGrain != 0 {
|
||||
t.Errorf("IssueHandPass FeeGrain (large amount) = %d, expected 0", hp2.FeeGrain)
|
||||
}
|
||||
}
|
||||
|
||||
// TestIssueHandPassFields asserts IssueHandPass populates all fields.
|
||||
func TestIssueHandPassFields(t *testing.T) {
|
||||
hp := types.IssueHandPass("p1", "g1", "reach:issuer", "reach:recipient", 5000, 1234)
|
||||
if hp.PassID != "p1" || hp.GuildID != "g1" || hp.IssuerReach != "reach:issuer" ||
|
||||
hp.RecipientReach != "reach:recipient" || hp.AmountGrain != 5000 ||
|
||||
hp.Timestamp != 1234 || hp.FeeGrain != 0 {
|
||||
t.Error("IssueHandPass fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestHandPassStructFields asserts HandPass carries all required fields.
|
||||
func TestHandPassStructFields(t *testing.T) {
|
||||
hp := types.HandPass{
|
||||
PassID: "p1",
|
||||
GuildID: "g1",
|
||||
IssuerReach: "reach:i",
|
||||
RecipientReach: "reach:r",
|
||||
AmountGrain: 100,
|
||||
Timestamp: 200,
|
||||
FeeGrain: 0,
|
||||
}
|
||||
if hp.PassID != "p1" || hp.GuildID != "g1" || hp.AmountGrain != 100 ||
|
||||
hp.FeeGrain != 0 {
|
||||
t.Error("HandPass fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestGuildWithStandAffiliation asserts a Guild can affiliate with a Stand
|
||||
// (stand-affiliation-id set).
|
||||
func TestGuildWithStandAffiliation(t *testing.T) {
|
||||
g := types.Guild{
|
||||
GuildID: "g1",
|
||||
Name: "Task Guild",
|
||||
FounderReach: "reach:founder",
|
||||
CreatedAt: 100,
|
||||
StandAffiliationID: "s1",
|
||||
}
|
||||
if g.StandAffiliationID != "s1" {
|
||||
t.Errorf("StandAffiliationID = %q, want %q", g.StandAffiliationID, "s1")
|
||||
}
|
||||
}
|
||||
|
||||
// TestGuildStandalone asserts a Guild can be standalone (no Stand affiliation).
|
||||
func TestGuildStandalone(t *testing.T) {
|
||||
g := types.Guild{
|
||||
GuildID: "g2",
|
||||
Name: "Loose Collective",
|
||||
FounderReach: "reach:founder",
|
||||
CreatedAt: 100,
|
||||
}
|
||||
if g.StandAffiliationID != "" {
|
||||
t.Errorf("Standalone Guild StandAffiliationID = %q, want empty", g.StandAffiliationID)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultGenesisStateEmpty asserts DefaultGenesisState returns non-nil
|
||||
// empty slices for Guilds and HandPasses.
|
||||
func TestDefaultGenesisStateEmpty(t *testing.T) {
|
||||
gs := types.DefaultGenesisState()
|
||||
if gs == nil {
|
||||
t.Fatal("DefaultGenesisState returned nil")
|
||||
}
|
||||
if gs.Guilds == nil || len(gs.Guilds) != 0 {
|
||||
t.Errorf("Default Guilds should be non-nil empty slice")
|
||||
}
|
||||
if gs.HandPasses == nil || len(gs.HandPasses) != 0 {
|
||||
t.Errorf("Default HandPasses should be non-nil empty slice")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsDupGuildIDs asserts A-212: duplicate guild-ids
|
||||
// are rejected.
|
||||
func TestValidateGenesisRejectsDupGuildIDs(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Guilds: []types.Guild{
|
||||
{GuildID: "g1"},
|
||||
{GuildID: "g1"}, // dup
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject duplicate guild-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsDupPassIDs asserts A-212: duplicate pass-ids
|
||||
// are rejected.
|
||||
func TestValidateGenesisRejectsDupPassIDs(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
HandPasses: []types.HandPass{
|
||||
{PassID: "p1"},
|
||||
{PassID: "p1"}, // dup
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject duplicate pass-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsNonZeroFeeGrain asserts the 0-fee covenant is
|
||||
// enforced at genesis: any HandPass with non-zero FeeGrain is rejected.
|
||||
func TestValidateGenesisRejectsNonZeroFeeGrain(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
HandPasses: []types.HandPass{
|
||||
{PassID: "p1", FeeGrain: 1}, // violates 0-fee covenant
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject non-zero FeeGrain (0pct covenant)")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsEmptyGuildID asserts empty guild-id is rejected.
|
||||
func TestValidateGenesisRejectsEmptyGuildID(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Guilds: []types.Guild{{GuildID: ""}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject empty guild-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsEmptyPassID asserts empty pass-id is rejected.
|
||||
func TestValidateGenesisRejectsEmptyPassID(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
HandPasses: []types.HandPass{{PassID: ""}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject empty pass-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsBadJSON asserts malformed JSON is rejected.
|
||||
func TestValidateGenesisRejectsBadJSON(t *testing.T) {
|
||||
if err := types.ValidateGenesis(json.RawMessage(`{bad`)); err == nil {
|
||||
t.Error("ValidateGenesis should reject malformed JSON")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisAcceptsClean asserts a clean genesis validates,
|
||||
// including a Guild with Stand affiliation and a standalone Guild.
|
||||
func TestValidateGenesisAcceptsClean(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Guilds: []types.Guild{
|
||||
{GuildID: "g1", StandAffiliationID: "s1"},
|
||||
{GuildID: "g2"}, // standalone
|
||||
},
|
||||
HandPasses: []types.HandPass{
|
||||
{PassID: "p1", GuildID: "g1", FeeGrain: 0},
|
||||
{PassID: "p2", GuildID: "g2", FeeGrain: 0},
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept clean genesis, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestModuleConsts asserts the four Cosmos-convention module consts.
|
||||
func TestModuleConsts(t *testing.T) {
|
||||
if types.ModuleName != "guild" {
|
||||
t.Errorf("ModuleName = %q", types.ModuleName)
|
||||
}
|
||||
if types.StoreKey != "guild" {
|
||||
t.Errorf("StoreKey = %q", types.StoreKey)
|
||||
}
|
||||
if types.RouterKey != "guild" {
|
||||
t.Errorf("RouterKey = %q", types.RouterKey)
|
||||
}
|
||||
if types.QuerierRoute != "guild" {
|
||||
t.Errorf("QuerierRoute = %q", types.QuerierRoute)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultParams asserts DefaultParams returns a zero-value Params.
|
||||
func TestDefaultParams(t *testing.T) {
|
||||
_ = types.DefaultParams() // no panics
|
||||
}
|
||||
|
||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
||||
|
||||
// TestLexiconNoBannedTermsInGuildPackage scans every non-test .go file in
|
||||
// the guild/types package directory for the 9 banned terms (case-insensitive).
|
||||
// Production files only — the test file contains the banned terms as the list
|
||||
// of things to forbid (standard lexicon-test bootstrapping pattern).
|
||||
func TestLexiconNoBannedTermsInGuildPackage(t *testing.T) {
|
||||
pkgDir := packageDir(t, "github.com/oy/openyield/x/guild/types")
|
||||
files, err := filepath.Glob(filepath.Join(pkgDir, "*.go"))
|
||||
if err != nil {
|
||||
t.Fatalf("glob: %v", err)
|
||||
}
|
||||
prodFiles := []string{}
|
||||
for _, f := range files {
|
||||
if strings.HasSuffix(f, "_test.go") {
|
||||
continue
|
||||
}
|
||||
prodFiles = append(prodFiles, f)
|
||||
}
|
||||
if len(prodFiles) == 0 {
|
||||
t.Fatal("no production .go files found in guild/types")
|
||||
}
|
||||
for _, f := range prodFiles {
|
||||
bz, err := os.ReadFile(f)
|
||||
if err != nil {
|
||||
t.Fatalf("read %s: %v", f, err)
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
t.Errorf("%s: banned term %q (REQ-012 lexicon firewall)", filepath.Base(f), found)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// packageDir resolves a Go import path to its filesystem directory.
|
||||
func packageDir(t *testing.T, importPath string) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(file))))
|
||||
rel := strings.TrimPrefix(importPath, "github.com/oy/openyield/")
|
||||
return filepath.Join(repoRoot, rel)
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
package types
|
||||
|
||||
import "fmt"
|
||||
|
||||
// genesis.go holds the data-engineer's genesis schema helpers for the pact
|
||||
// module (G-008 split). ValidateGenesis in types.go composes these helpers;
|
||||
// the security-engineer's test assertions live in types_test.go.
|
||||
//
|
||||
// The Pact genesis schema is a single top-level set: Pacts. The two
|
||||
// invariants enforced at genesis load are (1) pact-id uniqueness (A-212) and
|
||||
// (2) the Mission-Lock check (the per-type AmendableCoreTerms flags for
|
||||
// Pause/Ground/Stance must be false — the global MissionLockAmendable const
|
||||
// bool is the firewall). The Mission-Lock is enforced by compile-time consts;
|
||||
// the genesis-side MissionLockCheck is the data-engineer's hook that asserts
|
||||
// the const firewall is intact whenever genesis Pacts are loaded (so a
|
||||
// future change to the consts would surface here too).
|
||||
|
||||
// ValidatePacts asserts pact-ids are present and unique, and that each
|
||||
// Pact's type is a known PactType. It also runs the Mission-Lock check
|
||||
// (MissionLockCheck) so the genesis load path enforces both invariants.
|
||||
// ValidatePacts is the data-engineer's schema validator, composed by
|
||||
// ValidateGenesis in types.go.
|
||||
func ValidatePacts(pacts []Pact) error {
|
||||
seen := make(map[string]bool, len(pacts))
|
||||
for i, p := range pacts {
|
||||
if p.PactID == "" {
|
||||
return fmt.Errorf("pact [%d]: empty pact-id", i)
|
||||
}
|
||||
if seen[p.PactID] {
|
||||
return fmt.Errorf("pact: duplicate pact-id %q", p.PactID)
|
||||
}
|
||||
seen[p.PactID] = true
|
||||
if !knownPactType(p.Type) {
|
||||
return fmt.Errorf("pact %q: unknown pact type %q", p.PactID, p.Type)
|
||||
}
|
||||
}
|
||||
if err := MissionLockCheck(pacts); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// knownPactType reports whether t is one of the six vision §16 PactType values.
|
||||
func knownPactType(t PactType) bool {
|
||||
for _, kt := range AllPactTypes() {
|
||||
if t == kt {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// MissionLockCheck asserts the Mission-Lock invariant on a slice of Pacts:
|
||||
// every Pause/Ground/Stance Pact must have its AmendableCoreTerms flag false.
|
||||
// Because the flags are compile-time consts (AmendableCoreTermsPause/Ground/
|
||||
// Stance == false) and the global MissionLockAmendable const is false, this
|
||||
// check always passes — it exists as the data-engineer's genesis-side
|
||||
// assertion that the Mission-Lock firewall is intact. If the consts ever
|
||||
// changed to true, this check would still pass (the consts are the firewall,
|
||||
// not runtime data); the test in types_test.go is the true regression guard.
|
||||
// The helper is the genesis hook for v0.3 keeper logic to extend with live
|
||||
// per-pact Mission-Lock enforcement.
|
||||
func MissionLockCheck(pacts []Pact) error {
|
||||
// The global MissionLockAmendable const is the firewall: if it were ever
|
||||
// flipped to true (which the test suite rejects), the genesis load would
|
||||
// surface it here. The per-pact loop echoes the invariant for each
|
||||
// Mission-Locked Pact type so a future per-pact check has a hook point.
|
||||
if MissionLockAmendable {
|
||||
return fmt.Errorf("pact: Mission Lock amendable (MissionLockAmendable == true) — firewall breach")
|
||||
}
|
||||
for _, p := range pacts {
|
||||
if !MissionLockAmendableCoreTerms(p.Type) {
|
||||
// Non-amendable core terms: the const flags already guarantee this;
|
||||
// the genesis check is the echo. No per-pact runtime data to verify
|
||||
// in the skeleton — the const is the source of truth.
|
||||
continue
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,235 @@
|
||||
package types
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
const (
|
||||
ModuleName = "pact"
|
||||
StoreKey = ModuleName
|
||||
RouterKey = ModuleName
|
||||
QuerierRoute = ModuleName
|
||||
|
||||
// PactTypeCount is the locked count of PactType enum values (vision §16).
|
||||
// A regression firewall: adding/removing/renaming a Pact type breaks this
|
||||
// const's test (REQ-020, A-207: ONE module with enum, not six micro-modules).
|
||||
PactTypeCount = 6
|
||||
|
||||
// MissionLockAmendable is the Mission-Lock invariant: the core terms of
|
||||
// Pause/Ground/Stance Pacts are non-amendable (vision §19). This is a
|
||||
// locked const bool: it can NEVER be set true. The regression test asserts
|
||||
// it is false and that the per-type AmendableCoreTerms flags for
|
||||
// Pause/Ground/Stance are all false.
|
||||
MissionLockAmendable = false
|
||||
)
|
||||
|
||||
// PactType enumerates the six commitment types (vision §16, REQ-020).
|
||||
// A-207: all six live in ONE x/pact module with a PactType enum + per-type
|
||||
// execute-entry stubs (NOT six micro-modules).
|
||||
type PactType string
|
||||
|
||||
const (
|
||||
PactPause PactType = "Pause" // circuit-breaker commitment (wraps x/still)
|
||||
PactGround PactType = "Ground" // earth-anchored collateral lock commitment
|
||||
PactStance PactType = "Stance" // public-position / attestation commitment
|
||||
PactCover PactType = "Cover" // insurance-like commitment (Cover Pool)
|
||||
PactStandRegistry PactType = "StandRegistry" // registers a Stand into the canonical registry
|
||||
PactHubAPI PactType = "HubAPI" // B2B backbone commitment
|
||||
)
|
||||
|
||||
// AllPactTypes returns all six PactType values in vision §16 order.
|
||||
// Locked-const test asserts exactly 6 entries with these names (REQ-020).
|
||||
func AllPactTypes() []PactType {
|
||||
return []PactType{
|
||||
PactPause,
|
||||
PactGround,
|
||||
PactStance,
|
||||
PactCover,
|
||||
PactStandRegistry,
|
||||
PactHubAPI,
|
||||
}
|
||||
}
|
||||
|
||||
// PactStatus enumerates the lifecycle states of a Pact (REQ-020).
|
||||
type PactStatus string
|
||||
|
||||
const (
|
||||
StatusProposed PactStatus = "Proposed" // pact created, not yet active
|
||||
StatusActive PactStatus = "Active" // pact is live and binding
|
||||
StatusFulfilled PactStatus = "Fulfilled" // pact completed successfully
|
||||
StatusVoided PactStatus = "Voided" // pact voided (cancelled / breached)
|
||||
)
|
||||
|
||||
// PactStatusCount is the locked count of PactStatus enum values.
|
||||
const PactStatusCount = 4
|
||||
|
||||
// Pact is a commitment of one of six types (vision §16, REQ-020). Each Pact
|
||||
// has a type, parties (Reach IDs by-ID-string per G-003), opaque terms-bytes,
|
||||
// a status, and per-type execute-message ref. window-id-ref references
|
||||
// x/window by ID string (G-003 by-ID-string invariant; P1-01-01 convention).
|
||||
// stand-id-ref references x/stand by ID string (P1-02-01 convention); only
|
||||
// StandRegistry Pacts populate it for non-empty, others leave it "".
|
||||
type Pact struct {
|
||||
PactID string `json:"pact_id" yaml:"pact_id"`
|
||||
Type PactType `json:"type" yaml:"type"`
|
||||
Parties []string `json:"parties" yaml:"parties"`
|
||||
Terms []byte `json:"terms" yaml:"terms"`
|
||||
Status PactStatus `json:"status" yaml:"status"`
|
||||
ExecuteMsgRef string `json:"execute_msg_ref" yaml:"execute_msg_ref"`
|
||||
WindowIDRef string `json:"window_id_ref" yaml:"window_id_ref"`
|
||||
StandIDRef string `json:"stand_id_ref" yaml:"stand_id_ref"`
|
||||
}
|
||||
|
||||
// MissionLockCoreTerms flags which Pact types have non-amendable core terms
|
||||
// under the Mission Lock (vision §19). Pause/Ground/Stance core terms are
|
||||
// non-amendable; the const flags below are the per-type invariant. The
|
||||
// module-level MissionLockAmendable const bool is the global firewall.
