Fix Soroban storage TTL extension

stellar-contracts/src/admin_multisig.rs

@@ -1,5 +1,5 @@
 use soroban_sdk::{
-    contract, contractimpl, contracttype, symbol_short, Address, BytesN, Env, IntoVal, String,
+    contract, contractimpl, contracttype, symbol_short, Address, BytesN, Env, IntoVal, String, Val,
     Vec,
 };
 
@@ -71,6 +71,15 @@ pub struct AdminMultisigContract;
 
 #[contractimpl]
 impl AdminMultisigContract {
+    fn set_instance<K, V>(env: &Env, key: &K, value: &V)
+    where
+        K: IntoVal<Env, Val>,
+        V: IntoVal<Env, Val>,
+    {
+        env.storage().instance().set(key, value);
+        crate::persistent::extend_instance_ttl(env, None);
+    }
+
     pub fn init_admin_multisig(
         env: Env,
         threshold: u32,
@@ -87,7 +96,8 @@ impl AdminMultisigContract {
             panic!("Admin multisig already initialized");
         }
 
-        env.storage().instance().set(
+        Self::set_instance(
+            &env,
             &AdminMultisigDataKey::AdminConfig,
             &AdminMultisigConfig {
                 threshold,
@@ -133,7 +143,7 @@ impl AdminMultisigContract {
             status: AdminProposalStatus::Pending,
         };
 
-        env.storage().instance().set(&proposal_key, &proposal);
+        Self::set_instance(&env, &proposal_key, &proposal);
         env.events().publish(
             (symbol_short!("proposal"), symbol_short!("created")),
             ProposalCreatedEvent {
@@ -166,7 +176,7 @@ impl AdminMultisigContract {
         let current_ledger = env.ledger().sequence();
         if current_ledger > proposal.expires_at_ledger {
             proposal.status = AdminProposalStatus::Expired;
-            env.storage().instance().set(&proposal_key, &proposal);
+            Self::set_instance(&env, &proposal_key, &proposal);
             return AdminProposalStatus::Expired;
         }
 
@@ -197,7 +207,7 @@ impl AdminMultisigContract {
             status = AdminProposalStatus::Approved;
         }
 
-        env.storage().instance().set(&proposal_key, &proposal);
+        Self::set_instance(&env, &proposal_key, &proposal);
 
         if status == AdminProposalStatus::Approved {
             status = Self::execute_action(env, proposal_id);
@@ -225,7 +235,7 @@ impl AdminMultisigContract {
         }
 
         proposal.status = AdminProposalStatus::Rejected;
-        env.storage().instance().set(&proposal_key, &proposal);
+        Self::set_instance(&env, &proposal_key, &proposal);
 
         env.events().publish(
             (symbol_short!("proposal"), symbol_short!("canceled")),
@@ -273,9 +283,11 @@ impl AdminMultisigContract {
         let config = Self::get_config(env.clone());
         Self::require_signer(&config.signers, &signer);
 
-        env.storage()
-            .instance()
-            .set(&AdminMultisigDataKey::CertificateContractId, &certificate_contract);
+        Self::set_instance(
+            &env,
+            &AdminMultisigDataKey::CertificateContractId,
+            &certificate_contract,
+        );
     }
 
     pub fn get_certificate_contract(env: Env) -> Address {
@@ -303,9 +315,11 @@ impl AdminMultisigContract {
                     .update_current_contract_wasm(wasm_hash.clone());
             }
             AdminAction::RemoveIssuer(issuer) => {
-                env.storage()
-                    .instance()
-                    .set(&AdminMultisigDataKey::RemovedIssuer(issuer.clone()), &true);
+                Self::set_instance(
+                    &env,
+                    &AdminMultisigDataKey::RemovedIssuer(issuer.clone()),
+                    &true,
+                );
 
