Skip to content

Commit 04e2b9d

Browse files
mfteemftee
authored
Merge pull request #1253 from Qoder-Voidd/Authorization-audit—require_auth-coverage-on-every-sensitive-entrypoin
Authorization-audit—require_auth-coverage-on-every-sensitive-entrypoin
2 parents bbfffc4 + 51f5b5e commit 04e2b9d

5 files changed

Lines changed: 303 additions & 11 deletions

File tree

‎contracts/document/src/lib.rs‎

Lines changed: 42 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ impl DocumentContract {
117117
if env.storage().instance().has(&DataKey::Admin) {
118118
return Err(DocumentError::AlreadyInitialized);
119119
}
120+
admin.require_auth();
120121
env.storage().instance().set(&DataKey::Admin, &admin);
121122
env.storage().persistent().set(&DataKey::Counter, &0u64);
122123
Ok(())
@@ -163,7 +164,7 @@ impl DocumentContract {
163164
content_hash: BytesN<32>,
164165
ipfs_cid: Bytes,
165166
) -> Result<u64, DocumentError> {
166-
uploader.require_auth();
167+
uploader.require_auth_for_args(&[&shipment_id, &doc_type, &content_hash, &ipfs_cid]);
167168

168169
if ipfs_cid.is_empty() {
169170
return Err(DocumentError::InvalidInput);
@@ -218,7 +219,7 @@ impl DocumentContract {
218219
if verifier != admin {
219220
return Err(DocumentError::Unauthorized);
220221
}
221-
verifier.require_auth();
222+
verifier.require_auth_for_args(&[&doc_id]);
222223

223224
let mut doc = Self::load(&env, doc_id)?;
224225
if doc.status != DocumentStatus::Pending {
@@ -408,6 +409,45 @@ mod tests {
408409
(id, hash)
409410
}
410411

412+
#[test]
413+
fn test_initialize_requires_auth() {
414+
let env = Env::default();
415+
let admin = Address::generate(&env);
416+
let contract_id = env.register(DocumentContract {}, ());
417+
let client = DocumentContractClient::new(&env, &contract_id);
418+
419+
let result = client.try_initialize(&admin);
420+
assert!(result.is_err());
421+
}
422+
423+
#[test]
424+
fn test_register_document_requires_auth() {
425+
let env = Env::default();
426+
let uploader = Address::generate(&env);
427+
let contract_id = env.register(DocumentContract {}, ());
428+
let client = DocumentContractClient::new(&env, &contract_id);
429+
430+
let result = client.try_register_document(
431+
&uploader,
432+
&1u64,
433+
&DocumentType::BillOfLading,
434+
&fake_hash(&env),
435+
&fake_cid(&env),
436+
);
437+
assert!(result.is_err());
438+
}
439+
440+
#[test]
441+
fn test_verify_document_requires_auth() {
442+
let env = Env::default();
443+
let verifier = Address::generate(&env);
444+
let contract_id = env.register(DocumentContract {}, ());
445+
let client = DocumentContractClient::new(&env, &contract_id);
446+
447+
let result = client.try_verify_document(&verifier, &1u64);
448+
assert!(result.is_err());
449+
}
450+
411451
#[test]
412452
fn test_register_document() {
413453
let (env, _, client) = setup();

‎contracts/escrow/src/lib.rs‎

Lines changed: 67 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ impl EscrowContract {
7777
if env.storage().instance().has(&DataKey::Admin) {
7878
return Err(EscrowError::AlreadyInitialized);
7979
}
80+
admin.require_auth();
8081
env.storage().instance().set(&DataKey::Admin, &admin);
8182
env.storage()
8283
.instance()
@@ -99,7 +100,7 @@ impl EscrowContract {
99100
shipment_id: u64,
100101
amount: i128,
101102
) -> Result<(), EscrowError> {
102-
shipper.require_auth();
103+
shipper.require_auth_for_args(&[&carrier, &shipment_id, &amount]);
103104

