From 516c52ece957742a9edee610908299d3ea77aace Mon Sep 17 00:00:00 2001 From: SinuS Von SifriduS Date: Thu, 3 Sep 2026 22:05:45 +0200 Subject: [PATCH] v0.3.8-pre.010-fix.002 --- Cargo.toml | 4 +- .../tests/desktop_security.rs | 24 ++++++++--- deltas/0.3.8/pre.010-fix.002.md | 43 +++++++++++++++++++ docs/validation/025-V0_3_8_STORE_DESK.md | 14 +++++- 4 files changed, 77 insertions(+), 8 deletions(-) create mode 100644 deltas/0.3.8/pre.010-fix.002.md diff --git a/Cargo.toml b/Cargo.toml index 4841ab6..28e22d8 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,12 +1,12 @@ # file: Cargo.toml -# version: 467 +# version: 468 [workspace] resolver = "3" members = ["crates/ksp-app-backfill-desk", "crates/ksp-app-config-desk", "crates/ksp-app-solprices-desk", "crates/ksp-app-store-desk", "crates/ksp-app-wallet-desk", "crates/ksp-config-lib", "crates/ksp-core-lib", "crates/ksp-interface-lib", "crates/ksp-job-api", "crates/ksp-job-backfill-lib", "crates/ksp-logging-lib", "crates/ksp-offchain-transport-lib", "crates/ksp-onchain-transport-lib", "crates/ksp-program-api", "crates/ksp-store-api", "crates/ksp-store-lib", "crates/ksp-store-postgres-lib", "crates/ksp-wallet-lib"] [workspace.package] -version = "0.3.8-pre.10.fix.1" +version = "0.3.8-pre.10.fix.2" edition = "2024" license = "MIT" repository = "https://git.sasedev.com/Sasedev/khadhroony-solana-project" diff --git a/crates/ksp-app-store-desk/tests/desktop_security.rs b/crates/ksp-app-store-desk/tests/desktop_security.rs index a749997..66e0eb5 100644 --- a/crates/ksp-app-store-desk/tests/desktop_security.rs +++ b/crates/ksp-app-store-desk/tests/desktop_security.rs @@ -1,5 +1,5 @@ // file: crates/ksp-app-store-desk/tests/desktop_security.rs -// version: 11 +// version: 12 //! Security boundary tests for the Store Desk scaffold. @@ -123,7 +123,8 @@ fn pre_007_transaction_request_rejects_datatables_search_order_draw_and_physical assert!(!dto.contains(forbidden), "forbidden DataTables/physical request material present: {forbidden}"); } assert!(runtime.contains("25 | 50 | 100")); - assert!(runtime.contains("request.offset.parse::()")); + assert!(runtime.contains("inspection_page_from_request(request.offset.as_str(), request.limit)")); + assert!(runtime.contains("offset_text.parse::()")); assert!(runtime.contains("RawSlotRange::new")); assert!(runtime.contains("\"ascending\" =>")); assert!(runtime.contains("\"descending\" =>")); @@ -209,7 +210,8 @@ fn pre_008_account_request_rejects_datatables_search_order_draw_network_and_phys assert!(!dto.contains(forbidden), "forbidden DataTables/physical account request material present: {forbidden}"); } assert!(runtime.contains("25 | 50 | 100")); - assert!(runtime.contains("request.offset.parse::()")); + assert!(runtime.contains("inspection_page_from_request(request.offset.as_str(), request.limit)")); + assert!(runtime.contains("offset_text.parse::()")); assert!(runtime.contains("parse_optional_pubkey(request.pubkey.as_deref())")); assert!(runtime.contains("RawSlotRange::new")); assert!(runtime.contains("request.pubkey.parse::()")); @@ -247,8 +249,20 @@ fn pre_010_observation_ipc_and_tracing_keep_entity_values_and_source_bytes_out_o assert!(!frontend.contains(r#"query started", { signature"#)); assert!(!frontend.contains(r#"query started", { pubkey"#)); assert!(!frontend.contains(r#"query completed", { observationKey"#)); - assert!(tauri.contains(r#"project_command_error("store_query_transaction_observations")"#)); - assert!(tauri.contains(r#"project_command_error("store_query_account_observations")"#)); + let transaction_command = tauri.find("fn store_query_transaction_observations"); + let account_command = tauri.find("fn store_query_account_observations"); + assert!(transaction_command.is_some()); + assert!(account_command.is_some()); + if let (std::option::Option::Some(transaction_start), std::option::Option::Some(account_start)) = (transaction_command, account_command) { + let transaction_source = &tauri[transaction_start..]; + let account_source = &tauri[account_start..transaction_start]; + assert!