|
||||
const (
|
||||
// AmendableCoreTermsPause is false: Pause Pact core terms are
|
||||
// non-amendable under the Mission Lock.
|
||||
AmendableCoreTermsPause = false
|
||||
// AmendableCoreTermsGround is false: Ground Pact core terms are
|
||||
// non-amendable under the Mission Lock.
|
||||
AmendableCoreTermsGround = false
|
||||
// AmendableCoreTermsStance is false: Stance Pact core terms are
|
||||
// non-amendable under the Mission Lock.
|
||||
AmendableCoreTermsStance = false
|
||||
)
|
||||
|
||||
// MissionLockAmendableCoreTerms returns the per-type AmendableCoreTerms flag
|
||||
// for a PactType. Pause/Ground/Stance return false (non-amendable); Cover,
|
||||
// StandRegistry, HubAPI return true (amendable per the skeleton — these are
|
||||
// not Mission-Locked). The Mission-Lock invariant test asserts the three
|
||||
// core types return false.
|
||||
func MissionLockAmendableCoreTerms(t PactType) bool {
|
||||
switch t {
|
||||
case PactPause:
|
||||
return AmendableCoreTermsPause
|
||||
case PactGround:
|
||||
return AmendableCoreTermsGround
|
||||
case PactStance:
|
||||
return AmendableCoreTermsStance
|
||||
default:
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
// ExecutePause is the execute-entry stub for a Pause Pact (circuit-breaker).
|
||||
// The skeleton returns the proposed status transition; v0.3 wires the live
|
||||
// keeper that wraps x/still.
|
||||
func (p *Pact) ExecutePause() error {
|
||||
if p.Type != PactPause {
|
||||
return fmt.Errorf("ExecutePause: pact %q is type %q, not Pause", p.PactID, p.Type)
|
||||
}
|
||||
if p.Status != StatusProposed {
|
||||
return fmt.Errorf("ExecutePause: pact %q status %q, not Proposed", p.PactID, p.Status)
|
||||
}
|
||||
p.Status = StatusActive
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExecuteGround is the execute-entry stub for a Ground Pact
|
||||
// (earth-anchored collateral lock).
|
||||
func (p *Pact) ExecuteGround() error {
|
||||
if p.Type != PactGround {
|
||||
return fmt.Errorf("ExecuteGround: pact %q is type %q, not Ground", p.PactID, p.Type)
|
||||
}
|
||||
if p.Status != StatusProposed {
|
||||
return fmt.Errorf("ExecuteGround: pact %q status %q, not Proposed", p.PactID, p.Status)
|
||||
}
|
||||
p.Status = StatusActive
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExecuteStance is the execute-entry stub for a Stance Pact
|
||||
// (public-position / attestation).
|
||||
func (p *Pact) ExecuteStance() error {
|
||||
if p.Type != PactStance {
|
||||
return fmt.Errorf("ExecuteStance: pact %q is type %q, not Stance", p.PactID, p.Type)
|
||||
}
|
||||
if p.Status != StatusProposed {
|
||||
return fmt.Errorf("ExecuteStance: pact %q status %q, not Proposed", p.PactID, p.Status)
|
||||
}
|
||||
p.Status = StatusActive
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExecuteCover is the execute-entry stub for a Cover Pact (insurance-like).
|
||||
// Cover Pool seniority is deferred per Q7 — the skeleton is a flat
|
||||
// commitment type with no seniority fields.
|
||||
func (p *Pact) ExecuteCover() error {
|
||||
if p.Type != PactCover {
|
||||
return fmt.Errorf("ExecuteCover: pact %q is type %q, not Cover", p.PactID, p.Type)
|
||||
}
|
||||
if p.Status != StatusProposed {
|
||||
return fmt.Errorf("ExecuteCover: pact %q status %q, not Proposed", p.PactID, p.Status)
|
||||
}
|
||||
p.Status = StatusActive
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExecuteStandRegistry is the execute-entry stub for a StandRegistry Pact.
|
||||
// stand-id-ref references x/stand by ID string (G-003); the skeleton activates
|
||||
// the pact without a live keeper call.
|
||||
func (p *Pact) ExecuteStandRegistry() error {
|
||||
if p.Type != PactStandRegistry {
|
||||
return fmt.Errorf("ExecuteStandRegistry: pact %q is type %q, not StandRegistry", p.PactID, p.Type)
|
||||
}
|
||||
if p.Status != StatusProposed {
|
||||
return fmt.Errorf("ExecuteStandRegistry: pact %q status %q, not Proposed", p.PactID, p.Status)
|
||||
}
|
||||
if p.StandIDRef == "" {
|
||||
return fmt.Errorf("ExecuteStandRegistry: pact %q missing stand-id-ref", p.PactID)
|
||||
}
|
||||
p.Status = StatusActive
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExecuteHubAPI is the execute-entry stub for a HubAPI Pact (B2B backbone).
|
||||
// The full Hub API suite is deferred to Phase 3; v0.2 = stub type only.
|
||||
func (p *Pact) ExecuteHubAPI() error {
|
||||
if p.Type != PactHubAPI {
|
||||
return fmt.Errorf("ExecuteHubAPI: pact %q is type %q, not HubAPI", p.PactID, p.Type)
|
||||
}
|
||||
if p.Status != StatusProposed {
|
||||
return fmt.Errorf("ExecuteHubAPI: pact %q status %q, not Proposed", p.PactID, p.Status)
|
||||
}
|
||||
p.Status = StatusActive
|
||||
return nil
|
||||
}
|
||||
|
||||
// Params for the pact module (skeleton — no tunables in v0.2).
|
||||
type Params struct{}
|
||||
|
||||
func DefaultParams() Params { return Params{} }
|
||||
|
||||
// GenesisState defines the pact module genesis state (REQ-020).
|
||||
// Pacts is the top-level set; ValidateGenesis enforces pact-id uniqueness and
|
||||
// the Mission-Lock check (Mission-Locked types' AmendableCoreTerms flags must
|
||||
// be false). The data-engineer's genesis.go holds the schema helpers (G-008).
|
||||
type GenesisState struct {
|
||||
Params Params `json:"params" yaml:"params"`
|
||||
Pacts []Pact `json:"pacts" yaml:"pacts"`
|
||||
}
|
||||
|
||||
func DefaultGenesisState() *GenesisState {
|
||||
return &GenesisState{
|
||||
Params: DefaultParams(),
|
||||
Pacts: []Pact{},
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||
// no-op): rejects duplicate pact-ids, and runs the Mission-Lock check on
|
||||
// genesis Pacts. Delegates to the data-engineer's genesis.go helpers (G-008).
|
||||
func ValidateGenesis(bz json.RawMessage) error {
|
||||
var gs GenesisState
|
||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
||||
return fmt.Errorf("pact: invalid genesis: %w", err)
|
||||
}
|
||||
if err := ValidatePacts(gs.Pacts); err != nil {
|
||||
return fmt.Errorf("pact: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,449 @@
|
||||
package types_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/lexicon"
|
||||
"github.com/oy/openyield/x/pact/types"
|
||||
)
|
||||
|
||||
// TestPactTypeCountLockedConst asserts PactTypeCount is exactly 6 and
|
||||
// AllPactTypes() returns exactly 6 (vision §16, REQ-020, A-207). A regression
|
||||
// firewall: adding/removing/renaming a Pact type breaks this test.
|
||||
func TestPactTypeCountLockedConst(t *testing.T) {
|
||||
if types.PactTypeCount != 6 {
|
||||
t.Errorf("PactTypeCount = %d, expected 6 (vision §16 LOCKED)", types.PactTypeCount)
|
||||
}
|
||||
all := types.AllPactTypes()
|
||||
if len(all) != 6 {
|
||||
t.Errorf("AllPactTypes() len = %d, expected 6", len(all))
|
||||
}
|
||||
}
|
||||
|
||||
// TestAllPactTypesNames asserts the 6 vision §16 names in order with no
|
||||
// extras, no dups, no renames.
|
||||
func TestAllPactTypesNames(t *testing.T) {
|
||||
want := []string{
|
||||
"Pause", "Ground", "Stance", "Cover", "StandRegistry", "HubAPI",
|
||||
}
|
||||
all := types.AllPactTypes()
|
||||
if len(all) != len(want) {
|
||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for i, s := range all {
|
||||
if string(s) != want[i] {
|
||||
t.Errorf("AllPactTypes()[%d] = %q, want %q", i, s, want[i])
|
||||
}
|
||||
if seen[string(s)] {
|
||||
t.Errorf("duplicate PactType %q", s)
|
||||
}
|
||||
seen[string(s)] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestPactTypeValues asserts each named const matches its AllPactTypes entry.
|
||||
func TestPactTypeValues(t *testing.T) {
|
||||
if types.PactPause != "Pause" {
|
||||
t.Errorf("PactPause = %q", types.PactPause)
|
||||
}
|
||||
if types.PactGround != "Ground" {
|
||||
t.Errorf("PactGround = %q", types.PactGround)
|
||||
}
|
||||
if types.PactStance != "Stance" {
|
||||
t.Errorf("PactStance = %q", types.PactStance)
|
||||
}
|
||||
if types.PactCover != "Cover" {
|
||||
t.Errorf("PactCover = %q", types.PactCover)
|
||||
}
|
||||
if types.PactStandRegistry != "StandRegistry" {
|
||||
t.Errorf("PactStandRegistry = %q", types.PactStandRegistry)
|
||||
}
|
||||
if types.PactHubAPI != "HubAPI" {
|
||||
t.Errorf("PactHubAPI = %q", types.PactHubAPI)
|
||||
}
|
||||
}
|
||||
|
||||
// TestPactStatusCountLockedConst asserts PactStatusCount is exactly 4.
|
||||
func TestPactStatusCountLockedConst(t *testing.T) {
|
||||
if types.PactStatusCount != 4 {
|
||||
t.Errorf("PactStatusCount = %d, expected 4", types.PactStatusCount)
|
||||
}
|
||||
}
|
||||
|
||||
// TestPactStatusEnumCoverage asserts all four PactStatus values are distinct
|
||||
// and non-empty (REQ-020 lifecycle: Proposed, Active, Fulfilled, Voided).
|
||||
func TestPactStatusEnumCoverage(t *testing.T) {
|
||||
statuses := []types.PactStatus{
|
||||
types.StatusProposed, types.StatusActive,
|
||||
types.StatusFulfilled, types.StatusVoided,
|
||||
}
|
||||
if len(statuses) != 4 {
|
||||
t.Errorf("expected 4 PactStatus consts, got %d", len(statuses))
|
||||
}
|
||||
seen := map[types.PactStatus]bool{}
|
||||
for _, s := range statuses {
|
||||
if s == "" {
|
||||
t.Error("empty PactStatus")
|
||||
}
|
||||
if seen[s] {
|
||||
t.Errorf("duplicate PactStatus %q", s)
|
||||
}
|
||||
seen[s] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestMissionLockAmendableConstFalse asserts the global Mission-Lock const
|
||||
// is false (vision §19): the Mission Lock can NEVER be amended. This is the
|
||||
// highest-severity regression firewall for the pact module.
|
||||
func TestMissionLockAmendableConstFalse(t *testing.T) {
|
||||
if types.MissionLockAmendable != false {
|
||||
t.Fatalf("MissionLockAmendable = %v, expected false (Mission Lock non-amendable)", types.MissionLockAmendable)
|
||||
}
|
||||
}
|
||||
|
||||
// TestMissionLockCoreTermsNonAmendable asserts the per-type AmendableCoreTerms
|
||||
// const flags for Pause/Ground/Stance are all false (Mission-Lock invariant).
|
||||
// Cover/StandRegistry/HubAPI return true (amendable — not Mission-Locked).
|
||||
func TestMissionLockCoreTermsNonAmendable(t *testing.T) {
|
||||
// Pause/Ground/Stance core terms MUST be non-amendable.
|
||||
if types.AmendableCoreTermsPause != false {
|
||||
t.Error("AmendableCoreTermsPause must be false (Mission Lock)")
|
||||
}
|
||||
if types.AmendableCoreTermsGround != false {
|
||||
t.Error("AmendableCoreTermsGround must be false (Mission Lock)")
|
||||
}
|
||||
if types.AmendableCoreTermsStance != false {
|
||||
t.Error("AmendableCoreTermsStance must be false (Mission Lock)")
|
||||
}
|
||||
// The MissionLockAmendableCoreTerms helper echoes the const flags.
|
||||
locked := []types.PactType{types.PactPause, types.PactGround, types.PactStance}
|
||||
for _, pt := range locked {
|
||||
if types.MissionLockAmendableCoreTerms(pt) != false {
|
||||
t.Errorf("MissionLockAmendableCoreTerms(%q) = true, want false (Mission Lock)", pt)
|
||||
}
|
||||
}
|
||||
// Cover/StandRegistry/HubAPI are amendable (not Mission-Locked).
|
||||
amendable := []types.PactType{types.PactCover, types.PactStandRegistry, types.PactHubAPI}
|
||||
for _, pt := range amendable {
|
||||
if types.MissionLockAmendableCoreTerms(pt) != true {
|
||||
t.Errorf("MissionLockAmendableCoreTerms(%q) = false, want true (amendable)", pt)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestPactStructFields asserts Pact carries all required fields including
|
||||
// the by-ID-string refs (window-id-ref, stand-id-ref per G-003).
|
||||
func TestPactStructFields(t *testing.T) {
|
||||
p := types.Pact{
|
||||
PactID: "p1",
|
||||
Type: types.PactPause,
|
||||
Parties: []string{"reach:a", "reach:b"},
|
||||
Terms: []byte("terms-bytes"),
|
||||
Status: types.StatusProposed,
|
||||
ExecuteMsgRef: "msg:pause:1",
|
||||
WindowIDRef: "w1",
|
||||
StandIDRef: "s1",
|
||||
}
|
||||
if p.PactID != "p1" || p.Type != types.PactPause || len(p.Parties) != 2 ||
|
||||
string(p.Terms) != "terms-bytes" || p.Status != types.StatusProposed ||
|
||||
p.ExecuteMsgRef != "msg:pause:1" || p.WindowIDRef != "w1" || p.StandIDRef != "s1" {
|
||||
t.Error("Pact fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestPactStructRefsAreStrings asserts window-id-ref and stand-id-ref are
|
||||
// string-typed (G-003 by-ID-string invariant; the G-003 import invariant is
|
||||
// enforced project-wide by P1-01-02's go/parser scan, so this test only
|
||||
// asserts the field types at the struct level, not cross-module imports).
|
||||
func TestPactStructRefsAreStrings(t *testing.T) {
|
||||
// Construct a Pact and confirm the ref fields hold plain strings —
|
||||
// no struct imports of x/window or x/stand are needed.
|
||||
p := types.Pact{WindowIDRef: "window-abc", StandIDRef: "stand-xyz"}
|
||||
if p.WindowIDRef != "window-abc" {
|
||||
t.Errorf("WindowIDRef = %q", p.WindowIDRef)
|
||||
}
|
||||
if p.StandIDRef != "stand-xyz" {
|
||||
t.Errorf("StandIDRef = %q", p.StandIDRef)
|
||||
}
|
||||
}
|
||||
|
||||
// TestExecuteStubsCallable asserts each per-type Execute* stub is callable
|
||||
// and transitions a Proposed Pact to Active (REQ-020).
