Skip to content

Add comprehensive event emission for auth-related failures #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alberto-crossmint wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add comprehensive event emission for auth-related failures #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5543d73
Add comprehensive event emission for auth-related failures
devin-ai-integration[bot] Jul 24, 2025
7d3dc8f
Update Cargo.lock after running tests
devin-ai-integration[bot] Jul 24, 2025
be95abf
Fix formatting issues for CI lint checks
devin-ai-integration[bot] Jul 24, 2025
df8664c
Fix unused variable warnings in signer_key_to_string
devin-ai-integration[bot] Jul 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

224 changes: 215 additions & 9 deletions contracts/smart-account/src/account.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,42 @@ pub struct SignerRevokedEvent {
pub revoked_signer: Signer,
}

#[contracttype]
#[derive(Clone)]
pub struct AuthCheckFailedEvent {
pub error_code: u32,
pub error_message: soroban_sdk::String,
pub signer_key: Option<soroban_sdk::String>,
pub context: Option<soroban_sdk::String>,
}

#[contracttype]
#[derive(Clone)]
pub struct SignerOperationFailedEvent {
pub operation: soroban_sdk::String,
pub error_code: u32,
pub error_message: soroban_sdk::String,
pub signer_key: Option<soroban_sdk::String>,
}

#[contracttype]
#[derive(Clone)]
pub struct PolicyValidationFailedEvent {
pub policy_type: soroban_sdk::String,
pub error_code: u32,
pub error_message: soroban_sdk::String,
pub signer_key: Option<soroban_sdk::String>,
}

#[contracttype]
#[derive(Clone)]
pub struct SignatureVerificationFailedEvent {
pub error_code: u32,
pub error_message: soroban_sdk::String,
pub signer_key: soroban_sdk::String,
pub proof_type: soroban_sdk::String,
}

/// SmartAccount is a multi-signature account contract that provides enhanced security
/// through role-based access control and policy-based authorization.
///
Expand Down Expand Up @@ -67,6 +103,31 @@ impl SmartAccount {
env.current_contract_address().require_auth();
}
}

fn error_to_code_and_message(env: &Env, error: &Error) -> (u32, soroban_sdk::String) {
let (code, message) = match error {
Error::SignerNotFound => (1, "SignerNotFound"),
Error::SignerAlreadyExists => (2, "SignerAlreadyExists"),
Error::NoProofsInAuthEntry => (3, "NoProofsInAuthEntry"),
Error::InsufficientPermissions => (4, "InsufficientPermissions"),
Error::InsufficientPermissionsOnCreation => (5, "InsufficientPermissionsOnCreation"),
Error::CannotRevokeAdminSigner => (6, "CannotRevokeAdminSigner"),
Error::InvalidProofType => (7, "InvalidProofType"),
Error::SignatureVerificationFailed => (8, "SignatureVerificationFailed"),
Error::InvalidPolicy => (9, "InvalidPolicy"),
Error::InvalidNotAfterTime => (10, "InvalidNotAfterTime"),
Error::InvalidTimeRange => (11, "InvalidTimeRange"),
_ => (999, "UnknownError"),
};
(code, soroban_sdk::String::from_str(env, message))
}

fn signer_key_to_string(env: &Env, signer_key: &SignerKey) -> soroban_sdk::String {
match signer_key {
SignerKey::Ed25519(_key) => soroban_sdk::String::from_str(env, "ed25519_key"),
SignerKey::Secp256r1(_key_id) => soroban_sdk::String::from_str(env, "secp256r1_key"),
}
}
}

// ============================================================================
Expand All @@ -91,13 +152,35 @@ impl SmartAccountInterface for SmartAccount {