104105
if amount <= 0 {
105106
return Err(EscrowError::InvalidAmount);
@@ -235,7 +236,7 @@ impl EscrowContract {
235236
/// Raise a dispute for the escrow (mirrors the shipment dispute).
236237
/// Either party can call this; admin then resolves via release or refund.
237238
pub fn raise_dispute(env: Env, caller: Address, shipment_id: u64) -> Result<(), EscrowError> {
238-
caller.require_auth();
239+
caller.require_auth_for_args(&[&shipment_id]);
239240

240241
let mut record = Self::load(&env, shipment_id)?;
241242

@@ -427,6 +428,70 @@ mod tests {
427428
client.fund_escrow(shipper, carrier, &SHIPMENT_ID, &AMOUNT);
428429
}
429430

431+
#[test]
432+
fn test_initialize_requires_auth() {
433+
let env = Env::default();
434+
let admin = Address::generate(&env);
435+
let contract_id = env.register(EscrowContract {}, ());
436+
let client = EscrowContractClient::new(&env, &contract_id);
437+
438+
let result = client.try_initialize(&admin, &Address::generate(&env));
439+
assert!(result.is_err());
440+
}
441+
442+
#[test]
443+
fn test_fund_escrow_requires_auth() {
444+
let env = Env::default();
445+
let shipper = Address::generate(&env);
446+
let carrier = Address::generate(&env);
447+
let contract_id = env.register(EscrowContract {}, ());
448+
let client = EscrowContractClient::new(&env, &contract_id);
449+
450+
let result = client.try_fund_escrow(&shipper, &carrier, &SHIPMENT_ID, &AMOUNT);
451+
assert!(result.is_err());
452+
}
453+
454+
#[test]
455+
fn test_release_payment_requires_auth() {
456+
let env = Env::default();
457+
let contract_id = env.register(EscrowContract {}, ());
458+
let client = EscrowContractClient::new(&env, &contract_id);
459+
460+
let result = client.try_release_payment(&SHIPMENT_ID);
461+
assert!(result.is_err());
462+
}
463+
464+
#[test]
465+
fn test_refund_payment_requires_auth() {
466+
let env = Env::default();
467+
let contract_id = env.register(EscrowContract {}, ());
468+
let client = EscrowContractClient::new(&env, &contract_id);
469+
470+
let result = client.try_refund_payment(&SHIPMENT_ID);
471+
assert!(result.is_err());
472+
}
473+
474+
#[test]
475+
fn test_raise_dispute_requires_auth() {
476+
let env = Env::default();
477+
let caller = Address::generate(&env);
478+
let contract_id = env.register(EscrowContract {}, ());
479+
let client = EscrowContractClient::new(&env, &contract_id);
480+
481+
let result = client.try_raise_dispute(&caller, &SHIPMENT_ID);
482+
assert!(result.is_err());
483+
}
484+
485+
#[test]
486+
fn test_resolve_dispute_requires_auth() {
487+
let env = Env::default();
488+
let contract_id = env.register(EscrowContract {}, ());
489+
let client = EscrowContractClient::new(&env, &contract_id);
490+
491+
let result = client.try_resolve_dispute(&SHIPMENT_ID, &true);
492+
assert!(result.is_err());
493+
}
494+
430495
#[test]
431496
fn test_fund_and_release() {
432497
let (env, _admin, shipper, carrier, token_addr, client) = setup(AMOUNT);

‎contracts/identity/src/lib.rs‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ impl IdentityContract {
4242
user_id_hash: BytesN<32>,
4343
wallet: Address,
4444
) -> Result<(), IdentityError> {
45-
wallet.require_auth();
45+
wallet.require_auth_for_args(&[&user_id_hash]);
4646

4747
if env
4848
.storage()
@@ -112,6 +112,39 @@ mod tests {
112112
Env,
113113
};
114114