|
||||
func TestExecuteStubsCallable(t *testing.T) {
|
||||
tt := []struct {
|
||||
name string
|
||||
pact types.Pact
|
||||
execFn func(*types.Pact) error
|
||||
}{
|
||||
{"Pause", types.Pact{PactID: "p1", Type: types.PactPause, Status: types.StatusProposed}, (*types.Pact).ExecutePause},
|
||||
{"Ground", types.Pact{PactID: "p2", Type: types.PactGround, Status: types.StatusProposed}, (*types.Pact).ExecuteGround},
|
||||
{"Stance", types.Pact{PactID: "p3", Type: types.PactStance, Status: types.StatusProposed}, (*types.Pact).ExecuteStance},
|
||||
{"Cover", types.Pact{PactID: "p4", Type: types.PactCover, Status: types.StatusProposed}, (*types.Pact).ExecuteCover},
|
||||
{"HubAPI", types.Pact{PactID: "p6", Type: types.PactHubAPI, Status: types.StatusProposed}, (*types.Pact).ExecuteHubAPI},
|
||||
}
|
||||
for _, tc := range tt {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
p := tc.pact
|
||||
if err := tc.execFn(&p); err != nil {
|
||||
t.Fatalf("Execute%s: %v", tc.name, err)
|
||||
}
|
||||
if p.Status != types.StatusActive {
|
||||
t.Errorf("after Execute%s, status = %q, want Active", tc.name, p.Status)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestExecuteStandRegistryRequiresStandIDRef asserts ExecuteStandRegistry
|
||||
// requires a non-empty stand-id-ref (the by-ID-string ref to x/stand).
|
||||
func TestExecuteStandRegistryRequiresStandIDRef(t *testing.T) {
|
||||
p := types.Pact{PactID: "p5", Type: types.PactStandRegistry, Status: types.StatusProposed, StandIDRef: ""}
|
||||
if err := p.ExecuteStandRegistry(); err == nil {
|
||||
t.Error("ExecuteStandRegistry should error on empty stand-id-ref")
|
||||
}
|
||||
p.StandIDRef = "s1"
|
||||
if err := p.ExecuteStandRegistry(); err != nil {
|
||||
t.Errorf("ExecuteStandRegistry with stand-id-ref: %v", err)
|
||||
}
|
||||
if p.Status != types.StatusActive {
|
||||
t.Errorf("status = %q, want Active", p.Status)
|
||||
}
|
||||
}
|
||||
|
||||
// TestExecuteStubsRejectWrongType asserts each Execute* stub rejects a Pact
|
||||
// of the wrong type (type guard).
|
||||
func TestExecuteStubsRejectWrongType(t *testing.T) {
|
||||
p := types.Pact{PactID: "p", Type: types.PactCover, Status: types.StatusProposed}
|
||||
if err := p.ExecutePause(); err == nil {
|
||||
t.Error("ExecutePause on a Cover pact should error")
|
||||
}
|
||||
if err := p.ExecuteGround(); err == nil {
|
||||
t.Error("ExecuteGround on a Cover pact should error")
|
||||
}
|
||||
if err := p.ExecuteStance(); err == nil {
|
||||
t.Error("ExecuteStance on a Cover pact should error")
|
||||
}
|
||||
if err := p.ExecuteStandRegistry(); err == nil {
|
||||
t.Error("ExecuteStandRegistry on a Cover pact should error")
|
||||
}
|
||||
if err := p.ExecuteHubAPI(); err == nil {
|
||||
t.Error("ExecuteHubAPI on a Cover pact should error")
|
||||
}
|
||||
// ExecuteCover should succeed (matches type).
|
||||
if err := p.ExecuteCover(); err != nil {
|
||||
t.Errorf("ExecuteCover on a Cover pact: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestExecuteStubsRejectNonProposed asserts each Execute* stub rejects a
|
||||
// Pact not in the Proposed status.
|
||||
func TestExecuteStubsRejectNonProposed(t *testing.T) {
|
||||
tt := []struct {
|
||||
name string
|
||||
pact types.Pact
|
||||
execFn func(*types.Pact) error
|
||||
}{
|
||||
{"Pause-active", types.Pact{PactID: "p", Type: types.PactPause, Status: types.StatusActive}, (*types.Pact).ExecutePause},
|
||||
{"Ground-fulfilled", types.Pact{PactID: "p", Type: types.PactGround, Status: types.StatusFulfilled}, (*types.Pact).ExecuteGround},
|
||||
{"Stance-voided", types.Pact{PactID: "p", Type: types.PactStance, Status: types.StatusVoided}, (*types.Pact).ExecuteStance},
|
||||
{"Cover-active", types.Pact{PactID: "p", Type: types.PactCover, Status: types.StatusActive}, (*types.Pact).ExecuteCover},
|
||||
{"HubAPI-voided", types.Pact{PactID: "p", Type: types.PactHubAPI, Status: types.StatusVoided}, (*types.Pact).ExecuteHubAPI},
|
||||
}
|
||||
for _, tc := range tt {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
p := tc.pact
|
||||
if err := tc.execFn(&p); err == nil {
|
||||
t.Errorf("Execute%s on %q-status pact should error", tc.name, p.Status)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestExecuteStandRegistryNonProposed asserts ExecuteStandRegistry rejects
|
||||
// a non-Proposed StandRegistry pact even when stand-id-ref is set.
|
||||
func TestExecuteStandRegistryNonProposed(t *testing.T) {
|
||||
p := types.Pact{PactID: "p", Type: types.PactStandRegistry, Status: types.StatusActive, StandIDRef: "s1"}
|
||||
if err := p.ExecuteStandRegistry(); err == nil {
|
||||
t.Error("ExecuteStandRegistry on Active pact should error")
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultGenesisStateEmpty asserts DefaultGenesisState returns a
|
||||
// non-nil empty slice for Pacts.
|
||||
func TestDefaultGenesisStateEmpty(t *testing.T) {
|
||||
gs := types.DefaultGenesisState()
|
||||
if gs == nil {
|
||||
t.Fatal("DefaultGenesisState returned nil")
|
||||
}
|
||||
if gs.Pacts == nil || len(gs.Pacts) != 0 {
|
||||
t.Errorf("Default Pacts should be non-nil empty slice; got len=%d nil=%v", len(gs.Pacts), gs.Pacts == nil)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsDupPactIDs asserts A-212: duplicate pact-ids
|
||||
// are rejected (upgrade from v0.1's no-op ValidateGenesis).
|
||||
func TestValidateGenesisRejectsDupPactIDs(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Pacts: []types.Pact{
|
||||
{PactID: "p1", Type: types.PactPause},
|
||||
{PactID: "p1", Type: types.PactGround}, // dup
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject duplicate pact-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsEmptyPactID asserts empty pact-id is rejected.
|
||||
func TestValidateGenesisRejectsEmptyPactID(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Pacts: []types.Pact{{PactID: "", Type: types.PactPause}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject empty pact-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsUnknownType asserts an unknown PactType is
|
||||
// rejected (data-engineer schema validation).
|
||||
func TestValidateGenesisRejectsUnknownType(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Pacts: []types.Pact{{PactID: "p1", Type: types.PactType("Bogus")}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject unknown pact type")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsBadJSON asserts malformed JSON is rejected.
|
||||
func TestValidateGenesisRejectsBadJSON(t *testing.T) {
|
||||
if err := types.ValidateGenesis(json.RawMessage(`{not json`)); err == nil {
|
||||
t.Error("ValidateGenesis should reject malformed JSON")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisAcceptsClean asserts a clean genesis validates.
|
||||
func TestValidateGenesisAcceptsClean(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Pacts: []types.Pact{
|
||||
{PactID: "p1", Type: types.PactPause, Status: types.StatusProposed},
|
||||
{PactID: "p2", Type: types.PactCover, Status: types.StatusActive},
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept clean genesis, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestMissionLockCheckIsNoOp asserts the genesis-side MissionLockCheck helper
|
||||
// is a no-op (the const flags are the true firewall). It must return nil for
|
||||
// any slice of Pacts — the Mission Lock is enforced at compile time by the
|
||||
// const bools, not at genesis load.
|
||||
func TestMissionLockCheckIsNoOp(t *testing.T) {
|
||||
pacts := []types.Pact{
|
||||
{PactID: "p1", Type: types.PactPause},
|
||||
{PactID: "p2", Type: types.PactGround},
|
||||
{PactID: "p3", Type: types.PactStance},
|
||||
{PactID: "p4", Type: types.PactCover},
|
||||
}
|
||||
if err := types.MissionLockCheck(pacts); err != nil {
|
||||
t.Errorf("MissionLockCheck should be a no-op (const flags are the firewall), got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestModuleConsts asserts the four Cosmos-convention module consts.
|
||||
func TestModuleConsts(t *testing.T) {
|
||||
if types.ModuleName != "pact" {
|
||||
t.Errorf("ModuleName = %q", types.ModuleName)
|
||||
}
|
||||
if types.StoreKey != "pact" {
|
||||
t.Errorf("StoreKey = %q", types.StoreKey)
|
||||
}
|
||||
if types.RouterKey != "pact" {
|
||||
t.Errorf("RouterKey = %q", types.RouterKey)
|
||||
}
|
||||
if types.QuerierRoute != "pact" {
|
||||
t.Errorf("QuerierRoute = %q", types.QuerierRoute)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultParams asserts DefaultParams returns a zero-value Params.
|
||||
func TestDefaultParams(t *testing.T) {
|
||||
_ = types.DefaultParams() // no panics
|
||||
}
|
||||
|
||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
||||
|
||||
// TestLexiconNoBannedTermsInPactPackage scans every non-test .go file in
|
||||
// the pact/types package directory for the 9 banned terms (case-insensitive).
|
||||
// Production files only — the test file references banned terms via the
|
||||
// lexicon package helpers (standard lexicon-test bootstrapping pattern;
|
||||
// no banned literals are inlined in this test file).
|
||||
func TestLexiconNoBannedTermsInPactPackage(t *testing.T) {
|
||||
pkgDir := packageDir(t, "github.com/oy/openyield/x/pact/types")
|
||||
files, err := filepath.Glob(filepath.Join(pkgDir, "*.go"))
|
||||
if err != nil {
|
||||
t.Fatalf("glob: %v", err)
|
||||
}
|
||||
prodFiles := []string{}
|
||||
for _, f := range files {
|
||||
if strings.HasSuffix(f, "_test.go") {
|
||||
continue
|
||||
}
|
||||
prodFiles = append(prodFiles, f)
|
||||
}
|
||||
if len(prodFiles) == 0 {
|
||||
t.Fatal("no production .go files found in pact/types")
|
||||
}
|
||||
for _, f := range prodFiles {
|
||||
bz, err := os.ReadFile(f)
|
||||
if err != nil {
|
||||
t.Fatalf("read %s: %v", f, err)
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
t.Errorf("%s: banned term %q (REQ-012 lexicon firewall)", filepath.Base(f), found)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestLexiconNoBannedTermsInPactTestFile asserts this test file itself does
|
||||
// not contain any banned term as a literal (the firewall scans test files
|
||||
// too; the lexicon helpers must be used rather than inlining banned terms).
|
||||
// This is the self-bootstrapping check.
|
||||
func TestLexiconNoBannedTermsInPactTestFile(t *testing.T) {
|
||||
_, thisFile, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
bz, err := os.ReadFile(thisFile)
|
||||
if err != nil {
|
||||
t.Fatalf("read self: %v", err)
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
t.Fatalf("pact test file contains banned term %q — use lexicon helpers, not literals", found)
|
||||
}
|
||||
}
|
||||
|
||||
// packageDir resolves a Go import path to its filesystem directory by
|
||||
// walking up from this test file (v0.2 skeleton has zero external deps).
|
||||
func packageDir(t *testing.T, importPath string) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
// file = .../oy/x/pact/types/types_test.go -> repoRoot = .../oy (4 dirs up)
|
||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(file))))
|
||||
rel := strings.TrimPrefix(importPath, "github.com/oy/openyield/")
|
||||
return filepath.Join(repoRoot, rel)
|
||||
}
|
||||
@@ -0,0 +1,195 @@
|
||||
package types
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"sync"
|
||||
)
|
||||
|
||||
const (
|
||||
ModuleName = "partner"
|
||||
StoreKey = ModuleName
|
||||
RouterKey = ModuleName
|
||||
QuerierRoute = ModuleName
|
||||
|
||||
// PartnerTierCount is the locked count of PartnerTier enum values
|
||||
// (vision §13, D-026). A regression firewall: adding/removing/renaming a
|
||||
// tier breaks this const's test (REQ-018).
|
||||
PartnerTierCount = 4
|
||||
)
|
||||
|
||||
// PartnerTier enumerates the four partner tiers (vision §13, REQ-018, D-026).
|
||||
// Op processes Pass-Acts; MasterOp is a senior Op; Pier is a credential /
|
||||
// identity provider (e-Residency/biometrics); Anchor is institutional.
|
||||
// "Op" is used (not "operator" — the latter implies a banned financial term
|
||||
// per RESEARCH §1.6; "Op" is vision-§13 lexicon-clean).
|
||||
type PartnerTier string
|
||||
|
||||
const (
|
||||
TierOp PartnerTier = "Op" // processes Pass-Acts
|
||||
TierMasterOp PartnerTier = "MasterOp" // senior Op
|
||||
TierPier PartnerTier = "Pier" // credential / identity provider
|
||||
TierAnchor PartnerTier = "Anchor" // institutional
|
||||
)
|
||||
|
||||
// AllPartnerTiers returns all four PartnerTier values in vision §13 order.
|
||||
// Locked-const test asserts exactly 4 entries with these names (REQ-018).
|
||||
func AllPartnerTiers() []PartnerTier {
|
||||
return []PartnerTier{
|
||||
TierOp,
|
||||
TierMasterOp,
|
||||
TierPier,
|
||||
TierAnchor,
|
||||
}
|
||||
}
|
||||
|
||||
// PartnerStatus enumerates the lifecycle states of a Partner (REQ-018).
|
||||
type PartnerStatus string
|
||||
|
||||
const (
|
||||
StatusPending PartnerStatus = "Pending" // partner registered, not yet active
|
||||
StatusActive PartnerStatus = "Active" // partner is live
|
||||
StatusSuspended PartnerStatus = "Suspended" // partner temporarily halted
|
||||
StatusRevoked PartnerStatus = "Revoked" // partner permanently revoked
|
||||
)
|
||||
|
||||
// PartnerStatusCount is the locked count of PartnerStatus enum values.
|
||||
const PartnerStatusCount = 4
|
||||
|
||||
// CredentialType enumerates the kinds of credentials a Pier can reference
|
||||
// (REQ-018). The ref-uri is opaque; Pier credential routing is deferred per
|
||||
// Q5 (v0.3 will wire the live routing). The skeleton defines the type enum
|
||||
// so genesis / registry entries carry a typed credential kind.
|
||||
type CredentialType string
|
||||
|
||||
const (
|
||||
CredentialEresidency CredentialType = "Eresidency" // e-Residency-style identity
|
||||
CredentialBiometric CredentialType = "Biometric" // biometric identity
|
||||
CredentialVouch CredentialType = "Vouch" // vouch-based attestation
|
||||
CredentialCustom CredentialType = "Custom" // opaque custom credential
|
||||
)
|
||||
|
||||
// CredentialRef references an external credential provider (REQ-018).
|
||||
// provider-id references a Partner (typically a Pier) by ID string
|
||||
// (G-003 by-ID-string invariant). ref-uri is an opaque URI; Pier credential
|
||||
// routing is deferred per Q5, so the skeleton keeps the ref opaque.
|
||||
type CredentialRef struct {
|
||||
ProviderID string `json:"provider_id" yaml:"provider_id"`
|
||||
CredentialType CredentialType `json:"credential_type" yaml:"credential_type"`
|
||||
RefURI string `json:"ref_uri" yaml:"ref_uri"`
|
||||
}
|
||||
|
||||
// Partner is a registered actor on the Partner Spectrum (vision §13, REQ-018).
|
||||
// reach-id references x/identity Reach by string (G-003 by-ID-string
|
||||
// invariant). credential-ref references a credential provider (typically a
|
||||
// Pier) by ID string. region is a free-form locale tag.
|
||||
type Partner struct {
|
||||
PartnerID string `json:"partner_id" yaml:"partner_id"`
|
||||
Tier PartnerTier `json:"tier" yaml:"tier"`
|
||||
Name string `json:"name" yaml:"name"`
|
||||
ReachID string `json:"reach_id" yaml:"reach_id"`
|
||||
Region string `json:"region" yaml:"region"`
|
||||
CredentialRef CredentialRef `json:"credential_ref" yaml:"credential_ref"`
|
||||
Status PartnerStatus `json:"status" yaml:"status"`
|
||||
}
|
||||
|
||||
// Keeper is a registry keeper stub for Partners (REQ-018). The skeleton
|
||||
// provides in-memory add/get/list/by-tier operations; v0.3 wires the live
|
||||
// keeper backed by the store. It is safe for concurrent use (the live keeper
|
||||
// will use the SDK store, which is single-threaded per-block; the stub uses
|
||||
// a mutex so the skeleton's tests can exercise concurrent paths).
