v0.3.13-pre.005

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 13
+// version: 14
 
 //! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
 
@@ -612,6 +612,46 @@ fn v0_3_13_pre_004_standard_block_redaction_version_and_null_guards_are_explicit
     return;
 }
 
+#[test]
+fn v0_3_13_pre_005_helius_transaction_redaction_full_reference_and_tier_neutrality_are_explicit() {
+    let resources = include_str!("../src/runtime_resources.rs");
+    for required in [
+        "RawTransactionIngestHeliusTransactionSource",
+        ".field(\"filter\"",
+        ".field(\"filter_fingerprint_bytes\"",
+        ".field(\"source_key_bytes\"",
+        "HeliusTransactionNotification::Full(value)",
+        "source.helius_transaction_notification_unqualified",
+        "project_helius_transaction_signal",
+        "transaction_index: std::option::Option::Some(response.transaction_index())",
+        "RAW_TRANSACTION_INGEST_HELIUS_TRANSACTION_HTTP_PROTOCOL",
+    ] {
+        assert!(resources.contains(required), "required pre.005 Helius hardening guard missing: {required}");
+    }
+    let source_struct = match resources.split_once("pub struct RawTransactionIngestHeliusTransactionSource {") {
+        std::option::Option::Some((_, tail)) => match tail.split_once("impl crate::RawTransactionIngestHeliusTransactionSource") {
+            std::option::Option::Some((value, _)) => value,
+            std::option::Option::None => "",
+        },
+        std::option::Option::None => "",
+    };
+    for forbidden in ["url:", "api_key", "credential", "transaction:", "payload:", "tier:"] {
+        assert!(!source_struct.contains(forbidden), "sensitive/provider material stored in Helius transaction source: {forbidden}");
+    }
+    let projection = match resources.split_once("fn project_helius_transaction_signal") {
+        std::option::Option::Some((_, tail)) => match tail.split_once("trait RawTransactionIngestStandardLogsView") {
+            std::option::Option::Some((value, _)) => value,
+            std::option::Option::None => "",
+        },
+        std::option::Option::None => "",
+    };
+    assert!(!projection.contains(".transaction()"), "Helius nested full payload must not enter Worker projection");
+    for forbidden in ["Developer", "Business", "Professional", "paid_tier", "provider_tier"] {
+        assert!(!resources.contains(forbidden), "provider tier must not be coded in Worker: {forbidden}");
+    }
+    return;
+}
+
 #[test]
 fn v0_3_12_pre_009_hydration_retry_ownership_and_no_orphan_cleanup_are_explicit() {
     let resources = include_str!("../src/runtime_resources.rs");