                 let certificate_contract: Address = env
                     .storage()
@@ -321,7 +335,8 @@ impl AdminMultisigContract {
             }
             AdminAction::UpdateConfig(threshold, signers, proposal_window) => {
                 Self::validate_config(signers, *threshold, *proposal_window);
-                env.storage().instance().set(
+                Self::set_instance(
+                    &env,
                     &AdminMultisigDataKey::AdminConfig,
                     &AdminMultisigConfig {
                         threshold: *threshold,
@@ -334,7 +349,7 @@ impl AdminMultisigContract {
         }
 
         proposal.status = AdminProposalStatus::Executed;
-        env.storage().instance().set(&proposal_key, &proposal);
+        Self::set_instance(&env, &proposal_key, &proposal);
         env.events().publish(
             (symbol_short!("proposal"), symbol_short!("executed")),
             proposal_id,

stellar-contracts/src/admin_multisig_test.rs

@@ -1,7 +1,10 @@
 #![cfg(test)]
 
 use super::*;
-use soroban_sdk::{testutils::Address as _, Address, Env, String, Vec};
+use soroban_sdk::{
+    testutils::{storage::Instance, Address as _},
+    Address, Env, String, Vec,
+};
 
 #[test]
 fn test_admin_multisig_flow() {
@@ -43,6 +46,28 @@ fn test_admin_multisig_flow() {
     let stored_proposal = client.get_proposal(&proposal_id);
     assert_eq!(stored_proposal.status, AdminProposalStatus::Executed);
 }
+
+#[test]
+fn test_admin_multisig_instance_ttl_is_extended() {
+    let env = Env::default();
+    let contract_id = env.register_contract(None, AdminMultisigContract);
+    let client = AdminMultisigContractClient::new(&env, &contract_id);
+
+    let admin1 = Address::generate(&env);
+    let admin2 = Address::generate(&env);
+    let signers = Vec::from_array(&env, [admin1, admin2]);
+
+    env.mock_all_auths();
+    client.init_admin_multisig(&2, &signers, &10);
+
+    let ttl = env.as_contract(&contract_id, || env.storage().instance().get_ttl());
+    let expected_ttl = env.as_contract(&contract_id, || {
+        crate::persistent::DEFAULT_TTL.min(env.storage().max_ttl())
+    });
+
+    assert_eq!(ttl, expected_ttl);
+}
+
 #[test]
 fn test_remove_issuer_action_executes_after_threshold() {
     let env = Env::default();

stellar-contracts/src/crl.rs

@@ -1,4 +1,6 @@
-use soroban_sdk::{contract, contractimpl, contracttype, Address, Bytes, BytesN, Env, IntoVal, String, Vec};
+use soroban_sdk::{
+    contract, contractimpl, contracttype, Address, Bytes, BytesN, Env, IntoVal, String, Val, Vec,
+};
 
 const DEFAULT_UPDATE_WINDOW_SECONDS: u64 = 7 * 24 * 60 * 60;
 
@@ -52,6 +54,24 @@ pub struct CRLContract;
 
 #[contractimpl]
 impl CRLContract {
+    fn set_persistent<K, V>(env: &Env, key: &K, value: &V)
+    where
+        K: IntoVal<Env, Val>,
+        V: IntoVal<Env, Val>,
+    {
+        env.storage().persistent().set(key, value);
+        crate::persistent::extend_ttl(env, key, None);
+    }
+
+    fn set_instance<K, V>(env: &Env, key: &K, value: &V)
+    where
+        K: IntoVal<Env, Val>,
+        V: IntoVal<Env, Val>,
+    {
+        env.storage().instance().set(key, value);
+        crate::persistent::extend_instance_ttl(env, None);
+    }
+
     pub fn initialize(env: Env, issuer: Address, certificate_contract: Address) {
         if env.storage().persistent().has(&DataKey::Issuer) {
             panic!("CRL already initialized");
@@ -70,14 +90,14 @@ impl CRLContract {
             merkle_root: Self::build_merkle_root(&env, &empty_ids),
         };
 