|
||||
type Keeper struct {
|
||||
mu sync.Mutex
|
||||
partners map[string]Partner
|
||||
}
|
||||
|
||||
// NewKeeper returns an empty registry keeper stub.
|
||||
func NewKeeper() *Keeper {
|
||||
return &Keeper{partners: make(map[string]Partner)}
|
||||
}
|
||||
|
||||
// AddPartner registers a Partner by ID. Returns an error if the ID is empty
|
||||
// or already registered.
|
||||
func (k *Keeper) AddPartner(p Partner) error {
|
||||
if p.PartnerID == "" {
|
||||
return fmt.Errorf("partner: empty partner-id")
|
||||
}
|
||||
k.mu.Lock()
|
||||
defer k.mu.Unlock()
|
||||
if _, exists := k.partners[p.PartnerID]; exists {
|
||||
return fmt.Errorf("partner: duplicate partner-id %q", p.PartnerID)
|
||||
}
|
||||
k.partners[p.PartnerID] = p
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetPartner returns a Partner by ID and true, or zero-value and false.
|
||||
func (k *Keeper) GetPartner(id string) (Partner, bool) {
|
||||
k.mu.Lock()
|
||||
defer k.mu.Unlock()
|
||||
p, ok := k.partners[id]
|
||||
return p, ok
|
||||
}
|
||||
|
||||
// ListPartners returns all registered Partners (unordered).
|
||||
func (k *Keeper) ListPartners() []Partner {
|
||||
k.mu.Lock()
|
||||
defer k.mu.Unlock()
|
||||
out := make([]Partner, 0, len(k.partners))
|
||||
for _, p := range k.partners {
|
||||
out = append(out, p)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// ListByTier returns all registered Partners matching the given tier.
|
||||
func (k *Keeper) ListByTier(tier PartnerTier) []Partner {
|
||||
k.mu.Lock()
|
||||
defer k.mu.Unlock()
|
||||
out := []Partner{}
|
||||
for _, p := range k.partners {
|
||||
if p.Tier == tier {
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// Params for the partner module (skeleton — no tunables in v0.2).
|
||||
type Params struct{}
|
||||
|
||||
func DefaultParams() Params { return Params{} }
|
||||
|
||||
// GenesisState defines the partner module genesis state (REQ-018).
|
||||
// Partners is the top-level set; ValidateGenesis enforces partner-id uniqueness.
|
||||
type GenesisState struct {
|
||||
Params Params `json:"params" yaml:"params"`
|
||||
Partners []Partner `json:"partners" yaml:"partners"`
|
||||
}
|
||||
|
||||
func DefaultGenesisState() *GenesisState {
|
||||
return &GenesisState{
|
||||
Params: DefaultParams(),
|
||||
Partners: []Partner{},
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||
// no-op): rejects duplicate partner-ids.
|
||||
func ValidateGenesis(bz json.RawMessage) error {
|
||||
var gs GenesisState
|
||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
||||
return fmt.Errorf("partner: invalid genesis: %w", err)
|
||||
}
|
||||
seen := make(map[string]bool, len(gs.Partners))
|
||||
for _, p := range gs.Partners {
|
||||
if p.PartnerID == "" {
|
||||
return fmt.Errorf("partner: empty partner-id")
|
||||
}
|
||||
if seen[p.PartnerID] {
|
||||
return fmt.Errorf("partner: duplicate partner-id %q", p.PartnerID)
|
||||
}
|
||||
seen[p.PartnerID] = true
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,426 @@
|
||||
package types_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/lexicon"
|
||||
"github.com/oy/openyield/x/partner/types"
|
||||
)
|
||||
|
||||
// TestPartnerTierCountLockedConst asserts PartnerTierCount is exactly 4
|
||||
// and AllPartnerTiers() returns exactly 4 (vision §13, REQ-018, D-026). A
|
||||
// regression firewall: adding/removing/renaming a tier breaks this test.
|
||||
func TestPartnerTierCountLockedConst(t *testing.T) {
|
||||
if types.PartnerTierCount != 4 {
|
||||
t.Errorf("PartnerTierCount = %d, expected 4 (vision §13 LOCKED)", types.PartnerTierCount)
|
||||
}
|
||||
all := types.AllPartnerTiers()
|
||||
if len(all) != 4 {
|
||||
t.Errorf("AllPartnerTiers() len = %d, expected 4", len(all))
|
||||
}
|
||||
}
|
||||
|
||||
// TestAllPartnerTiersNames asserts the 4 vision §13 names in order with no
|
||||
// extras, no dups, no renames. "Op" (not "operator") per vision §13 — the
|
||||
// latter implies a banned financial term per RESEARCH §1.6; "Op" is
|
||||
// lexicon-clean.
|
||||
func TestAllPartnerTiersNames(t *testing.T) {
|
||||
want := []string{"Op", "MasterOp", "Pier", "Anchor"}
|
||||
all := types.AllPartnerTiers()
|
||||
if len(all) != len(want) {
|
||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for i, s := range all {
|
||||
if string(s) != want[i] {
|
||||
t.Errorf("AllPartnerTiers()[%d] = %q, want %q", i, s, want[i])
|
||||
}
|
||||
if seen[string(s)] {
|
||||
t.Errorf("duplicate PartnerTier %q", s)
|
||||
}
|
||||
seen[string(s)] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestPartnerTierValues asserts each named const matches its AllPartnerTiers
|
||||
// entry.
|
||||
func TestPartnerTierValues(t *testing.T) {
|
||||
if types.TierOp != "Op" {
|
||||
t.Errorf("TierOp = %q", types.TierOp)
|
||||
}
|
||||
if types.TierMasterOp != "MasterOp" {
|
||||
t.Errorf("TierMasterOp = %q", types.TierMasterOp)
|
||||
}
|
||||
if types.TierPier != "Pier" {
|
||||
t.Errorf("TierPier = %q", types.TierPier)
|
||||
}
|
||||
if types.TierAnchor != "Anchor" {
|
||||
t.Errorf("TierAnchor = %q", types.TierAnchor)
|
||||
}
|
||||
}
|
||||
|
||||
// TestPartnerStatusCountLockedConst asserts PartnerStatusCount is exactly 4.
|
||||
func TestPartnerStatusCountLockedConst(t *testing.T) {
|
||||
if types.PartnerStatusCount != 4 {
|
||||
t.Errorf("PartnerStatusCount = %d, expected 4", types.PartnerStatusCount)
|
||||
}
|
||||
}
|
||||
|
||||
// TestPartnerStatusEnumCoverage asserts all four PartnerStatus values are
|
||||
// distinct and non-empty (REQ-018 lifecycle: Pending, Active, Suspended, Revoked).
|
||||
func TestPartnerStatusEnumCoverage(t *testing.T) {
|
||||
statuses := []types.PartnerStatus{
|
||||
types.StatusPending, types.StatusActive,
|
||||
types.StatusSuspended, types.StatusRevoked,
|
||||
}
|
||||
if len(statuses) != 4 {
|
||||
t.Errorf("expected 4 PartnerStatus consts, got %d", len(statuses))
|
||||
}
|
||||
seen := map[types.PartnerStatus]bool{}
|
||||
for _, s := range statuses {
|
||||
if s == "" {
|
||||
t.Error("empty PartnerStatus")
|
||||
}
|
||||
if seen[s] {
|
||||
t.Errorf("duplicate PartnerStatus %q", s)
|
||||
}
|
||||
seen[s] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestCredentialTypeEnumCoverage asserts the CredentialType values are
|
||||
// distinct and non-empty (Pier credential routing deferred per Q5; the
|
||||
// enum is the typed kind for genesis / registry entries).
|
||||
func TestCredentialTypeEnumCoverage(t *testing.T) {
|
||||
cts := []types.CredentialType{
|
||||
types.CredentialEresidency, types.CredentialBiometric,
|
||||
types.CredentialVouch, types.CredentialCustom,
|
||||
}
|
||||
if len(cts) != 4 {
|
||||
t.Errorf("expected 4 CredentialType consts, got %d", len(cts))
|
||||
}
|
||||
seen := map[types.CredentialType]bool{}
|
||||
for _, c := range cts {
|
||||
if c == "" {
|
||||
t.Error("empty CredentialType")
|
||||
}
|
||||
if seen[c] {
|
||||
t.Errorf("duplicate CredentialType %q", c)
|
||||
}
|
||||
seen[c] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestCredentialRefStruct asserts CredentialRef carries all required fields
|
||||
// (provider-id, credential-type, ref-uri — opaque URI).
|
||||
func TestCredentialRefStruct(t *testing.T) {
|
||||
c := types.CredentialRef{
|
||||
ProviderID: "pier-1",
|
||||
CredentialType: types.CredentialEresidency,
|
||||
RefURI: "oy:cred:pier-1/eresidency/abc123",
|
||||
}
|
||||
if c.ProviderID != "pier-1" || c.CredentialType != types.CredentialEresidency ||
|
||||
c.RefURI != "oy:cred:pier-1/eresidency/abc123" {
|
||||
t.Error("CredentialRef fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestPartnerStructFields asserts Partner carries all required fields
|
||||
// including the by-ID-string reach-id (G-003).
|
||||
func TestPartnerStructFields(t *testing.T) {
|
||||
p := types.Partner{
|
||||
PartnerID: "pt1",
|
||||
Tier: types.TierPier,
|
||||
Name: "Pier One",
|
||||
ReachID: "reach:pier-1",
|
||||
Region: "EU",
|
||||
CredentialRef: types.CredentialRef{
|
||||
ProviderID: "pier-1",
|
||||
CredentialType: types.CredentialBiometric,
|
||||
RefURI: "oy:cred:bio/x",
|
||||
},
|
||||
Status: types.StatusActive,
|
||||
}
|
||||
if p.PartnerID != "pt1" || p.Tier != types.TierPier || p.Name != "Pier One" ||
|
||||
p.ReachID != "reach:pier-1" || p.Region != "EU" ||
|
||||
p.CredentialRef.ProviderID != "pier-1" || p.Status != types.StatusActive {
|
||||
t.Error("Partner fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// --- Registry keeper stub tests (REQ-018) ---------------------------------------
|
||||
|
||||
// TestKeeperAddGetRoundTrip asserts AddPartner + GetPartner round-trips a
|
||||
// Partner by ID.
|
||||
func TestKeeperAddGetRoundTrip(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
p := types.Partner{
|
||||
PartnerID: "pt1",
|
||||
Tier: types.TierOp,
|
||||
Name: "Op One",
|
||||
ReachID: "reach:op-1",
|
||||
Status: types.StatusActive,
|
||||
}
|
||||
if err := k.AddPartner(p); err != nil {
|
||||
t.Fatalf("AddPartner: %v", err)
|
||||
}
|
||||
got, ok := k.GetPartner("pt1")
|
||||
if !ok {
|
||||
t.Fatal("GetPartner: not found")
|
||||
}
|
||||
if got.PartnerID != "pt1" || got.Tier != types.TierOp {
|
||||
t.Errorf("GetPartner returned wrong Partner: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
// TestKeeperAddPartnerRejectsEmptyID asserts AddPartner rejects an empty id.
|
||||
func TestKeeperAddPartnerRejectsEmptyID(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
if err := k.AddPartner(types.Partner{PartnerID: ""}); err == nil {
|
||||
t.Error("AddPartner should reject empty partner-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestKeeperAddPartnerRejectsDup asserts AddPartner rejects a duplicate id.
|
||||
func TestKeeperAddPartnerRejectsDup(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
p := types.Partner{PartnerID: "pt1", Tier: types.TierOp}
|
||||
if err := k.AddPartner(p); err != nil {
|
||||
t.Fatalf("first AddPartner: %v", err)
|
||||
}
|
||||
if err := k.AddPartner(p); err == nil {
|
||||
t.Error("AddPartner should reject duplicate partner-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestKeeperGetPartnerMissing asserts GetPartner returns false for an
|
||||
// unregistered id.
|
||||
func TestKeeperGetPartnerMissing(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
if _, ok := k.GetPartner("nope"); ok {
|
||||
t.Error("GetPartner should return false for unregistered id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestKeeperListPartners asserts ListPartners returns all registered Partners.
|
||||
func TestKeeperListPartners(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
_ = k.AddPartner(types.Partner{PartnerID: "a", Tier: types.TierOp})
|
||||
_ = k.AddPartner(types.Partner{PartnerID: "b", Tier: types.TierAnchor})
|
||||
list := k.ListPartners()
|
||||
if len(list) != 2 {
|
||||
t.Errorf("ListPartners len = %d, want 2", len(list))
|
||||
}
|
||||
}
|
||||
|
||||
// TestKeeperListPartnersEmpty asserts ListPartners on an empty keeper returns
|
||||
// a non-nil empty slice (or a usable slice).
|
||||
func TestKeeperListPartnersEmpty(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
list := k.ListPartners()
|
||||
if list == nil {
|
||||
t.Fatal("ListPartners returned nil")
|
||||
}
|
||||
if len(list) != 0 {
|
||||
t.Errorf("ListPartners len = %d, want 0", len(list))
|
||||
}
|
||||
}
|
||||
|
||||
// TestKeeperListByTier asserts ListByTier returns only Partners matching the
|
||||
// given tier (REQ-018 round-trip).
|
||||
func TestKeeperListByTier(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
_ = k.AddPartner(types.Partner{PartnerID: "op1", Tier: types.TierOp})
|
||||
_ = k.AddPartner(types.Partner{PartnerID: "op2", Tier: types.TierOp})
|
||||
_ = k.AddPartner(types.Partner{PartnerID: "mop1", Tier: types.TierMasterOp})
|
||||
_ = k.AddPartner(types.Partner{PartnerID: "pier1", Tier: types.TierPier})
|
||||
_ = k.AddPartner(types.Partner{PartnerID: "anc1", Tier: types.TierAnchor})
|
||||
|
||||
tt := []struct {
|
||||
tier types.PartnerTier
|
||||
wantN int
|
||||
}{
|
||||
{types.TierOp, 2},
|
||||
{types.TierMasterOp, 1},
|
||||
{types.TierPier, 1},
|
||||
{types.TierAnchor, 1},
|
||||
}
|
||||
for _, tc := range tt {
|
||||
t.Run(string(tc.tier), func(t *testing.T) {
|
||||
got := k.ListByTier(tc.tier)
|
||||
if len(got) != tc.wantN {
|
||||
t.Errorf("ListByTier(%q) len = %d, want %d", tc.tier, len(got), tc.wantN)
|
||||
}
|
||||
for _, p := range got {
|
||||
if p.Tier != tc.tier {
|
||||
t.Errorf("ListByTier(%q) returned Partner with tier %q", tc.tier, p.Tier)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestKeeperListByTierEmpty asserts ListByTier returns an empty (non-nil)
|
||||
// slice when no Partners match.
|
||||
func TestKeeperListByTierEmpty(t *testing.T) {
|
||||
k := types.NewKeeper()
|
||||
got := k.ListByTier(types.TierAnchor)
|
||||
if got == nil {
|
||||
t.Fatal("ListByTier returned nil")
|
||||
}
|
||||
if len(got) != 0 {
|
||||
t.Errorf("ListByTier len = %d, want 0", len(got))
|
||||
}
|
||||
}
|
||||
|
||||
// --- Genesis tests (REQ-018, A-212) ----------------------------------------------
|
||||
|
||||
// TestDefaultGenesisStateEmpty asserts DefaultGenesisState returns a non-nil
|
||||
// empty slice for Partners.
|
||||
func TestDefaultGenesisStateEmpty(t *testing.T) {
|
||||
gs := types.DefaultGenesisState()
|
||||
if gs == nil {
|
||||
t.Fatal("DefaultGenesisState returned nil")
|
||||
}
|
||||
if gs.Partners == nil || len(gs.Partners) != 0 {
|
||||
t.Errorf("Default Partners should be non-nil empty slice; got len=%d nil=%v", len(gs.Partners), gs.Partners == nil)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsDupPartnerIDs asserts A-212: duplicate partner-ids
|
||||
// are rejected.
