Add Protocol 27 (CAP-71) Soroban authorization support#94
Merged
Conversation
The generated XDR layer was already at the Protocol 27 commit (55a00d9); this adds the hand-written layer (#93): - Soroban credential wrappers now model all four arms (source-account, legacy ADDRESS, ADDRESS_V2, ADDRESS_WITH_DELEGATES); SorobanCredentials fromXdr/toXdr round-trip every arm (fixing the prior silent data loss) with fail-fast on unknown arms; new SorobanAddressCredentialsWithDelegates / SorobanDelegateSignature / SorobanDelegateDescriptor classes and forAddressCredentialsV2 / forAddressWithDelegates factories - Arm-aware signing through one preimage builder: SorobanAuthorizationEntry buildPreimage, sign() with an optional forAddress that routes into matching top-level or delegate nodes, and the withDelegates tree builder (XDR-byte sort, duplicate rejection) - Opt-in authV2 flag on SimulateTransactionRequest and MethodOptions (key omitted when false; old RPCs silently ignore it and return legacy entries) - AssembledTransaction and SEP-45 web auth handle all credential arms; delegates-only entries pass the send precheck - Bounded recursive XDR decode (depth 128) to prevent stack exhaustion from hostile delegate trees, with fail-closed caps on the tree-walk helpers - Tests incl. byte-exact golden vectors and a testnet integration test that activates on Protocol 27; documentation and agent-skill updates - Port the skill API-reference generator into tools/skill-generator and regenerate skills/stellar-php-sdk/references/api_reference.md Legacy ADDRESS remains the default and fully valid; the new arms are opt-in and only valid on Protocol 27+.
signAuthEntries (AssembledTransaction) and signAuthorizationEntries (WebAuthForContracts) stamped signatureExpirationLedger only on the direct signing paths, not before invoking the signing callback, so a callback-signed entry kept the wrong expiration and was rejected on submission. Stamp the expiration before the callback, as the direct paths already do. Also strengthen the Protocol 27 unit tests: assert the stamped expiration on the callback paths, verify produced signatures against the rebuilt preimage, and tighten weak assertions.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #94 +/- ##
============================================
+ Coverage 92.63% 92.74% +0.10%
- Complexity 20806 20960 +154
============================================
Files 987 990 +3
Lines 49713 50119 +406
============================================
+ Hits 46050 46481 +431
+ Misses 3663 3638 -25
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the hand-written Protocol 27 (CAP-71) layer on top of the generated XDR: the new Soroban authorization credential types and delegated account authorization. All additions are additive and opt-in; the legacy
SOROBAN_CREDENTIALS_ADDRESScredential remains the default and fully valid.Credentials and XDR
SorobanCredentialsmodels all four arms (source-account, legacyADDRESS,ADDRESS_V2,ADDRESS_WITH_DELEGATES);fromXdr/toXdrround-trip every arm and fail fast on unknown arms.SorobanAddressCredentialsWithDelegates,SorobanDelegateSignature, andSorobanDelegateDescriptor, plusforAddressCredentialsV2andforAddressWithDelegatesfactories.Authorization
SorobanAuthorizationEntry::buildPreimageandsign()with an optionalforAddressthat routes a signature into matching top-level or delegate nodes; the credential arm is preserved on write-back.withDelegatestree builder with XDR-byte sorting and within-array duplicate rejection.AssembledTransactionand SEP-45 web auth handle all credential arms; a delegates-only entry passes the send precheck with a void top-level signature.Hardening
Tooling
tools/skill-generator, and the API reference is regenerated.Defaults and protocol gating
ADDRESScredential remains the default; the new arms are opt-in and only valid on Protocol 27+.Source compatibility
SorobanCredentialsconstructor's first parameter was renamed from$addressCredentialsto$credentialType(nowint|SorobanAddressCredentials). Positional callers are unaffected. Callers that used the named argumentaddressCredentials:should switch tocredentialType:or to theforAddressCredentials()factory: the old named call still compiles but now binds to a different parameter and yields source-account credentials.Closes #93.