fix(user_registry): keep Privy DID to wallet mapping unique on update and recovery (#1075)

update_privy_did and recover_privy_did could move a DID onto a wallet
already linked to another DID, overwriting its reverse index. Reject
that case, matching register_privy_did.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: aladuru001

contracts/contracts/user_registry/src/lib.rs

@@ -455,6 +455,14 @@ impl UserRegistryContract {
         if stored_wallet != old_wallet {
             panic!("unauthorized: old wallet does not match registered wallet");
         }
+        // One wallet -> one DID: the new wallet must not already be linked.
+        if env
+            .storage()
+            .persistent()
+            .has(&DataKey::WalletDid(new_wallet.clone()))
+        {
+            panic!("wallet already has a DID linked");
+        }
         // Remove old reverse mapping
         env.storage()
             .persistent()
@@ -480,6 +488,14 @@ impl UserRegistryContract {
         let admin = Self::require_admin(&env);
         admin.require_auth();
         let did_key = DataKey::PrivyDid(did.clone());
+        // One wallet -> one DID: the new wallet must not already be linked.
+        if env
+            .storage()
+            .persistent()
+            .has(&DataKey::WalletDid(new_wallet.clone()))
+        {
+            panic!("wallet already has a DID linked");
+        }
         // Remove old reverse mapping if present
         if let Some(old_wallet) = env.storage().persistent().get::<DataKey, Address>(&did_key) {
             env.storage()

contracts/contracts/user_registry/src/test.rs

@@ -177,6 +177,27 @@ fn test_recover_privy_did_as_admin() {
     assert_eq!(client.get_wallet_for_did(&did), new_wallet);
 }
 
+/// Verify that update and recovery cannot move a DID onto a wallet that is
+/// already linked to another DID (one wallet -> one DID).
+#[test]
+#[ignore = "contract panics are non-unwinding under Soroban v20 testutils and abort the test process"]
+fn test_update_and_recover_reject_wallet_already_linked() {
+    let (env, client, signing_key) = setup();
+    let wallet_a = Address::generate(&env);
+    let wallet_b = Address::generate(&env);
+    let did_a = String::from_str(&env, "did:privy:a");
+    let did_b = String::from_str(&env, "did:privy:b");
+    let sig_a = sign_did_link(&env, &signing_key, &did_a, &wallet_a);
+    let sig_b = sign_did_link(&env, &signing_key, &did_b, &wallet_b);
+    client.register_privy_did(&did_a, &wallet_a, &sig_a);
+    client.register_privy_did(&did_b, &wallet_b, &sig_b);
+
+    assert!(client.try_update_privy_did(&did_a, &wallet_a, &wallet_b).is_err());
+    assert!(client.try_recover_privy_did(&did_a, &wallet_b).is_err());
+    assert_eq!(client.get_wallet_for_did(&did_a), wallet_a);
+    assert_eq!(client.get_did_for_wallet(&wallet_b), did_b);
+}
+
 /// Verify that querying an unregistered DID returns an error.
 #[test]
 #[ignore = "contract panics are non-unwinding under Soroban v20 testutils and abort the test process"]