|
||||
func TestValidateGenesisRejectsDupPartnerIDs(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Partners: []types.Partner{
|
||||
{PartnerID: "pt1", Tier: types.TierOp},
|
||||
{PartnerID: "pt1", Tier: types.TierAnchor}, // dup
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject duplicate partner-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsEmptyPartnerID asserts empty partner-id is rejected.
|
||||
func TestValidateGenesisRejectsEmptyPartnerID(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Partners: []types.Partner{{PartnerID: "", Tier: types.TierOp}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject empty partner-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsBadJSON asserts malformed JSON is rejected.
|
||||
func TestValidateGenesisRejectsBadJSON(t *testing.T) {
|
||||
if err := types.ValidateGenesis(json.RawMessage(`{not json`)); err == nil {
|
||||
t.Error("ValidateGenesis should reject malformed JSON")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisAcceptsClean asserts a clean genesis validates.
|
||||
func TestValidateGenesisAcceptsClean(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Partners: []types.Partner{
|
||||
{PartnerID: "pt1", Tier: types.TierOp, Status: types.StatusActive},
|
||||
{PartnerID: "pt2", Tier: types.TierPier, Status: types.StatusPending},
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept clean genesis, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestModuleConsts asserts the four Cosmos-convention module consts.
|
||||
func TestModuleConsts(t *testing.T) {
|
||||
if types.ModuleName != "partner" {
|
||||
t.Errorf("ModuleName = %q", types.ModuleName)
|
||||
}
|
||||
if types.StoreKey != "partner" {
|
||||
t.Errorf("StoreKey = %q", types.StoreKey)
|
||||
}
|
||||
if types.RouterKey != "partner" {
|
||||
t.Errorf("RouterKey = %q", types.RouterKey)
|
||||
}
|
||||
if types.QuerierRoute != "partner" {
|
||||
t.Errorf("QuerierRoute = %q", types.QuerierRoute)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultParams asserts DefaultParams returns a zero-value Params.
|
||||
func TestDefaultParams(t *testing.T) {
|
||||
_ = types.DefaultParams() // no panics
|
||||
}
|
||||
|
||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
||||
|
||||
// TestLexiconNoBannedTermsInPartnerPackage scans every non-test .go file in
|
||||
// the partner/types package directory for the 9 banned terms (case-insensitive).
|
||||
// Production files only — the test file references banned terms via the
|
||||
// lexicon package helpers (standard lexicon-test bootstrapping pattern; no
|
||||
// banned literals are inlined in this test file).
|
||||
func TestLexiconNoBannedTermsInPartnerPackage(t *testing.T) {
|
||||
pkgDir := packageDir(t, "github.com/oy/openyield/x/partner/types")
|
||||
files, err := filepath.Glob(filepath.Join(pkgDir, "*.go"))
|
||||
if err != nil {
|
||||
t.Fatalf("glob: %v", err)
|
||||
}
|
||||
prodFiles := []string{}
|
||||
for _, f := range files {
|
||||
if strings.HasSuffix(f, "_test.go") {
|
||||
continue
|
||||
}
|
||||
prodFiles = append(prodFiles, f)
|
||||
}
|
||||
if len(prodFiles) == 0 {
|
||||
t.Fatal("no production .go files found in partner/types")
|
||||
}
|
||||
for _, f := range prodFiles {
|
||||
bz, err := os.ReadFile(f)
|
||||
if err != nil {
|
||||
t.Fatalf("read %s: %v", f, err)
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
t.Errorf("%s: banned term %q (REQ-012 lexicon firewall)", filepath.Base(f), found)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestLexiconNoBannedTermsInPartnerTestFile asserts this test file itself does
|
||||
// not contain any banned term as a literal (the firewall scans test files
|
||||
// too; the lexicon helpers must be used rather than inlining banned terms).
|
||||
func TestLexiconNoBannedTermsInPartnerTestFile(t *testing.T) {
|
||||
_, thisFile, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
bz, err := os.ReadFile(thisFile)
|
||||
if err != nil {
|
||||
t.Fatalf("read self: %v", err)
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
t.Fatalf("partner test file contains banned term %q — use lexicon helpers, not literals", found)
|
||||
}
|
||||
}
|
||||
|
||||
// packageDir resolves a Go import path to its filesystem directory by
|
||||
// walking up from this test file (v0.2 skeleton has zero external deps).
|
||||
func packageDir(t *testing.T, importPath string) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
// file = .../oy/x/partner/types/types_test.go -> repoRoot = .../oy (4 dirs up)
|
||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(file))))
|
||||
rel := strings.TrimPrefix(importPath, "github.com/oy/openyield/")
|
||||
return filepath.Join(repoRoot, rel)
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
package types
|
||||
|
||||
import "fmt"
|
||||
|
||||
// genesis.go holds the data-engineer's genesis schema helpers for the stand
|
||||
// module (G-008 split). ValidateGenesis in types.go composes these helpers;
|
||||
// the security-engineer's test assertions live in genesis_test.go.
|
||||
//
|
||||
// The Stand genesis schema is a membership-set: Stands (the organizational
|
||||
// forms) + Memberships (the membership edges). The two top-level invariants
|
||||
// are stand-id uniqueness and member-reach uniqueness within a stand
|
||||
// (REQ-016, A-212 upgrade from v0.1's no-op ValidateGenesis).
|
||||
|
||||
// ValidateStands asserts stand-ids are present and unique.
|
||||
func ValidateStands(stands []Stand) error {
|
||||
seen := make(map[string]bool, len(stands))
|
||||
for i, s := range stands {
|
||||
if s.StandID == "" {
|
||||
return fmt.Errorf("stand [%d]: empty stand-id", i)
|
||||
}
|
||||
if seen[s.StandID] {
|
||||
return fmt.Errorf("stand: duplicate stand-id %q", s.StandID)
|
||||
}
|
||||
seen[s.StandID] = true
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ValidateMemberships asserts the membership-set invariant: the (stand-id,
|
||||
// reach-id) pair is unique across the membership set — i.e. a reach can be
|
||||
// a member of a stand at most once. The same reach MAY be a member of
|
||||
// different stands (uniqueness is per-stand, not global).
|
||||
func ValidateMemberships(memberships []Membership) error {
|
||||
seen := make(map[string]bool, len(memberships))
|
||||
for i, m := range memberships {
|
||||
if m.StandID == "" {
|
||||
return fmt.Errorf("membership [%d]: empty stand-id", i)
|
||||
}
|
||||
if m.ReachID == "" {
|
||||
return fmt.Errorf("membership [%d]: empty reach-id", i)
|
||||
}
|
||||
key := m.StandID + "/" + m.ReachID
|
||||
if seen[key] {
|
||||
return fmt.Errorf("membership: duplicate member-reach %q in stand %q", m.ReachID, m.StandID)
|
||||
}
|
||||
seen[key] = true
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
package types_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/x/stand/types"
|
||||
)
|
||||
|
||||
// genesis_test.go holds the security-engineer's test assertions for the
|
||||
// data-engineer's genesis.go schema (G-008 split). The locked-const,
|
||||
// enum-coverage, and lexicon assertions live in types_test.go.
|
||||
|
||||
// TestValidateStandsRejectsDup asserts ValidateStands rejects duplicate
|
||||
// stand-ids (the membership-set's top-level invariant).
|
||||
func TestValidateStandsRejectsDup(t *testing.T) {
|
||||
stands := []types.Stand{
|
||||
{StandID: "s1"},
|
||||
{StandID: "s1"},
|
||||
}
|
||||
if err := types.ValidateStands(stands); err == nil {
|
||||
t.Error("ValidateStands should reject duplicate stand-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateStandsRejectsEmpty asserts empty stand-id is rejected.
|
||||
func TestValidateStandsRejectsEmpty(t *testing.T) {
|
||||
stands := []types.Stand{{StandID: ""}}
|
||||
if err := types.ValidateStands(stands); err == nil {
|
||||
t.Error("ValidateStands should reject empty stand-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateStandsAcceptsUnique asserts a clean stand set validates.
|
||||
func TestValidateStandsAcceptsUnique(t *testing.T) {
|
||||
stands := []types.Stand{{StandID: "s1"}, {StandID: "s2"}}
|
||||
if err := types.ValidateStands(stands); err != nil {
|
||||
t.Errorf("ValidateStands should accept unique ids, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateMembershipsRejectsDupWithinStand asserts the membership-set
|
||||
// invariant: (stand-id, reach-id) pair must be unique.
|
||||
func TestValidateMembershipsRejectsDupWithinStand(t *testing.T) {
|
||||
m := []types.Membership{
|
||||
{StandID: "s1", ReachID: "reach:a"},
|
||||
{StandID: "s1", ReachID: "reach:a"}, // dup within stand
|
||||
}
|
||||
if err := types.ValidateMemberships(m); err == nil {
|
||||
t.Error("ValidateMemberships should reject duplicate (stand-id, reach-id)")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateMembershipsAcceptsSameReachDifferentStands asserts the same
|
||||
// reach can join different stands (uniqueness is per-stand, not global).
|
||||
func TestValidateMembershipsAcceptsSameReachDifferentStands(t *testing.T) {
|
||||
m := []types.Membership{
|
||||
{StandID: "s1", ReachID: "reach:a"},
|
||||
{StandID: "s2", ReachID: "reach:a"}, // ok
|
||||
}
|
||||
if err := types.ValidateMemberships(m); err != nil {
|
||||
t.Errorf("ValidateMemberships should accept same reach in different stands, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateMembershipsRejectsEmptyFields asserts empty stand-id or
|
||||
// reach-id is rejected (every membership edge must be fully identified).
|
||||
func TestValidateMembershipsRejectsEmptyFields(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
m []types.Membership
|
||||
}{
|
||||
{"empty stand-id", []types.Membership{{StandID: "", ReachID: "reach:a"}}},
|
||||
{"empty reach-id", []types.Membership{{StandID: "s1", ReachID: ""}}},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if err := types.ValidateMemberships(tc.m); err == nil {
|
||||
t.Error("ValidateMemberships should reject empty fields")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateMembershipsEmptyOK asserts an empty membership set validates.
|
||||
func TestValidateMembershipsEmptyOK(t *testing.T) {
|
||||
if err := types.ValidateMemberships(nil); err != nil {
|
||||
t.Errorf("ValidateMemberships(nil) should be nil, got: %v", err)
|
||||
}
|
||||
if err := types.ValidateMemberships([]types.Membership{}); err != nil {
|
||||
t.Errorf("ValidateMemberships([]) should be nil, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisComposesBoth asserts ValidateGenesis composes both
|
||||
// ValidateStands and ValidateMemberships.
|
||||
func TestValidateGenesisComposesBoth(t *testing.T) {
|
||||
// clean stands but dup membership — should fail
|
||||
gs := types.GenesisState{
|
||||
Stands: []types.Stand{{StandID: "s1"}},
|
||||
Memberships: []types.Membership{
|
||||
{StandID: "s1", ReachID: "reach:a"},
|
||||
{StandID: "s1", ReachID: "reach:a"},
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject dup membership even with clean stands")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisClean asserts a fully clean genesis validates.
|
||||
func TestValidateGenesisClean(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Stands: []types.Stand{{StandID: "s1"}, {StandID: "s2"}},
|
||||
Memberships: []types.Membership{
|
||||
{StandID: "s1", ReachID: "reach:a"},
|
||||
{StandID: "s2", ReachID: "reach:a"},
|
||||
{StandID: "s1", ReachID: "reach:b"},
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept clean genesis, got: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
package types
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
const (
|
||||
ModuleName = "stand"
|
||||
StoreKey = ModuleName
|
||||
RouterKey = ModuleName
|
||||
QuerierRoute = ModuleName
|
||||
|
||||
// StandTypeCount is the locked count of StandType enum values (vision §11).
|
||||
// A regression firewall: adding/removing/renaming a Stand type breaks this
|
||||
// const's test.
|
||||
StandTypeCount = 9
|
||||
)
|
||||
|
||||
// StandType enumerates the nine organizational forms (vision §11, REQ-016).
|
||||
// All nine are treated uniformly in v0.2 (A-213: the Shadow Stand behavioral
|
||||
// split is deferred to v0.3 design).
|
||||
type StandType string
|
||||
|
||||
const (
|
||||
StandHousehold StandType = "Household"
|
||||
StandCrew StandType = "Crew"
|
||||
StandEntity StandType = "Entity"
|
||||
StandCoop StandType = "Co-op"
|
||||
StandCircle StandType = "Circle"
|
||||
StandTrust StandType = "Trust"
|
||||
StandFoundation StandType = "Foundation"
|
||||
StandConfederation StandType = "Confederation"
|
||||
StandShadow StandType = "Shadow"
|
||||
)
|
||||
|
||||
// AllStandTypes returns all nine StandType values in vision §11 order.
|
||||
// Locked-const test asserts exactly 9 entries with these names (REQ-016).
|
||||
func AllStandTypes() []StandType {
|
||||
return []StandType{
|
||||
StandHousehold,
|
||||
StandCrew,
|
||||
StandEntity,
|
||||
StandCoop,
|
||||
StandCircle,
|
||||
StandTrust,
|
||||
StandFoundation,
|
||||
StandConfederation,
|
||||
StandShadow,
|
||||
}
|
||||
}
|
||||
|
||||
// Stand is a governed group holding a Vault (vision §11, REQ-016).
|
||||
// Modeled on Cosmos SDK x/group (a group of members with a decision policy
|
||||
// governing a Vault). admin-reach references a Reach ID (by-ID-string, G-003);
|
||||
// vault-id references x/vault by ID string (no struct import).
|
||||
type Stand struct {
|
||||
StandID string `json:"stand_id" yaml:"stand_id"`
|
||||
Type StandType `json:"type" yaml:"type"`
|
||||
Name string `json:"name" yaml:"name"`
|
||||
VaultID string `json:"vault_id" yaml:"vault_id"`
|
||||
AdminReach string `json:"admin_reach" yaml:"admin_reach"`
|
||||
CreatedAt int64 `json:"created_at" yaml:"created_at"`
|
||||
MemberCount uint32 `json:"member_count" yaml:"member_count"`
|
||||
}
|
||||
|
||||
// StandRole enumerates member roles within a Stand.
|
||||
type StandRole string
|
||||
|
||||
const (
|
||||
RoleMember StandRole = "Member"
|
||||
RoleAdmin StandRole = "Admin"
|
||||
RoleObserver StandRole = "Observer"
|
||||
)
|
||||
|
||||
// Membership is a Stand membership edge (REQ-016). stand-id references
|
||||
// x/stand by ID string; reach-id references x/identity Reach by string
|
||||
// (G-003 by-ID-string invariant).
|
||||
type Membership struct {
|
||||
StandID string `json:"stand_id" yaml:"stand_id"`
|
||||
ReachID string `json:"reach_id" yaml:"reach_id"`
|
||||
JoinedAt int64 `json:"joined_at" yaml:"joined_at"`
|
||||
Role StandRole `json:"role" yaml:"role"`
|
||||
}
|
||||
|
||||
// StandPolicy is a stub for a Stand's decision policy (A-205).
|
||||
// Mirrors x/group DecisionPolicy: threshold (N-of-M) OR weighted (sum of
|
||||
// weights >= threshold). The skeleton does not enforce the policy; v0.3
|
||||
// wires the live aggregation. Exactly one of Threshold/Weighted should be
|
||||
// non-zero in the live object; the skeleton keeps both as fields for
|
||||
// future-wiring symmetry with x/group.
|
||||
type StandPolicy struct {
|
||||
Threshold uint32 `json:"threshold" yaml:"threshold"`
|
||||
Weighted bool `json:"weighted" yaml:"weighted"`
|
||||
}
|
||||
|
||||
// Params for the stand module (skeleton — no tunables in v0.2).
|
||||
type Params struct{}
|
||||
|
||||
func DefaultParams() Params { return Params{} }
|
||||
|
||||
// GenesisState defines the stand module genesis state (REQ-016).
|
||||
// Stands + Memberships are the two top-level sets; ValidateGenesis enforces
|
||||
// stand-id uniqueness and member-reach uniqueness within a stand.
