smartcontract: add user ownership transfer and feed authority subscribe bypass#3364
Draft
smartcontract: add user ownership transfer and feed authority subscribe bypass#3364
Conversation
Add a new instruction (variant 104) that transfers ownership of a user account from one access pass to another. The instruction validates that both access passes share the same client_ip as the user, updates connection counters and status on both access passes, and merges multicast pub/sub allowlists from the old to the new access pass. Authorization: the old access pass must have user_payer matching the feed authority, OR the payer must be a foundation allowlist member.
When connecting multicast and an existing user is found that is owned by the feed authority, automatically transfer ownership to the client's payer if they have an access pass for the same IP. This wires up the TransferUserOwnership instruction through the SDK and CLI.
Add a hidden CLI subcommand `user transfer-ownership` to both the doublezero and doublezero-admin CLIs, allowing foundation members to manually transfer user ownership between access passes.
Add instruction-level test for old access pass client_ip mismatch, and SDK unit tests for the TransferUserOwnershipCommand including the success path and the old access pass not found error case.
Add get_globalstate mock to test fixture for maybe_transfer_user_ownership, and fix needless borrow clippy warning.
The delete instruction validates the access pass against user.owner, so if the user is still owned by the feed authority, a regular client's delete will fail. Add the same maybe_transfer_user_ownership check before deleting each user during disconnect.
snormore
force-pushed
the
snor/transfer-user-ownership
branch
from
467420a to
659a8b1
Compare
The feed authority (from globalstate) can now subscribe/unsubscribe users to multicast groups without the access pass allowlist check. This is needed because the feed authority manages users on behalf of clients before ownership is transferred.
snormore
changed the title
snormore
changed the title
…ber allowlist Remove the restriction that prevented the feed authority from modifying access passes it doesn't own. The feed authority needs to manage subscriber allowlists on behalf of users before ownership is transferred.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
TransferUserOwnership(variant 104) that transfers user ownership between access passes, updating connection counters, status, and merging multicast pub/sub allowlistsconnect multicastanddisconnect multicast, automatically transfer ownership from the feed authority to the client's payer when the client has an access pass for the same IP (required for delete to succeed)user transfer-ownershipadmin CLI command for foundation members to manually trigger transfersDiff Breakdown
~74% tests, ~24% core logic — well-covered new feature.
Key files (click to expand)
smartcontract/programs/.../processors/user/transfer_ownership.rs— new instruction processor: account validation, auth checks, connection counter updates, multicast allowlist merging, ownership transfersmartcontract/sdk/rs/src/commands/user/transfer_ownership.rs— SDK command that resolves access pass PDAs and sends the transaction, with unit testsclient/doublezero/src/command/connect.rs—maybe_transfer_user_ownershiphelper called during connect multicastclient/doublezero/src/command/disconnect.rs— same transfer check before delete during disconnectsmartcontract/programs/.../processors/multicastgroup/subscribe.rs— allow feed authority to bypass allowlist checks when subscribing userssmartcontract/sdk/rs/src/commands/multicastgroup/subscribe.rs— skip SDK-side allowlist validation for feed authoritysmartcontract/cli/src/user/transfer_ownership.rs— CLI wrapper for the adminuser transfer-ownershipsubcommandTesting Verification
cargo test -p doublezero-serviceability,cargo test -p doublezero_sdk,cargo test -p doublezero)