-        env.storage().persistent().set(&DataKey::Issuer, &issuer);
-        env.storage()
-            .persistent()
-            .set(&DataKey::CertContract, &certificate_contract);
-        env.storage()
-            .persistent()
-            .set(&DataKey::RevokedCertificates, &Vec::<String>::new(&env));
-        env.storage().persistent().set(&DataKey::Info, &crl_info);
+        Self::set_persistent(&env, &DataKey::Issuer, &issuer);
+        Self::set_persistent(&env, &DataKey::CertContract, &certificate_contract);
+        Self::set_persistent(
+            &env,
+            &DataKey::RevokedCertificates,
+            &Vec::<String>::new(&env),
+        );
+        Self::set_persistent(&env, &DataKey::Info, &crl_info);
     }
 
     pub fn revoke_certificate(
@@ -133,19 +153,15 @@ impl CRLContract {
             revoked_by: authorizer.clone(),
         };
 
-        env.storage()
-            .persistent()
-            .set(&revocation_key, &revocation_info);
+        Self::set_persistent(&env, &revocation_key, &revocation_info);
 
         let mut revoked_certificates = Self::get_revoked_certificate_ids(&env);
         revoked_certificates.push_back(certificate_id);
-        env.storage()
-            .persistent()
-            .set(&DataKey::RevokedCertificates, &revoked_certificates);
+        Self::set_persistent(&env, &DataKey::RevokedCertificates, &revoked_certificates);
 
         crl_info.revoked_count += 1;
         Self::refresh_crl_info(&env, &mut crl_info, &revoked_certificates);
-        env.storage().persistent().set(&DataKey::Info, &crl_info);
+        Self::set_persistent(&env, &DataKey::Info, &crl_info);
     }
 
     pub fn is_revoked(env: Env, certificate_id: String) -> bool {
@@ -225,14 +241,14 @@ impl CRLContract {
 
         let revoked_ids = Self::get_revoked_certificate_ids(&env);
         Self::refresh_crl_info(&env, &mut crl_info, &revoked_ids);
-        env.storage().persistent().set(&DataKey::Info, &crl_info);
+        Self::set_persistent(&env, &DataKey::Info, &crl_info);
     }
 
     /// Set an admin address that can authorize revocations/unrevocations
     pub fn set_admin(env: Env, admin: Address) {
         let issuer = Self::get_issuer(&env);
         issuer.require_auth();
-        env.storage().instance().set(&DataKey::Admin, &admin);
+        Self::set_instance(&env, &DataKey::Admin, &admin);
     }
 
     pub fn needs_update(env: Env) -> bool {
@@ -258,7 +274,11 @@ impl CRLContract {
     }
 
     fn get_revoked_certificate_ids(env: &Env) -> Vec<String> {
-        match env.storage().persistent().get(&DataKey::RevokedCertificates) {
+        match env
+            .storage()
+            .persistent()
+            .get(&DataKey::RevokedCertificates)
+        {
             Some(revoked_certificates) => revoked_certificates,
             None => Vec::new(env),
         }
@@ -272,7 +292,7 @@ impl CRLContract {
 
     fn build_merkle_root(env: &Env, revoked_ids: &Vec<String>) -> String {
         fn sha256_bytes(env: &Env, data: &Bytes) -> BytesN<32> {
-            env.crypto().sha256(data)
+            env.crypto().sha256(data).into()
         }
 
         fn pair_hash(env: &Env, left: &BytesN<32>, right: &BytesN<32>) -> BytesN<32> {

stellar-contracts/src/crl_test.rs

@@ -1,19 +1,27 @@
 #![cfg(test)]
 