115+
#[test]
116+
fn test_initialize_requires_auth() {
117+
let env = Env::default();
118+
let admin = Address::generate(&env);
119+
let contract_id = env.register(IdentityContract {}, ());
120+
let client = IdentityContractClient::new(&env, &contract_id);
121+
122+
let result = client.try_initialize(&admin);
123+
assert!(result.is_err());
124+
}
125+
126+
#[test]
127+
fn test_register_identity_requires_auth() {
128+
let env = Env::default();
129+
let wallet = Address::generate(&env);
130+
let contract_id = env.register(IdentityContract {}, ());
131+
let client = IdentityContractClient::new(&env, &contract_id);
132+
133+
let result = client.try_register_identity(&BytesN::random(&env), &wallet);
134+
assert!(result.is_err());
135+
}
136+
137+
#[test]
138+
fn test_revoke_identity_requires_auth() {
139+
let env = Env::default();
140+
let wallet = Address::generate(&env);
141+
let contract_id = env.register(IdentityContract {}, ());
142+
let client = IdentityContractClient::new(&env, &contract_id);
143+
144+
let result = client.try_revoke_identity(&wallet);
145+
assert!(result.is_err());
146+
}
147+
115148
#[test]
116149
fn test_register_and_verify() {
117150
let env = Env::default();

‎contracts/reputation/src/lib.rs‎

Lines changed: 51 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ impl ReputationContract {
133133
if env.storage().instance().has(&DataKey::Admin) {
134134
return Err(ReputationError::AlreadyInitialized);
135135
}
136+
admin.require_auth();
136137
env.storage().instance().set(&DataKey::Admin, &admin);
137138
env.storage()
138139
.instance()
@@ -151,7 +152,7 @@ impl ReputationContract {
151152
user: Address,
152153
user_type: UserType,
153154
) -> Result<(), ReputationError> {
154-
user.require_auth();
155+
user.require_auth_for_args(&[&user_type]);
155156

156157
if env
157158
.storage()
@@ -206,7 +207,7 @@ impl ReputationContract {
206207
rated: Address,
207208
score: u32,
208209
) -> Result<u64, ReputationError> {
209-
rater.require_auth();
210+
rater.require_auth_for_args(&[&shipment_id, &rated, &score]);
210211

211212
if !(1..=5).contains(&score) {
212213
return Err(ReputationError::InvalidScore);
@@ -326,7 +327,7 @@ impl ReputationContract {
326327
was_on_time: bool,
327328
was_successful: bool,
328329
) -> Result<(), ReputationError> {
329-
caller.require_auth();
330+
caller.require_auth_for_args(&[&user, &was_on_time, &was_successful]);
330331

331332
// Only the authorised contract or the admin may call this.
332333
let auth_contract: Address = env
@@ -544,6 +545,53 @@ mod tests {
544545
(env, admin, auth_contract, client)
545546
}
546547

548+
#[test]
549+
fn test_initialize_requires_auth() {
550+
let env = Env::default();
551+
let admin = Address::generate(&env);
552+
let auth_contract = Address::generate(&env);
553+
let contract_id = env.register(ReputationContract {}, ());
554+
let client = ReputationContractClient::new(&env, &contract_id);
555+
556+
let result = client.try_initialize(&admin, &auth_contract);
557+
assert!(result.is_err());
558+
}
559+
560+
#[test]
561+
fn test_register_user_requires_auth() {
562+
let env = Env::default();
563+
let user = Address::generate(&env);
564+
let contract_id = env.register(ReputationContract {}, ());
565+
let client = ReputationContractClient::new(&env, &contract_id);
566+
567+
let result = client.try_register_user(&user, &UserType::Carrier);
568+
assert!(result.is_err());
569+
}
570+
571+
#[test]
572+
fn test_submit_rating_requires_auth() {
573+
let env = Env::default();
574+
let rater = Address::generate(&env);
575+
let rated = Address::generate(&env);
576+
let contract_id = env.register(ReputationContract {}, ());
577+
let client = ReputationContractClient::new(&env, &contract_id);
578+
579+
let result = client.try_submit_rating(&rater, &1u64, &rated, &5u32);
580+
assert!(result.is_err());
581+
}
582+
583+
#[test]
584+
fn test_update_stats_requires_auth() {
585+
let env = Env::default();
586+
let caller = Address::generate(&env);
587+
let user = Address::generate(&env);
588+
let contract_id = env.register(ReputationContract {}, ());
589+
let client = ReputationContractClient::new(&env, &contract_id);
590+
591+
let result = client.try_update_stats(&caller, &user, &true, &false);
592+
assert!(result.is_err());
593+
}
594+
547595
#[test]
548596
fn test_register_user() {
549597
let (env, _, _, client) = setup();

0 commit comments

Comments
 (0)