test: complete role permission matrix and fix spec shaking v2 compat - #184
Merged
El-swaggerito merged 2 commits intoJul 30, 2026
Merged
Conversation
This commit addresses two critical testing and compilation areas: 1. Spec Shaking V2 Compatibility: - Added `#[repr(u32)]` to core Enums (AssetStatus, Role, RestrictionReason, CapabilityStatus) to stabilize XDR serialization when Spec Shaking V2 sorts variants alphabetically. - Adjusted SDK fixtures to accommodate the new canonical `compliance_status_changed` event emitted prior to legacy events. - Updated obsolete error fixtures (AssetNotActive, AssetLifecyclePaused) to their active Restriction variants (AssetPausedRestriction, AssetRetiredRestriction). 2. Security Role Matrix: - Verified the complete role matrix covering Admin, AssetManager, ComplianceOfficer, and EmergencyOfficer operations. - Added explicit state consistency assertions across all wrong-caller tests to guarantee that state (balances, supply, whitelist status, paused state) remains perfectly preserved when an `Error::Unauthorized` rejection occurs.
Contributor
| \nThis PR is currently blocked by merge conflicts.\n\nPlease update the branch with the latest main branch and resolve the conflicts before it can be merged. |
…role-permissions # Conflicts: # fixtures/sdk/01-compliance.json # fixtures/sdk/05-errors.json # src/test.rs # tests/sdk_fixtures.rs
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #164
Summary
This PR closes the gap on security-critical role permission tests and completely resolves the broken test suite caused by the Soroban SDK's Spec Shaking V2 compiler updates.
Changes Made
1. Role Permission Matrix & State Preservation (Security)
wrong-callertests (where unauthorized operations are blocked) to explicitly verify that the contract state remains unchanged. This includes asserting that balances, total supply, paused state, and whitelist statuses are perfectly preserved upon anError::Unauthorizedrejection.AssetManager), Compliance (ComplianceOfficer), andEmergencyOfficeracross minting, whitelisting, and pausing operations.docs/admin-roles.mdanddocs/threat-model.md.2. Spec Shaking V2 Compatibility Fixes
The Soroban SDK V2 compiler sorts Enum variants alphabetically, which drifted the XDR serialization and caused downstream SDK fixtures to panic.
#[repr(u32)]andCopytraits forAssetStatus,RestrictionReason,CapabilityStatus, andRole. This guarantees deterministic integer indexing on the wire, irrespective of compiler shaking.test_snapshots/drift. The contract now properly initializes test states toAssetStatus::Active(sinceDraftprevents compliance transitions), preventing silentReceiverNotWhitelistedpanics.compliance_status_changedevent emitted prior to the legacywhitelist_revoked/user_whitelistedwrappers.AssetNotActive,AssetLifecyclePaused) fromALL_ERRORSinsdk_fixtures.rsand mapped the fixtures to their active700xcounterparts (AssetPausedRestriction,AssetRetiredRestriction).Verification
cargo test --workspacepasses seamlessly without panics.UPDATE_FIXTURES=1 UPDATE_EXPECT=1 cargo test --workspaceexecuted to fully regenerate and sync XDR JSON snapshots.Acceptance Criteria Met
Closes: #[Reemplaza con el número de tu Issue, ej: #12]