(transaction_source.contains("project_command_error")); + assert!(transaction_source.contains(r#""store_query_transaction_observations""#)); + assert!(transaction_source.contains("crate::TRACING_DOMAIN_STORE")); + assert!(account_source.contains("project_command_error")); + assert!(account_source.contains(r#""store_query_account_observations""#)); + assert!(account_source.contains("crate::TRACING_DOMAIN_STORE")); + } } #[test] diff --git a/deltas/0.3.8/pre.010-fix.002.md b/deltas/0.3.8/pre.010-fix.002.md new file mode 100644 index 0000000..cb51ec7 --- /dev/null +++ b/deltas/0.3.8/pre.010-fix.002.md @@ -0,0 +1,43 @@ + + + +# Delta `0.3.8-pre.010-fix.002` + +## Base + +- livraison directe : `0.3.8-pre.010-fix.001` ; +- workspace : `0.3.8-pre.10.fix.1` ; +- gate opérateur : tout est vert sauf trois canaris `desktop_security.rs` obsolètes après la centralisation du hardening `pre.010`. + +## Objet + +Réaligner les canaris de sécurité Store Desk sur les invariants réels de `pre.010` sans modifier le runtime. + +## Changements + +- les canaris Transaction et Account vérifient l'appel commun `inspection_page_from_request(request.offset.as_str(), request.limit)` et le parse `offset_text.parse::()` au lieu de l'ancien parse inline supprimé ; +- les canaris Observation vérifient la forme réelle de `project_command_error(..., crate::TRACING_DOMAIN_STORE, &error)` ; +- synchronisation de la version workspace vers `0.3.8-pre.10.fix.2` ; +- validation de tranche mise à jour. + +## Hors périmètre + +- aucun frontend/TypeScript/HTML ; +- aucun DTO ou IPC runtime ; +- aucun Store API/façade/PostgreSQL/SQL/schema ; +- aucune capability Tauri ou Config. + +## Gate recommandé + +```bash +cargo fmt --all +python3 scripts/audit_rust_workspace_rules.py +python3 scripts/audit_markdown_tables.py README.md RULES.md ROADMAP.md CHANGELOG.md docs prompts crates deltas + +cargo check --workspace +cargo clippy --workspace --all-targets + +cargo test -p ksp-app-store-desk +cargo test -p ksp-store-lib +cargo check -p ksp-store-lib --no-default-features +``` diff --git a/docs/validation/025-V0_3_8_STORE_DESK.md b/docs/validation/025-V0_3_8_STORE_DESK.md index b44b88a..153f986 100644 --- a/docs/validation/025-V0_3_8_STORE_DESK.md +++ b/docs/validation/025-V0_3_8_STORE_DESK.md @@ -1,5 +1,5 @@ - + # Validation v0.3.8 — Store Desk V1 RAW @@ -773,3 +773,15 @@ Le gate opérateur de `0.3.8-pre.10` confirme que les audits KSP, `cargo check - - [X] la version workspace devient `0.3.8-pre.10.fix.1` car un test Rust est modifié. Le gate Cargo du fix reste à rejouer après application du delta. + +## 37. `pre.010-fix.002` — canaris de hardening alignés sur la centralisation `pre.010` + +Le gate opérateur de `0.3.8-pre.10.fix.1` confirme que les audits KSP, `cargo check --workspace`, Clippy, les 37 tests unitaires Store Desk, les dependency/desktop contract/public API tests et Store façade sont verts. Trois assertions `desktop_security.rs` restent obsolètes par rapport au code réellement introduit en `pre.010` : + +- [X] les canaris Transaction et Account ne recherchent plus `request.offset.parse::()`, supprimé lors de la centralisation, mais vérifient l'appel commun `inspection_page_from_request(request.offset.as_str(), request.limit)` et le parse réel `offset_text.parse::()` dans le helper ; +- [X] les deux commandes Observation vérifient désormais la forme réellement formatée de `project_command_error(..., crate::TRACING_DOMAIN_STORE, &error)` ; +- [X] aucun invariant de sécurité n'est relâché : whitelist 25/50/100, offset `u64`, absence de `draw/search/order/cursor/network` dans les DTO et projection d'erreur statique restent contrôlés ; +- [X] aucun runtime, frontend, DTO, IPC, Store API/façade, PostgreSQL, SQL, Config ou capability Tauri n'est modifié ; +- [X] la version workspace devient `0.3.8-pre.10.fix.2` car un test Rust est modifié. + +Le gate Cargo du fix reste à rejouer après application du delta.