+extern crate std;
+
 use super::crl::*;
-use soroban_sdk::{testutils::Address as _, Address, Env, String};
+use soroban_sdk::{contract, contractimpl, testutils::Address as _, Address, Env, String};
+use std::string::ToString;
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
+#[contract]
+struct CertificateExistsStub;
+
+#[contractimpl]
+impl CertificateExistsStub {
+    pub fn certificate_exists(_env: Env, _id: String) -> bool {
+        true
+    }
+}
+
 /// Register a minimal stub that satisfies `certificate_exists` cross-contract
 /// calls made by `revoke_certificate`.
 fn register_cert_stub(env: &Env) -> Address {
-    // The CRL contract calls `certificate_exists(id) -> bool` on the cert
-    // contract.  In the test environment we use `mock_all_auths_allowing_non_root_auth`
-    // together with `env.mock_all_auths()` so cross-contract calls are
-    // intercepted.  We register a second CRLContract address purely to have a
-    // valid `Address`; the call will be mocked to return `true`.
-    env.register_contract(None, CRLContract)
+    env.register_contract(None, CertificateExistsStub)
 }
 
 fn setup() -> (Env, Address, Address) {
@@ -24,7 +32,7 @@ fn setup() -> (Env, Address, Address) {
     (env, issuer, cert_contract)
 }
 
-fn make_client(env: &Env) -> (Address, CRLContractClient) {
+fn make_client(env: &Env) -> (Address, CRLContractClient<'_>) {
     let contract_id = env.register_contract(None, CRLContract);
     let client = CRLContractClient::new(env, &contract_id);
     (contract_id, client)
@@ -343,6 +351,11 @@ fn test_set_admin_allows_revocation() {
 
     // Admin should now be able to revoke (auth is mocked for all)
     let cert_id = String::from_str(&env, "CERT-001");
-    client.revoke_certificate(&admin, &cert_id, &RevocationReason::AffiliationChanged, &None);
+    client.revoke_certificate(
+        &admin,
+        &cert_id,
+        &RevocationReason::AffiliationChanged,
+        &None,
+    );
     assert!(client.is_revoked(&cert_id));
 }

stellar-contracts/src/issuer_test.rs

@@ -1,7 +1,10 @@
 #![cfg(test)]
 
 use super::*;
-use soroban_sdk::{testutils::Address as _, Address, Env};
+use soroban_sdk::{
+    testutils::{storage::Persistent, Address as _},
+    Address, Env, String,
+};
 
 #[test]
 fn test_issuer_management() {
@@ -40,13 +43,42 @@ fn test_issuer_management() {
 
     let issuers = client.get_issuers();
     assert_eq!(issuers.len(), 2);
-    
+
     // Add issuer1 again (should not increment count or add to list)
     client.add_issuer(&issuer1);
     assert_eq!(client.get_issuer_count(), 2);
     assert_eq!(client.get_issuers().len(), 2);
 }
 
+#[test]
+fn test_issued_certificate_ttl_is_extended() {
+    let env = Env::default();
+    let contract_id = env.register_contract(None, CertificateContract);
+    let client = CertificateContractClient::new(&env, &contract_id);
+
+    let admin = Address::generate(&env);
+    let issuer = Address::generate(&env);
+    let owner = Address::generate(&env);
+    let id = String::from_str(&env, "cert-ttl-001");
+    let metadata_uri = String::from_str(&env, "ipfs://ttl");
+
+    client.initialize(&admin);
+    env.mock_all_auths();
+    client.add_issuer(&issuer);
+    client.issue_certificate(&id, &issuer, &owner, &metadata_uri, &None);
+
+    let ttl = env.as_contract(&contract_id, || {
+        env.storage()
+            .persistent()
+            .get_ttl(&DataKey::Certificate(id.clone()))
+    });
+    let expected_ttl = env.as_contract(&contract_id, || {
+        crate::persistent::DEFAULT_TTL.min(env.storage().max_ttl())
+    });
+
+    assert_eq!(ttl, expected_ttl);
+}
+
 #[test]
 fn test_remove_issuer_updates_vec_and_count() {
     let env = Env::default();