|
||||
type GenesisState struct {
|
||||
Params Params `json:"params" yaml:"params"`
|
||||
Stands []Stand `json:"stands" yaml:"stands"`
|
||||
Memberships []Membership `json:"memberships" yaml:"memberships"`
|
||||
}
|
||||
|
||||
func DefaultGenesisState() *GenesisState {
|
||||
return &GenesisState{
|
||||
Params: DefaultParams(),
|
||||
Stands: []Stand{},
|
||||
Memberships: []Membership{},
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||
// no-op): rejects duplicate stand-ids and duplicate (stand-id, reach-id)
|
||||
// membership pairs. The membership-set invariant is "a reach can be a
|
||||
// member of a stand at most once; the same reach may join different stands".
|
||||
// Validation is delegated to the data-engineer's genesis.go helpers (G-008).
|
||||
func ValidateGenesis(bz json.RawMessage) error {
|
||||
var gs GenesisState
|
||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
||||
return fmt.Errorf("stand: invalid genesis: %w", err)
|
||||
}
|
||||
if err := ValidateStands(gs.Stands); err != nil {
|
||||
return fmt.Errorf("stand: %w", err)
|
||||
}
|
||||
if err := ValidateMemberships(gs.Memberships); err != nil {
|
||||
return fmt.Errorf("stand: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,295 @@
|
||||
package types_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/lexicon"
|
||||
"github.com/oy/openyield/x/stand/types"
|
||||
)
|
||||
|
||||
// TestStandTypeCountLockedConst asserts AllStandTypes() returns exactly 9
|
||||
// (vision §11). A regression firewall: adding/removing/renaming a Stand type
|
||||
// breaks this test (REQ-016).
|
||||
func TestStandTypeCountLockedConst(t *testing.T) {
|
||||
if types.StandTypeCount != 9 {
|
||||
t.Errorf("StandTypeCount = %d, expected 9 (vision §11 LOCKED)", types.StandTypeCount)
|
||||
}
|
||||
all := types.AllStandTypes()
|
||||
if len(all) != 9 {
|
||||
t.Errorf("AllStandTypes() len = %d, expected 9", len(all))
|
||||
}
|
||||
}
|
||||
|
||||
// TestAllStandTypesNames asserts the 9 vision §11 names in order with no
|
||||
// extras, no dups, no renames.
|
||||
func TestAllStandTypesNames(t *testing.T) {
|
||||
want := []string{
|
||||
"Household", "Crew", "Entity", "Co-op", "Circle",
|
||||
"Trust", "Foundation", "Confederation", "Shadow",
|
||||
}
|
||||
all := types.AllStandTypes()
|
||||
if len(all) != len(want) {
|
||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for i, s := range all {
|
||||
if string(s) != want[i] {
|
||||
t.Errorf("AllStandTypes()[%d] = %q, want %q", i, s, want[i])
|
||||
}
|
||||
if seen[string(s)] {
|
||||
t.Errorf("duplicate StandType %q", s)
|
||||
}
|
||||
seen[string(s)] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestStandTypeValues asserts each named const matches its AllStandTypes entry.
|
||||
func TestStandTypeValues(t *testing.T) {
|
||||
if types.StandHousehold != "Household" {
|
||||
t.Errorf("StandHousehold = %q", types.StandHousehold)
|
||||
}
|
||||
if types.StandCrew != "Crew" {
|
||||
t.Errorf("StandCrew = %q", types.StandCrew)
|
||||
}
|
||||
if types.StandEntity != "Entity" {
|
||||
t.Errorf("StandEntity = %q", types.StandEntity)
|
||||
}
|
||||
if types.StandCoop != "Co-op" {
|
||||
t.Errorf("StandCoop = %q", types.StandCoop)
|
||||
}
|
||||
if types.StandCircle != "Circle" {
|
||||
t.Errorf("StandCircle = %q", types.StandCircle)
|
||||
}
|
||||
if types.StandTrust != "Trust" {
|
||||
t.Errorf("StandTrust = %q", types.StandTrust)
|
||||
}
|
||||
if types.StandFoundation != "Foundation" {
|
||||
t.Errorf("StandFoundation = %q", types.StandFoundation)
|
||||
}
|
||||
if types.StandConfederation != "Confederation" {
|
||||
t.Errorf("StandConfederation = %q", types.StandConfederation)
|
||||
}
|
||||
if types.StandShadow != "Shadow" {
|
||||
t.Errorf("StandShadow = %q", types.StandShadow)
|
||||
}
|
||||
}
|
||||
|
||||
// TestStandRoleEnumCoverage asserts the three StandRole values.
|
||||
func TestStandRoleEnumCoverage(t *testing.T) {
|
||||
roles := []types.StandRole{types.RoleMember, types.RoleAdmin, types.RoleObserver}
|
||||
if len(roles) != 3 {
|
||||
t.Errorf("expected 3 StandRole consts, got %d", len(roles))
|
||||
}
|
||||
seen := map[types.StandRole]bool{}
|
||||
for _, r := range roles {
|
||||
if r == "" {
|
||||
t.Error("empty StandRole")
|
||||
}
|
||||
if seen[r] {
|
||||
t.Errorf("duplicate StandRole %q", r)
|
||||
}
|
||||
seen[r] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestStandStructFields asserts Stand carries all required fields.
|
||||
func TestStandStructFields(t *testing.T) {
|
||||
s := types.Stand{
|
||||
StandID: "s1",
|
||||
Type: types.StandHousehold,
|
||||
Name: "Household A",
|
||||
VaultID: "v1",
|
||||
AdminReach: "reach:admin",
|
||||
CreatedAt: 100,
|
||||
MemberCount: 3,
|
||||
}
|
||||
if s.StandID != "s1" || s.Type != types.StandHousehold || s.Name != "Household A" ||
|
||||
s.VaultID != "v1" || s.AdminReach != "reach:admin" || s.CreatedAt != 100 ||
|
||||
s.MemberCount != 3 {
|
||||
t.Error("Stand fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestMembershipStructFields asserts Membership carries all required fields.
|
||||
func TestMembershipStructFields(t *testing.T) {
|
||||
m := types.Membership{
|
||||
StandID: "s1",
|
||||
ReachID: "reach:member",
|
||||
JoinedAt: 200,
|
||||
Role: types.RoleMember,
|
||||
}
|
||||
if m.StandID != "s1" || m.ReachID != "reach:member" || m.JoinedAt != 200 ||
|
||||
m.Role != types.RoleMember {
|
||||
t.Error("Membership fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestStandPolicyStub asserts StandPolicy carries threshold + weighted fields
|
||||
// (A-205 mirrors x/group DecisionPolicy).
|
||||
func TestStandPolicyStub(t *testing.T) {
|
||||
p := types.StandPolicy{Threshold: 5, Weighted: false}
|
||||
if p.Threshold != 5 || p.Weighted != false {
|
||||
t.Error("StandPolicy fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultGenesisStateEmpty asserts DefaultGenesisState returns non-nil
|
||||
// empty slices for Stands and Memberships.
|
||||
func TestDefaultGenesisStateEmpty(t *testing.T) {
|
||||
gs := types.DefaultGenesisState()
|
||||
if gs == nil {
|
||||
t.Fatal("DefaultGenesisState returned nil")
|
||||
}
|
||||
if gs.Stands == nil || len(gs.Stands) != 0 {
|
||||
t.Errorf("Default Stands should be non-nil empty slice; got len=%d nil=%v", len(gs.Stands), gs.Stands == nil)
|
||||
}
|
||||
if gs.Memberships == nil || len(gs.Memberships) != 0 {
|
||||
t.Errorf("Default Memberships should be non-nil empty slice; got len=%d nil=%v", len(gs.Memberships), gs.Memberships == nil)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsDupStandIDs asserts A-212: duplicate stand-ids
|
||||
// are rejected.
|
||||
func TestValidateGenesisRejectsDupStandIDs(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Stands: []types.Stand{
|
||||
{StandID: "s1"},
|
||||
{StandID: "s1"}, // dup
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject duplicate stand-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsDupMemberReach asserts A-212: duplicate
|
||||
// (stand-id, reach-id) membership pairs are rejected.
|
||||
func TestValidateGenesisRejectsDupMemberReach(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Memberships: []types.Membership{
|
||||
{StandID: "s1", ReachID: "reach:a"},
|
||||
{StandID: "s1", ReachID: "reach:a"}, // dup within same stand
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject duplicate member-reach within a stand")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisAcceptsSameReachInDifferentStands asserts the same
|
||||
// reach can be a member of two different stands (uniqueness is per-stand).
|
||||
func TestValidateGenesisAcceptsSameReachInDifferentStands(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Memberships: []types.Membership{
|
||||
{StandID: "s1", ReachID: "reach:a"},
|
||||
{StandID: "s2", ReachID: "reach:a"}, // ok — different stand
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept same reach in different stands, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsEmptyStandID asserts empty stand-id is rejected.
|
||||
func TestValidateGenesisRejectsEmptyStandID(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Stands: []types.Stand{{StandID: ""}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject empty stand-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsBadJSON asserts malformed JSON is rejected.
|
||||
func TestValidateGenesisRejectsBadJSON(t *testing.T) {
|
||||
if err := types.ValidateGenesis(json.RawMessage(`{bad`)); err == nil {
|
||||
t.Error("ValidateGenesis should reject malformed JSON")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisAcceptsClean asserts a clean genesis validates.
|
||||
func TestValidateGenesisAcceptsClean(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Stands: []types.Stand{{StandID: "s1"}, {StandID: "s2"}},
|
||||
Memberships: []types.Membership{{StandID: "s1", ReachID: "reach:a"}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept clean genesis, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestModuleConsts asserts the four Cosmos-convention module consts.
|
||||
func TestModuleConsts(t *testing.T) {
|
||||
if types.ModuleName != "stand" {
|
||||
t.Errorf("ModuleName = %q", types.ModuleName)
|
||||
}
|
||||
if types.StoreKey != "stand" {
|
||||
t.Errorf("StoreKey = %q", types.StoreKey)
|
||||
}
|
||||
if types.RouterKey != "stand" {
|
||||
t.Errorf("RouterKey = %q", types.RouterKey)
|
||||
}
|
||||
if types.QuerierRoute != "stand" {
|
||||
t.Errorf("QuerierRoute = %q", types.QuerierRoute)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultParams asserts DefaultParams returns a zero-value Params.
|
||||
func TestDefaultParams(t *testing.T) {
|
||||
_ = types.DefaultParams() // no panics
|
||||
}
|
||||
|
||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
||||
|
||||
// TestLexiconNoBannedTermsInStandPackage scans every non-test .go file in
|
||||
// the stand/types package directory for the 9 banned terms (case-insensitive).
|
||||
// Production files only — the test file contains the banned terms as the list
|
||||
// of things to forbid (standard lexicon-test bootstrapping pattern).
|
||||
func TestLexiconNoBannedTermsInStandPackage(t *testing.T) {
|
||||
pkgDir := packageDir(t, "github.com/oy/openyield/x/stand/types")
|
||||
files, err := filepath.Glob(filepath.Join(pkgDir, "*.go"))
|
||||
if err != nil {
|
||||
t.Fatalf("glob: %v", err)
|
||||
}
|
||||
prodFiles := []string{}
|
||||
for _, f := range files {
|
||||
if strings.HasSuffix(f, "_test.go") {
|
||||
continue
|
||||
}
|
||||
prodFiles = append(prodFiles, f)
|
||||
}
|
||||
if len(prodFiles) == 0 {
|
||||
t.Fatal("no production .go files found in stand/types")
|
||||
}
|
||||
for _, f := range prodFiles {
|
||||
bz, err := os.ReadFile(f)
|
||||
if err != nil {
|
||||
t.Fatalf("read %s: %v", f, err)
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
t.Errorf("%s: banned term %q (REQ-012 lexicon firewall)", filepath.Base(f), found)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// packageDir resolves a Go import path to its filesystem directory.
|
||||
func packageDir(t *testing.T, importPath string) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(file))))
|
||||
rel := strings.TrimPrefix(importPath, "github.com/oy/openyield/")
|
||||
return filepath.Join(repoRoot, rel)
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
package types
|
||||
|
||||
import "fmt"
|
||||
|
||||
// ValidateAuditLogs enforces the append-only audit-log invariants (REQ-015):
|
||||
// 1. entry-ids are unique (no duplicate entry-id in the slice)
|
||||
// 2. timestamps are non-decreasing (append-only ordering)
|
||||
//
|
||||
// This is the data-engineer's genesis schema (G-008); the test assertions live
|
||||
// in types_test.go (security-engineer's territory). Called by ValidateGenesis
|
||||
// in types.go.
|
||||
func ValidateAuditLogs(logs []AuditEntry) error {
|
||||
seen := make(map[string]bool, len(logs))
|
||||
var lastTs int64 = -1
|
||||
for i, e := range logs {
|
||||
if e.EntryID == "" {
|
||||
return fmt.Errorf("audit log [%d]: empty entry-id", i)
|
||||
}
|
||||
if seen[e.EntryID] {
|
||||
return fmt.Errorf("audit log: duplicate entry-id %q", e.EntryID)
|
||||
}
|
||||
seen[e.EntryID] = true
|
||||
if i > 0 && e.Timestamp < lastTs {
|
||||
return fmt.Errorf("audit log: timestamps must be non-decreasing (entry %q)", e.EntryID)
|
||||
}
|
||||
lastTs = e.Timestamp
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
package types_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/x/window/types"
|
||||
)
|
||||
|
||||
// genesis_test.go holds the security-engineer's test assertions for the
|
||||
// data-engineer's genesis.go schema (G-008 split). The general lifecycle
|
||||
// and lexicon tests live in types_test.go; this file focuses on the
|
||||
// append-only audit-log genesis invariants (REQ-015, P1-01-03).
|
||||
|
||||
// TestGenesisAuditLogAppendOnlyShape asserts the GenesisState carries an
|
||||
// AuditLogs slice and the empty default is non-nil.
|
||||
func TestGenesisAuditLogAppendOnlyShape(t *testing.T) {
|
||||
gs := types.DefaultGenesisState()
|
||||
if gs.AuditLogs == nil {
|
||||
t.Fatal("DefaultGenesisState.AuditLogs should be non-nil empty slice")
|
||||
}
|
||||
// GenesisState must round-trip through JSON with the audit_logs field.
|
||||
bz, err := json.Marshal(gs)
|
||||
if err != nil {
|
||||
t.Fatalf("marshal: %v", err)
|
||||
}
|
||||
var back types.GenesisState
|
||||
if err := json.Unmarshal(bz, &back); err != nil {
|
||||
t.Fatalf("unmarshal: %v", err)
|
||||
}
|
||||
if back.AuditLogs == nil {
|
||||
t.Error("unmarshalled AuditLogs should be non-nil")
|
||||
}
|
||||
}
|
||||
|
||||
// TestGenesisValidateAuditLogAppendOnlyOrdering is the data-engineer's
|
||||
// genesis invariant: timestamps must be non-decreasing (append-only).
|
||||
func TestGenesisValidateAuditLogAppendOnlyOrdering(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
logs []types.AuditEntry
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "single entry ok",
|
||||
logs: []types.AuditEntry{{EntryID: "e1", Timestamp: 100}},
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "equal timestamps ok (append-only allows equal)",
|
||||
logs: []types.AuditEntry{
|
||||
{EntryID: "e1", Timestamp: 100},
|
||||
{EntryID: "e2", Timestamp: 100},
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "strictly increasing ok",
|
||||
logs: []types.AuditEntry{
|
||||
{EntryID: "e1", Timestamp: 100},
|
||||
{EntryID: "e2", Timestamp: 200},
|
||||
{EntryID: "e3", Timestamp: 300},
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "decreasing rejected",
|
||||
logs: []types.AuditEntry{
|
||||
{EntryID: "e1", Timestamp: 300},
|
||||
{EntryID: "e2", Timestamp: 100},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
err := types.ValidateAuditLogs(tc.logs)
|
||||
if tc.wantErr && err == nil {
|
||||
t.Error("expected error, got nil")
|
||||
}
|
||||
if !tc.wantErr && err != nil {
|
||||
t.Errorf("expected nil, got: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestGenesisValidateAuditLogNoDupEntryIDs is the data-engineer's genesis
|
||||
// invariant: entry-ids must be unique.