// Check that there is at least one admin signer to prevent the contract from being locked out.
if !signers.iter().any(|s| s.role() == SignerRole::Admin) {
let (error_code, error_message) =
Self::error_to_code_and_message(&env, &Error::InsufficientPermissionsOnCreation);
env.events().publish(
(symbol_short!("constr"), symbol_short!("failed")),
SignerOperationFailedEvent {
operation: soroban_sdk::String::from_str(&env, "constructor"),
error_code,
error_message,
signer_key: None,
},
);
panic_with_error!(env, Error::InsufficientPermissionsOnCreation);
}

let mut seen_signer_keys = Vec::new(&env);
for signer in signers.iter() {
let signer_key: SignerKey = signer.clone().into();
if seen_signer_keys.contains(&signer_key) {
let (error_code, error_message) =
Self::error_to_code_and_message(&env, &Error::SignerAlreadyExists);
env.events().publish(
(symbol_short!("constr"), symbol_short!("failed")),
SignerOperationFailedEvent {
operation: soroban_sdk::String::from_str(&env, "constructor"),
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(&env, &signer_key)),
},
);
panic_with_error!(env, Error::SignerAlreadyExists);
}
seen_signer_keys.push_back(signer_key);
Expand All @@ -107,9 +190,23 @@ impl SmartAccountInterface for SmartAccount {
// If it's a restricted signer, we check that the policies are valid.
if let SignerRole::Restricted(policies) = signer.role() {
for policy in policies {
policy
.check(&env)
.unwrap_or_else(|e| panic_with_error!(env, e));
if let Err(e) = policy.check(&env) {
let (error_code, error_message) = Self::error_to_code_and_message(&env, &e);
let signer_key: SignerKey = signer.clone().into();
env.events().publish(
(symbol_short!("constr"), symbol_short!("failed")),
PolicyValidationFailedEvent {
policy_type: soroban_sdk::String::from_str(
&env,
"restricted_policy",
),
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(&env, &signer_key)),
},
);
panic_with_error!(env, e);
}
}
}
SmartAccount::add_signer(&env, signer).unwrap_or_else(|e| panic_with_error!(env, e));
Expand All @@ -121,7 +218,23 @@ impl SmartAccountInterface for SmartAccount {
fn add_signer(env: &Env, signer: Signer) -> Result<(), Error> {
Self::require_auth_if_initialized(env);
let key = signer.clone().into();
Storage::default().store::<SignerKey, Signer>(env, &key, &signer)?;
match Storage::default().store::<SignerKey, Signer>(env, &key, &signer) {
Ok(_) => {}
Err(e) => {
let error: Error = e.into();
let (error_code, error_message) = Self::error_to_code_and_message(env, &error);
env.events().publish(
(symbol_short!("signer"), symbol_short!("failed")),
SignerOperationFailedEvent {
operation: soroban_sdk::String::from_str(env, "add_signer"),
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(env, &key)),
},
);
return Err(error);
}
}

let event = SignerAddedEvent {
signer_key: key.clone(),
Expand All @@ -138,7 +251,23 @@ impl SmartAccountInterface for SmartAccount {
let key = signer.clone().into();

let storage = Storage::default();
storage.update::<SignerKey, Signer>(env, &key, &signer)?;
match storage.update::<SignerKey, Signer>(env, &key, &signer) {
Ok(_) => {}
Err(e) => {
let error: Error = e.into();
let (error_code, error_message) = Self::error_to_code_and_message(env, &error);
env.events().publish(
(symbol_short!("signer"), symbol_short!("failed")),
SignerOperationFailedEvent {
operation: soroban_sdk::String::from_str(env, "update_signer"),
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(env, &key)),
},
);
return Err(error);
}
}

let event = SignerUpdatedEvent {
signer_key: key.clone(),
Expand All @@ -155,15 +284,56 @@ impl SmartAccountInterface for SmartAccount {

let storage = Storage::default();

let signer_to_revoke = storage
.get::<SignerKey, Signer>(env, &signer_key)
.ok_or(Error::SignerNotFound)?;
let signer_to_revoke = match storage.get::<SignerKey, Signer>(env, &signer_key) {
Some(signer) => signer,
None => {
let (error_code, error_message) =
Self::error_to_code_and_message(env, &Error::SignerNotFound);
env.events().publish(
(symbol_short!("signer"), symbol_short!("failed")),
SignerOperationFailedEvent {
operation: soroban_sdk::String::from_str(env, "revoke_signer"),
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(env, &signer_key)),
},
);
return Err(Error::SignerNotFound);
}
};

