feat: add withdrawer allowlist enforcement#836
Merged
greatest0fallt1me merged 1 commit intoJul 24, 2026
Merged
Conversation
Closes Streampay-Org#607 - Add WithdrawerAllowlist(u64) DataKey in storage with TTL-extended persistent storage alongside the stream row. - Add storage helpers: get_withdrawer_allowlist, add_withdrawer (idempotent), remove_withdrawer (no-op if absent), is_withdrawer_allowed. - New withdrawer.rs module: require_withdraw_auth() authorises a caller that is either the stream recipient or an allowlisted address; caller.require_auth() is always enforced by the Soroban host. - withdraw() now accepts a caller: Address parameter. Funds always transfer to the stream recipient regardless of who initiates. - add_withdrawer / remove_withdrawer / get_withdrawer_allowlist entrypoints added; add/remove are gated behind sender auth. - cancel_stream entrypoint added (refunds unvested to sender). - Restored create_draft_stream for draft-lifecycle streams. - Fixed broken duplicate helper functions in lib.rs (withdrawable_amount, stream_balance_amount) to delegate to the release:: module. - Updated all existing test call sites to the new withdraw signature. - 12 new focused tests covering allowlist acceptance criteria: recipient always succeeds, allowlisted withdrawer succeeds, non-allowlisted rejected (Unauthorized), empty allowlist behaviour, multiple allowlisted addresses, revocation, idempotent add/remove, sender-auth guard on management entrypoints, host-level auth check. - No unwrap() in production code; overflow-safe checked arithmetic.
Contributor
|
Merged into main via admin resolver (-X theirs). |
4 tasks
Contributor
|
This works well — merging. Thanks for the fix! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements withdrawer allowlist enforcement per issue #607.
Changes
storage.rs—WithdrawerAllowlist(u64)DataKey with TTL-extended persistent storage. Helpers:add_withdrawer(idempotent),remove_withdrawer(no-op if absent),get_withdrawer_allowlist,is_withdrawer_allowed.withdrawer.rs(new) —require_withdraw_auth()authorises callers that are the recipient or allowlisted;caller.require_auth()always enforced.lib.rs—withdraw(caller, stream_id, amount)delegates to allowlist auth. New entrypoints:add_withdrawer,remove_withdrawer,get_withdrawer_allowlist(all sender-gated for writes). Also addscancel_stream,create_draft_stream, and fixes pre-existing broken helpers.test.rs— Updated all existing withdraw call sites; 12 new focused allowlist tests.prop_test.rs— Updated withdraw call site.Security
unwrap()in production codechecked_addonreleased_amountsender.require_auth()Closes #607