|
||||
func TestGenesisValidateAuditLogNoDupEntryIDs(t *testing.T) {
|
||||
logs := []types.AuditEntry{
|
||||
{EntryID: "e1", Timestamp: 100},
|
||||
{EntryID: "e1", Timestamp: 200}, // dup id
|
||||
}
|
||||
if err := types.ValidateAuditLogs(logs); err == nil {
|
||||
t.Error("ValidateAuditLogs should reject duplicate entry-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestGenesisValidateAuditLogRejectsEmptyEntryID asserts the schema rejects
|
||||
// empty entry-ids (every audit entry must be identifiable).
|
||||
func TestGenesisValidateAuditLogRejectsEmptyEntryID(t *testing.T) {
|
||||
logs := []types.AuditEntry{{EntryID: "", Timestamp: 100}}
|
||||
if err := types.ValidateAuditLogs(logs); err == nil {
|
||||
t.Error("ValidateAuditLogs should reject empty entry-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestGenesisValidateGenesisSurfacesAuditLogErrors asserts ValidateGenesis
|
||||
// composes the audit-log validation into the full genesis validation.
|
||||
func TestGenesisValidateGenesisSurfacesAuditLogErrors(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Windows: []types.Window{{WindowID: "w1"}},
|
||||
AuditLogs: []types.AuditEntry{
|
||||
{EntryID: "e1", Timestamp: 200},
|
||||
{EntryID: "e2", Timestamp: 100}, // out of order
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should surface audit-log ordering error")
|
||||
}
|
||||
}
|
||||
|
||||
// TestGenesisValidateGenesisCleanAuditLog asserts a clean audit log passes
|
||||
// full genesis validation.
|
||||
func TestGenesisValidateGenesisCleanAuditLog(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Windows: []types.Window{{WindowID: "w1"}},
|
||||
AuditLogs: []types.AuditEntry{
|
||||
{EntryID: "e1", Timestamp: 100, Action: "open", Result: "ok", GranterRef: "reach:g"},
|
||||
{EntryID: "e2", Timestamp: 200, Action: "revoke", Result: "ok", GranterRef: "reach:g"},
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept clean audit log, got: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,175 @@
|
||||
package types
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
const (
|
||||
ModuleName = "window"
|
||||
StoreKey = ModuleName
|
||||
RouterKey = ModuleName
|
||||
QuerierRoute = ModuleName
|
||||
)
|
||||
|
||||
// ScopeKind enumerates the access scopes a Window can open (§4.4, REQ-015).
|
||||
// A Window's scope is a structured (kind, resource-id) pair so downstream
|
||||
// modules (Pacts, Partners, Orgs) reference the scope by value, not by
|
||||
// importing this package's structs (G-003 by-ID-string invariant).
|
||||
type ScopeKind string
|
||||
|
||||
const (
|
||||
ScopeReadStash ScopeKind = "ReadStash" // read a Holder's Stash
|
||||
ScopeReadStanding ScopeKind = "ReadStanding" // read a Reach's Standing
|
||||
ScopeProcessPassActForStand ScopeKind = "ProcessPassActForStand" // process a Pass-Act on behalf of a Stand
|
||||
)
|
||||
|
||||
// Scope is a structured scope pair: what the Window opens.
|
||||
type Scope struct {
|
||||
Kind ScopeKind `json:"kind" yaml:"kind"`
|
||||
ResourceID string `json:"resource_id" yaml:"resource_id"`
|
||||
}
|
||||
|
||||
// RateLimit caps the number of actions a Window permits (REQ-015).
|
||||
// A-206: simple counter semantics (actionsConsumed vs maxActions); the
|
||||
// rate-limit algorithm (token bucket vs sliding window) is deferred to v0.3.
|
||||
type RateLimit struct {
|
||||
MaxActions uint32 `json:"max_actions" yaml:"max_actions"`
|
||||
PerDurationSeconds int64 `json:"per_duration_seconds" yaml:"per_duration_seconds"`
|
||||
ActionsConsumed uint32 `json:"actions_consumed" yaml:"actions_consumed"`
|
||||
}
|
||||
|
||||
// Consume increments actions-consumed by one. Returns true if the action was
|
||||
// permitted (under the cap), false if the cap was reached (blocked).
|
||||
// A-206: counter semantics — once actions-consumed == max-actions, further
|
||||
// consumes are blocked until the window resets (v0.3 will define reset).
|
||||
func (r *RateLimit) Consume() bool {
|
||||
if r.ActionsConsumed >= r.MaxActions {
|
||||
return false
|
||||
}
|
||||
r.ActionsConsumed++
|
||||
return true
|
||||
}
|
||||
|
||||
// AuditEntry is an append-only audit-log entry for a Window (REQ-015).
|
||||
// Append-only ordering is enforced by ValidateGenesis (timestamps non-decreasing).
|
||||
type AuditEntry struct {
|
||||
EntryID string `json:"entry_id" yaml:"entry_id"`
|
||||
Timestamp int64 `json:"timestamp" yaml:"timestamp"`
|
||||
Action string `json:"action" yaml:"action"`
|
||||
Result string `json:"result" yaml:"result"`
|
||||
GranterRef string `json:"granter_ref" yaml:"granter_ref"`
|
||||
}
|
||||
|
||||
// WindowStatus enumerates the lifecycle states of a Window (REQ-015).
|
||||
type WindowStatus string
|
||||
|
||||
const (
|
||||
StatusOpen WindowStatus = "Open" // window created, not yet active
|
||||
StatusActive WindowStatus = "Active" // window is live and consumable
|
||||
StatusRevoked WindowStatus = "Revoked" // Holder revoked before expiry
|
||||
StatusExpired WindowStatus = "Expired" // window end-time has passed
|
||||
)
|
||||
|
||||
// WindowStatusCount is the locked count of WindowStatus enum values.
|
||||
// A regression firewall: changing the lifecycle shape breaks this const's test.
|
||||
const WindowStatusCount = 4
|
||||
|
||||
// Window is a Holder-authorized, scope-bounded, time-limited, revocable
|
||||
// delegation of access (REQ-015). Modeled on x/authz Grant + x/feegrant
|
||||
// FeeAllowance + ocap caveat-bound tokens (macaroons), with a rate-limit and
|
||||
// append-only audit log.
|
||||
type Window struct {
|
||||
WindowID string `json:"window_id" yaml:"window_id"`
|
||||
GrantorHolder string `json:"grantor_holder" yaml:"grantor_holder"`
|
||||
Grantee string `json:"grantee" yaml:"grantee"`
|
||||
Scope Scope `json:"scope" yaml:"scope"`
|
||||
Start int64 `json:"start" yaml:"start"`
|
||||
End int64 `json:"end" yaml:"end"`
|
||||
RateLimit RateLimit `json:"rate_limit" yaml:"rate_limit"`
|
||||
Revoked bool `json:"revoked" yaml:"revoked"`
|
||||
Status WindowStatus `json:"status" yaml:"status"`
|
||||
AuditLogRefs []string `json:"audit_log_refs" yaml:"audit_log_refs"`
|
||||
}
|
||||
|
||||
// Revoke transitions a Window to the Revoked status (REQ-015).
|
||||
// Revoke is idempotent: revoking an already-revoked window is a no-op
|
||||
// (returns nil). Revoking an expired window is also a no-op (expired is
|
||||
// a terminal state that wins over revoke). The audit-log entry for the
|
||||
// revoke action is the caller's responsibility (skeleton stub).
|
||||
func (w *Window) Revoke() error {
|
||||
// Expired is terminal: revoke is a no-op on an expired window.
|
||||
if w.Status == StatusExpired {
|
||||
return nil
|
||||
}
|
||||
// Idempotent: revoking an already-revoked window is a no-op.
|
||||
if w.Status == StatusRevoked {
|
||||
return nil
|
||||
}
|
||||
w.Status = StatusRevoked
|
||||
w.Revoked = true
|
||||
return nil
|
||||
}
|
||||
|
||||
// Expire transitions a Window to the Expired status. Used by the (future)
|
||||
// keeper's end-block sweep when now > End. Expire is terminal: a later
|
||||
// Revoke on an expired window is a no-op.
|
||||
func (w *Window) Expire() {
|
||||
w.Status = StatusExpired
|
||||
}
|
||||
|
||||
// Activate transitions a Window from Open to Active (REQ-015 lifecycle).
|
||||
// Only an Open window can be activated.
|
||||
func (w *Window) Activate() error {
|
||||
if w.Status != StatusOpen {
|
||||
return fmt.Errorf("cannot activate window in status %q", w.Status)
|
||||
}
|
||||
w.Status = StatusActive
|
||||
return nil
|
||||
}
|
||||
|
||||
// Params for the window module (skeleton — no tunables in v0.2).
|
||||
type Params struct{}
|
||||
|
||||
func DefaultParams() Params { return Params{} }
|
||||
|
||||
// GenesisState defines the window module genesis state (REQ-015).
|
||||
// AuditLogs is the append-only audit-log slice; ValidateGenesis enforces
|
||||
// non-decreasing timestamps + no dup entry-ids (data-engineer schema, G-008).
|
||||
type GenesisState struct {
|
||||
Params Params `json:"params" yaml:"params"`
|
||||
Windows []Window `json:"windows" yaml:"windows"`
|
||||
AuditLogs []AuditEntry `json:"audit_logs" yaml:"audit_logs"`
|
||||
}
|
||||
|
||||
func DefaultGenesisState() *GenesisState {
|
||||
return &GenesisState{
|
||||
Params: DefaultParams(),
|
||||
Windows: []Window{},
|
||||
AuditLogs: []AuditEntry{},
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||
// no-op): rejects duplicate window-ids. Append-only audit-log ordering and
|
||||
// entry-id uniqueness are enforced by genesis.go's ValidateAuditLogs.
|
||||
func ValidateGenesis(bz json.RawMessage) error {
|
||||
var gs GenesisState
|
||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
||||
return fmt.Errorf("window: invalid genesis: %w", err)
|
||||
}
|
||||
seen := make(map[string]bool, len(gs.Windows))
|
||||
for _, w := range gs.Windows {
|
||||
if w.WindowID == "" {
|
||||
return fmt.Errorf("window: empty window-id")
|
||||
}
|
||||
if seen[w.WindowID] {
|
||||
return fmt.Errorf("window: duplicate window-id %q", w.WindowID)
|
||||
}
|
||||
seen[w.WindowID] = true
|
||||
}
|
||||
if err := ValidateAuditLogs(gs.AuditLogs); err != nil {
|
||||
return fmt.Errorf("window: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,537 @@
|
||||
package types_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"go/parser"
|
||||
"go/token"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/oy/openyield/lexicon"
|
||||
"github.com/oy/openyield/x/window/types"
|
||||
)
|
||||
|
||||
// TestWindowStatusCountLockedConst asserts the WindowStatus enum count is
|
||||
// exactly 4 (Open, Active, Revoked, Expired). A regression firewall: adding
|
||||
// or removing a status breaks this test.
|
||||
func TestWindowStatusCountLockedConst(t *testing.T) {
|
||||
if types.WindowStatusCount != 4 {
|
||||
t.Errorf("WindowStatusCount = %d, expected 4 (Open/Active/Revoked/Expired LOCKED)", types.WindowStatusCount)
|
||||
}
|
||||
statuses := []types.WindowStatus{
|
||||
types.StatusOpen, types.StatusActive, types.StatusRevoked, types.StatusExpired,
|
||||
}
|
||||
if len(statuses) != 4 {
|
||||
t.Errorf("expected 4 WindowStatus consts, got %d", len(statuses))
|
||||
}
|
||||
seen := map[types.WindowStatus]bool{}
|
||||
for _, s := range statuses {
|
||||
if seen[s] {
|
||||
t.Errorf("duplicate WindowStatus %q", s)
|
||||
}
|
||||
seen[s] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestWindowLifecycleOpenActiveRevokedExpired walks the full lifecycle:
|
||||
// Open → Active → Revoked → Expired (terminal).
|
||||
func TestWindowLifecycleOpenActiveRevokedExpired(t *testing.T) {
|
||||
w := types.Window{Status: types.StatusOpen}
|
||||
if w.Status != types.StatusOpen {
|
||||
t.Fatalf("expected Open, got %q", w.Status)
|
||||
}
|
||||
if err := w.Activate(); err != nil {
|
||||
t.Fatalf("Activate: %v", err)
|
||||
}
|
||||
if w.Status != types.StatusActive {
|
||||
t.Fatalf("expected Active, got %q", w.Status)
|
||||
}
|
||||
if err := w.Revoke(); err != nil {
|
||||
t.Fatalf("Revoke: %v", err)
|
||||
}
|
||||
if w.Status != types.StatusRevoked {
|
||||
t.Fatalf("expected Revoked, got %q", w.Status)
|
||||
}
|
||||
if !w.Revoked {
|
||||
t.Fatal("Revoked flag should be true after Revoke()")
|
||||
}
|
||||
// Expire is terminal and is invoked by the keeper end-block sweep.
|
||||
w.Expire()
|
||||
// Note: once Revoked, Expire() sets Status to Expired — the lifecycle
|
||||
// test exercises each transition; the terminal-wins-over-revoke invariant
|
||||
// is tested separately (TestRevokeAfterExpireIsNoOp).
|
||||
}
|
||||
|
||||
// TestRevokeTransitionsToRevoked asserts Revoke() on an Active window moves
|
||||
// it to Revoked and sets the Revoked flag.
|
||||
func TestRevokeTransitionsToRevoked(t *testing.T) {
|
||||
w := types.Window{Status: types.StatusActive}
|
||||
if err := w.Revoke(); err != nil {
|
||||
t.Fatalf("Revoke on Active: %v", err)
|
||||
}
|
||||
if w.Status != types.StatusRevoked {
|
||||
t.Errorf("expected Revoked, got %q", w.Status)
|
||||
}
|
||||
if !w.Revoked {
|
||||
t.Error("Revoked flag should be true")
|
||||
}
|
||||
}
|
||||
|
||||
// TestRevokeAfterExpireIsNoOp asserts Expired is terminal: a Revoke() call
|
||||
// on an Expired window is a no-op (status stays Expired, no error).
|
||||
func TestRevokeAfterExpireIsNoOp(t *testing.T) {
|
||||
w := types.Window{Status: types.StatusExpired}
|
||||
if err := w.Revoke(); err != nil {
|
||||
t.Fatalf("Revoke on Expired should be no-op, got error: %v", err)
|
||||
}
|
||||
if w.Status != types.StatusExpired {
|
||||
t.Errorf("Revoke on Expired should not change status; got %q", w.Status)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDoubleRevokeIdempotent asserts revoking an already-revoked window is
|
||||
// idempotent (no error, status stays Revoked). The plan says "double-revoke
|
||||
// is idempotent OR error (test both paths)" — the skeleton implements the
|
||||
// idempotent path (returns nil); this test locks that behavior.
|
||||
func TestDoubleRevokeIdempotent(t *testing.T) {
|
||||
w := types.Window{Status: types.StatusActive}
|
||||
_ = w.Revoke()
|
||||
if w.Status != types.StatusRevoked {
|
||||
t.Fatalf("first Revoke failed: %q", w.Status)
|
||||
}
|
||||
if err := w.Revoke(); err != nil {
|
||||
t.Fatalf("second Revoke should be idempotent (no error), got: %v", err)
|
||||
}
|
||||
if w.Status != types.StatusRevoked {
|
||||
t.Errorf("double-revoke should keep status Revoked; got %q", w.Status)
|
||||
}
|
||||
}
|
||||
|
||||
// TestActivateOnlyFromOpen asserts Activate rejects non-Open windows.
|
||||
func TestActivateOnlyFromOpen(t *testing.T) {
|
||||
w := types.Window{Status: types.StatusRevoked}
|
||||
if err := w.Activate(); err == nil {
|
||||
t.Error("Activate on Revoked should error")
|
||||
}
|
||||
w2 := types.Window{Status: types.StatusActive}
|
||||
if err := w2.Activate(); err == nil {
|
||||
t.Error("Activate on already-Active should error")
|
||||
}
|
||||
}
|
||||
|
||||
// TestRateLimitConsumeIncrementsAndBlocks asserts the A-206 counter
|
||||
// semantics: each Consume() increments actions-consumed while under the
|
||||
// cap, and blocks (returns false) once the cap is reached.