if signer_to_revoke.role() == SignerRole::Admin {
let (error_code, error_message) =
Self::error_to_code_and_message(env, &Error::CannotRevokeAdminSigner);
env.events().publish(
(symbol_short!("signer"), symbol_short!("failed")),
SignerOperationFailedEvent {
operation: soroban_sdk::String::from_str(env, "revoke_signer"),
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(env, &signer_key)),
},
);
return Err(Error::CannotRevokeAdminSigner);
}

storage.delete::<SignerKey>(env, &signer_key)?;
match storage.delete::<SignerKey>(env, &signer_key) {
Ok(_) => {}
Err(e) => {
let error: Error = e.into();
let (error_code, error_message) = Self::error_to_code_and_message(env, &error);
env.events().publish(
(symbol_short!("signer"), symbol_short!("failed")),
SignerOperationFailedEvent {
operation: soroban_sdk::String::from_str(env, "revoke_signer"),
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(env, &signer_key)),
},
);
return Err(error);
}
}

let event = SignerRevokedEvent {
signer_key: signer_key.clone(),
Expand Down Expand Up @@ -219,6 +389,17 @@ impl CustomAccountInterface for SmartAccount {

// Ensure we have at least one authorization proof
if proof_map.is_empty() {
let (error_code, error_message) =
Self::error_to_code_and_message(&env, &Error::NoProofsInAuthEntry);
env.events().publish(
(symbol_short!("auth"), symbol_short!("failed")),
AuthCheckFailedEvent {
error_code,
error_message,
signer_key: None,
context: Some(soroban_sdk::String::from_str(&env, "no_proofs_provided")),
},
);
return Err(Error::NoProofsInAuthEntry);
}

Expand All @@ -228,6 +409,17 @@ impl CustomAccountInterface for SmartAccount {
for (signer_key, _) in proof_map.iter() {
if !storage.has(&env, &signer_key) {
log!(&env, "Signer not found {:?}", signer_key);
let (error_code, error_message) =
Self::error_to_code_and_message(&env, &Error::SignerNotFound);
env.events().publish(
(symbol_short!("auth"), symbol_short!("failed")),
AuthCheckFailedEvent {
error_code,
error_message,
signer_key: Some(Self::signer_key_to_string(&env, &signer_key)),
context: Some(soroban_sdk::String::from_str(&env, "signer_lookup_failed")),
},
);
return Err(Error::SignerNotFound);
}
}
Expand All @@ -250,6 +442,20 @@ impl CustomAccountInterface for SmartAccount {
}
}
if !context_authorized {
let (error_code, error_message) =
Self::error_to_code_and_message(&env, &Error::InsufficientPermissions);
env.events().publish(
(symbol_short!("auth"), symbol_short!("failed")),
AuthCheckFailedEvent {
error_code,
error_message,
signer_key: None,
context: Some(soroban_sdk::String::from_str(
&env,
"context_authorization_failed",
)),
},
);
return Err(Error::InsufficientPermissions);
}
}
Expand Down
11 changes: 10 additions & 1 deletion contracts/smart-account/src/auth/policy/allow_list.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
use soroban_sdk::{auth::Context, contracttype, Address, Env, Vec};
use soroban_sdk::{auth::Context, contracttype, symbol_short, Address, Env, Vec};

use crate::{
auth::permissions::{AuthorizationCheck, PolicyValidator},
Expand Down Expand Up @@ -28,6 +28,15 @@ impl PolicyValidator for ContractAllowListPolicy {
.allowed_contracts
.contains(env.current_contract_address())
{
env.events().publish(
(symbol_short!("policy"), symbol_short!("failed")),
crate::account::PolicyValidationFailedEvent {
policy_type: soroban_sdk::String::from_str(env, "contract_allow_list"),
error_code: 9,
error_message: soroban_sdk::String::from_str(env, "InvalidPolicy"),
signer_key: None,
},
);
return Err(Error::InvalidPolicy);
}
Ok(())
Expand Down
Loading