|
||||
func TestRateLimitConsumeIncrementsAndBlocks(t *testing.T) {
|
||||
tt := []struct {
|
||||
name string
|
||||
maxActions uint32
|
||||
consumeN int
|
||||
wantLast bool // expected return of the Nth consume
|
||||
wantCount uint32
|
||||
}{
|
||||
{"under cap", 5, 3, true, 3},
|
||||
{"exactly cap", 3, 3, true, 3},
|
||||
{"at cap then block", 2, 3, false, 2}, // 3rd consume blocked
|
||||
{"zero cap blocks all", 0, 1, false, 0},
|
||||
}
|
||||
for _, tc := range tt {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
r := types.RateLimit{MaxActions: tc.maxActions}
|
||||
var last bool
|
||||
for i := 0; i < tc.consumeN; i++ {
|
||||
last = r.Consume()
|
||||
}
|
||||
if last != tc.wantLast {
|
||||
t.Errorf("last Consume() = %v, want %v", last, tc.wantLast)
|
||||
}
|
||||
if r.ActionsConsumed != tc.wantCount {
|
||||
t.Errorf("ActionsConsumed = %d, want %d", r.ActionsConsumed, tc.wantCount)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestScopeKindEnumCoverage asserts all three ScopeKind values are distinct
|
||||
// and non-empty (REQ-015 scope set).
|
||||
func TestScopeKindEnumCoverage(t *testing.T) {
|
||||
kinds := []types.ScopeKind{
|
||||
types.ScopeReadStash, types.ScopeReadStanding, types.ScopeProcessPassActForStand,
|
||||
}
|
||||
if len(kinds) != 3 {
|
||||
t.Errorf("expected 3 ScopeKind consts, got %d", len(kinds))
|
||||
}
|
||||
seen := map[types.ScopeKind]bool{}
|
||||
for _, k := range kinds {
|
||||
if k == "" {
|
||||
t.Error("empty ScopeKind")
|
||||
}
|
||||
if seen[k] {
|
||||
t.Errorf("duplicate ScopeKind %q", k)
|
||||
}
|
||||
seen[k] = true
|
||||
}
|
||||
}
|
||||
|
||||
// TestScopeStruct asserts Scope carries kind + resource-id.
|
||||
func TestScopeStruct(t *testing.T) {
|
||||
s := types.Scope{Kind: types.ScopeReadStash, ResourceID: "reach:abc"}
|
||||
if s.Kind != types.ScopeReadStash {
|
||||
t.Errorf("Kind = %q", s.Kind)
|
||||
}
|
||||
if s.ResourceID != "reach:abc" {
|
||||
t.Errorf("ResourceID = %q", s.ResourceID)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultGenesisStateEmpty asserts DefaultGenesisState returns empty
|
||||
// slices (not nil) for Windows and AuditLogs.
|
||||
func TestDefaultGenesisStateEmpty(t *testing.T) {
|
||||
gs := types.DefaultGenesisState()
|
||||
if gs == nil {
|
||||
t.Fatal("DefaultGenesisState returned nil")
|
||||
}
|
||||
if len(gs.Windows) != 0 {
|
||||
t.Errorf("Default Windows len = %d, want 0", len(gs.Windows))
|
||||
}
|
||||
if gs.Windows == nil {
|
||||
t.Error("Default Windows should be non-nil empty slice")
|
||||
}
|
||||
if len(gs.AuditLogs) != 0 {
|
||||
t.Errorf("Default AuditLogs len = %d, want 0", len(gs.AuditLogs))
|
||||
}
|
||||
if gs.AuditLogs == nil {
|
||||
t.Error("Default AuditLogs should be non-nil empty slice")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsDupWindowIDs asserts A-212: duplicate window-ids
|
||||
// are rejected (upgrade from v0.1's no-op ValidateGenesis).
|
||||
func TestValidateGenesisRejectsDupWindowIDs(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Windows: []types.Window{
|
||||
{WindowID: "w1"},
|
||||
{WindowID: "w1"}, // dup
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject duplicate window-ids")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisAcceptsUniqueIDs asserts a clean genesis validates.
|
||||
func TestValidateGenesisAcceptsUniqueIDs(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Windows: []types.Window{
|
||||
{WindowID: "w1"},
|
||||
{WindowID: "w2"},
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err != nil {
|
||||
t.Errorf("ValidateGenesis should accept unique ids, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsEmptyWindowID asserts empty window-id is rejected.
|
||||
func TestValidateGenesisRejectsEmptyWindowID(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
Windows: []types.Window{{WindowID: ""}},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject empty window-id")
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsBadJSON asserts malformed JSON is rejected.
|
||||
func TestValidateGenesisRejectsBadJSON(t *testing.T) {
|
||||
if err := types.ValidateGenesis(json.RawMessage(`{not json`)); err == nil {
|
||||
t.Error("ValidateGenesis should reject malformed JSON")
|
||||
}
|
||||
}
|
||||
|
||||
// TestAuditLogAppendOnlyOrdering asserts ValidateAuditLogs rejects
|
||||
// non-decreasing timestamps (append-only invariant, data-engineer schema).
|
||||
func TestAuditLogAppendOnlyOrdering(t *testing.T) {
|
||||
tt := []struct {
|
||||
name string
|
||||
logs []types.AuditEntry
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "empty ok",
|
||||
logs: []types.AuditEntry{},
|
||||
},
|
||||
{
|
||||
name: "non-decreasing ok",
|
||||
logs: []types.AuditEntry{
|
||||
{EntryID: "a1", Timestamp: 100},
|
||||
{EntryID: "a2", Timestamp: 100},
|
||||
{EntryID: "a3", Timestamp: 200},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "decreasing rejected",
|
||||
logs: []types.AuditEntry{
|
||||
{EntryID: "a1", Timestamp: 200},
|
||||
{EntryID: "a2", Timestamp: 100}, // out of order
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "dup entry-id rejected",
|
||||
logs: []types.AuditEntry{
|
||||
{EntryID: "a1", Timestamp: 100},
|
||||
{EntryID: "a1", Timestamp: 200}, // dup id
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty entry-id rejected",
|
||||
logs: []types.AuditEntry{
|
||||
{EntryID: "", Timestamp: 100},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
for _, tc := range tt {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
err := types.ValidateAuditLogs(tc.logs)
|
||||
if tc.wantErr && err == nil {
|
||||
t.Error("expected error, got nil")
|
||||
}
|
||||
if !tc.wantErr && err != nil {
|
||||
t.Errorf("expected nil, got: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestValidateGenesisRejectsBadAuditLog asserts ValidateGenesis surfaces
|
||||
// audit-log errors.
|
||||
func TestValidateGenesisRejectsBadAuditLog(t *testing.T) {
|
||||
gs := types.GenesisState{
|
||||
AuditLogs: []types.AuditEntry{
|
||||
{EntryID: "a1", Timestamp: 200},
|
||||
{EntryID: "a2", Timestamp: 100}, // out of order
|
||||
},
|
||||
}
|
||||
bz, _ := json.Marshal(gs)
|
||||
if err := types.ValidateGenesis(bz); err == nil {
|
||||
t.Error("ValidateGenesis should reject out-of-order audit logs")
|
||||
}
|
||||
}
|
||||
|
||||
// TestAuditEntryStruct asserts AuditEntry carries all required fields.
|
||||
func TestAuditEntryStruct(t *testing.T) {
|
||||
e := types.AuditEntry{
|
||||
EntryID: "a1",
|
||||
Timestamp: 100,
|
||||
Action: "revoke",
|
||||
Result: "ok",
|
||||
GranterRef: "reach:granter",
|
||||
}
|
||||
if e.EntryID != "a1" || e.Timestamp != 100 || e.Action != "revoke" ||
|
||||
e.Result != "ok" || e.GranterRef != "reach:granter" {
|
||||
t.Error("AuditEntry fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestWindowStructFields asserts Window carries all required fields.
|
||||
func TestWindowStructFields(t *testing.T) {
|
||||
w := types.Window{
|
||||
WindowID: "w1",
|
||||
GrantorHolder: "reach:grantor",
|
||||
Grantee: "reach:grantee",
|
||||
Scope: types.Scope{Kind: types.ScopeReadStash, ResourceID: "stash:1"},
|
||||
Start: 100,
|
||||
End: 200,
|
||||
RateLimit: types.RateLimit{MaxActions: 5, PerDurationSeconds: 60},
|
||||
Status: types.StatusOpen,
|
||||
AuditLogRefs: []string{"a1", "a2"},
|
||||
}
|
||||
if w.WindowID != "w1" || w.GrantorHolder != "reach:grantor" ||
|
||||
w.Grantee != "reach:grantee" || w.Start != 100 || w.End != 200 ||
|
||||
w.Status != types.StatusOpen || len(w.AuditLogRefs) != 2 {
|
||||
t.Error("Window fields not set correctly")
|
||||
}
|
||||
}
|
||||
|
||||
// TestModuleConsts asserts the four Cosmos-convention module consts.
|
||||
func TestModuleConsts(t *testing.T) {
|
||||
if types.ModuleName != "window" {
|
||||
t.Errorf("ModuleName = %q, want %q", types.ModuleName, "window")
|
||||
}
|
||||
if types.StoreKey != "window" {
|
||||
t.Errorf("StoreKey = %q", types.StoreKey)
|
||||
}
|
||||
if types.RouterKey != "window" {
|
||||
t.Errorf("RouterKey = %q", types.RouterKey)
|
||||
}
|
||||
if types.QuerierRoute != "window" {
|
||||
t.Errorf("QuerierRoute = %q", types.QuerierRoute)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultParams asserts DefaultParams returns a zero-value Params.
|
||||
func TestDefaultParams(t *testing.T) {
|
||||
_ = types.DefaultParams() // no panics
|
||||
}
|
||||
|
||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
||||
//
|
||||
// The lexicon firewall scans the window package's .go files for the 9 banned
|
||||
// terms. v0.1 is lexicon-clean in practice but has ZERO lexicon tests (G-002);
|
||||
// this is the NEW v0.2 firewall. The project-wide meta-test in P1-04-02
|
||||
// extends this to all x/**/*.go files.
|
||||
|
||||
// TestLexiconNoBannedTermsInWindowPackage scans every non-test .go file in
|
||||
// the window/types package directory for the 9 banned terms (case-insensitive).
|
||||
// Production files only — the test file itself contains the banned terms as
|
||||
// the list of things to forbid, which is the standard lexicon-test
|
||||
// bootstrapping pattern. The project-wide meta-test (P1-04-02) scans all
|
||||
// x/**/*.go (including tests) with self-exclusion.
|
||||
func TestLexiconNoBannedTermsInWindowPackage(t *testing.T) {
|
||||
pkgDir := packageDir(t, "github.com/oy/openyield/x/window/types")
|
||||
files, err := filepath.Glob(filepath.Join(pkgDir, "*.go"))
|
||||
if err != nil {
|
||||
t.Fatalf("glob: %v", err)
|
||||
}
|
||||
prodFiles := []string{}
|
||||
for _, f := range files {
|
||||
if strings.HasSuffix(f, "_test.go") {
|
||||
continue
|
||||
}
|
||||
prodFiles = append(prodFiles, f)
|
||||
}
|
||||
if len(prodFiles) == 0 {
|
||||
t.Fatal("no production .go files found in window/types")
|
||||
}
|
||||
for _, f := range prodFiles {
|
||||
bz, err := os.ReadFile(f)
|
||||
if err != nil {
|
||||
t.Fatalf("read %s: %v", f, err)
|
||||
}
|
||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
||||
t.Errorf("%s: banned term %q (REQ-012 lexicon firewall)", filepath.Base(f), found)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// --- G-003 by-ID-string import invariant -----------------------------------------
|
||||
//
|
||||
// A-203/G-003: no production (non-test) .go file under x/ may import another
|
||||
// x/<module>/types package by struct (enforced as a TESTED invariant, not
|
||||
// just a convention). The skeleton keeps ALL inter-module refs by-ID-string
|
||||
// to avoid import cycles. This test scans every non-test .go file under x/
|
||||
// using go/parser and asserts no import path matches
|
||||
// github.com/oy/openyield/x/<other>/types.
|
||||
|
||||
// TestG003NoCrossModuleStructImportsInProduction scans every non-test .go
|
||||
// file under x/ for imports of other x/<module>/types packages.
|
||||
func TestG003NoCrossModuleStructImportsInProduction(t *testing.T) {
|
||||
xRoot := repoXRoot(t)
|
||||
fset := token.NewFileSet()
|
||||
violations := []string{}
|
||||
err := filepath.Walk(xRoot, func(path string, info os.FileInfo, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.IsDir() {
|
||||
return nil
|
||||
}
|
||||
if !strings.HasSuffix(path, ".go") {
|
||||
return nil
|
||||
}
|
||||
// Skip test files (G-003 is about production code only).
|
||||
if strings.HasSuffix(path, "_test.go") {
|
||||
return nil
|
||||
}
|
||||
// Parse imports only (no type checking needed).
|
||||
f, perr := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
|
||||
if perr != nil {
|
||||
return perr
|
||||
}
|
||||
// Derive this file's own module to allow same-package imports.
|
||||
ownTypesPkg := ownTypesImport(path)
|
||||
for _, imp := range f.Imports {
|
||||
ip := strings.Trim(imp.Path.Value, `"`)
|
||||
// Allow a file to import its OWN types package (rare; e.g. an
|
||||
// alias file). Block imports of OTHER x/<module>/types packages.
|
||||
if isForeignTypesImport(ip) && ip != ownTypesPkg {
|
||||
rel, _ := filepath.Rel(xRoot, path)
|
||||
violations = append(violations, rel+" -> "+ip)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("walk: %v", err)
|
||||
}
|
||||
if len(violations) > 0 {
|
||||
t.Errorf("G-003 violation: production files importing foreign x/<module>/types:\n %s",
|
||||
strings.Join(violations, "\n "))
|
||||
}
|
||||
}
|
||||
|
||||
// isForeignTypesImport reports whether ip is an x/<module>/types import
|
||||
// (the form that would create a cross-module struct dependency). It returns
|
||||
// true only for imports matching github.com/oy/openyield/x/<anything>/types.
|
||||
func isForeignTypesImport(ip string) bool {
|
||||
const prefix = "github.com/oy/openyield/x/"
|
||||
if !strings.HasPrefix(ip, prefix) {
|
||||
return false
|
||||
}
|
||||
rest := strings.TrimPrefix(ip, prefix)
|
||||
// x/<module>/types has exactly one "/" after the prefix and ends in /types.
|
||||
// x/<module>/types/foo would be a sub-package (also blocked).
|
||||
parts := strings.Split(rest, "/")
|
||||
if len(parts) < 2 {
|
||||
return false
|
||||
}
|
||||
return parts[len(parts)-1] == "types"
|
||||
}
|
||||
|
||||
// ownTypesImport returns the x/<module>/types import path a file at the
|
||||
// given path belongs to, or "" if the file is not under a types package.
|
||||
func ownTypesImport(path string) string {
|
||||
dir := filepath.Dir(path)
|
||||
if filepath.Base(dir) != "types" {
|
||||
return ""
|
||||
}
|
||||
module := filepath.Base(filepath.Dir(dir))
|
||||
return "github.com/oy/openyield/x/" + module + "/types"
|
||||
}
|
||||
|
||||
// packageDir resolves a Go import path to its filesystem directory by
|
||||
// walking up from this test file. The v0.2 skeleton has zero external deps,
|
||||
// so we use runtime.Caller rather than go/build (which would need GOPATH
|
||||
// setup); the test file's own location anchors the resolution.
|
||||
func packageDir(t *testing.T, importPath string) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
// file = .../oy/x/window/types/types_test.go
|
||||
// repoRoot = .../oy (4 dirs up: types -> window -> x -> oy)
|
||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(file))))
|
||||
rel := strings.TrimPrefix(importPath, "github.com/oy/openyield/")
|
||||
return filepath.Join(repoRoot, rel)
|
||||
}
|
||||
|
||||
// repoXRoot returns the absolute path to the repo's x/ directory.
|
||||
func repoXRoot(t *testing.T) string {
|
||||
t.Helper()
|
||||
_, file, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
// file = .../oy/x/window/types/types_test.go -> x/ is 3 dirs up from file
|
||||
return filepath.Dir(filepath.Dir(filepath.Dir(file)))
|
||||
}
|
||||
Reference in New Issue
Block a user