feat(platform)!: contract references may require the referenced contract's owner relation and config flags - #4915
Merged
Conversation
…act's owner relation to the writer `contractRequirements` on a `contract` `refersTo` gains `owner`: `"self"` requires the referenced contract to be owned by the `$ownerId` of the referring document (the transition's owner), a write gate like the `$ownerId` property agreement of a document reference; `"other"` requires it not to be. The check runs against the contract already fetched for the existence check, so it costs no further read, and refuses the write with the existing `ReferencedContractRequirementNotMetError` (40135), field `owner`, required `self` or `other`. The requirements are now checked against a `ReferringWrite` (the writer's id and the block time) instead of the block time alone. Meta-schema v3, the parser, the wasm-dpp2 surface, the v14 changelog and the book are extended in place, protocol version 14 being unreleased. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…act to be read-only, keep history or protect its owner `contractRequirements` on a `contract` `refersTo` gains three flags read from the referenced contract's config: `readonly: true` requires a read-only contract, one that can never be updated again; `keepsHistory: true` requires one keeping its history; `ownerProtected: true | false` requires an elected moderation declaration whose owner protection flag has that value, so a contract with no moderation or non-elected moderation meets neither value and the check implies elected moderation without the schema having to say so. Only `true` is meaningful for the first two, so the parser and the meta-schema (`const: true`) refuse `false`. An unmet flag refuses the write with the existing `ReferencedContractRequirementNotMetError` (40135), field the key and required `true` or `false`. Meta-schema v3, the parser, the wasm-dpp2 surface, the v14 changelog and the book are extended in place, protocol version 14 being unreleased. The drive-abci reference test helper for an elected contract takes the owner protection flag, and a new one writes a contract with an adjusted config. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: dashpay/platform/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (18)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe PR adds ChangesContract reference requirements
Priority: ➖ Normal Estimated code review effort: 4 (Complex) | ~60 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant DocumentCreation
participant DocumentReferenceValidation
participant ContractReferenceRequirements
participant ReferencedContract
DocumentCreation->>DocumentReferenceValidation: validate referenced contract
DocumentReferenceValidation->>ContractReferenceRequirements: pass ReferringWrite
ContractReferenceRequirements->>ReferencedContract: check owner and configuration
ReferencedContract-->>ContractReferenceRequirements: requirement result
ContractReferenceRequirements-->>DocumentReferenceValidation: success or first unmet requirement
Suggested reviewers: Merge Risk: ⚪ Minimal · up to Protocol v14 contract references now support owner and configuration requirements with corresponding validation and compatibility coverage. No merge-blocking risk is established by the supplied evidence. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
waiting-bots
Collaborator
|
|
Contributor
|
📖 Book Preview built successfully. Download the preview from the workflow artifacts. Updated at 2026-09-22T17:09:43.787Z |
Resolves the overlap with #4914 (electionDelay + `moderation: "electionOpen"`): both sets of `contractRequirements` keys are kept in the type, the parser tests, the meta-schema, the wasm-dpp2 surface, the book and the changelog. The drive-abci elected-contract test helper takes the election delay, the recorded creation time and the owner protection flag, and every helper's setup closure receives the reference targets. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
12 tasks
21 tasks
12 tasks
QuantumExplorer
added a commit
that referenced
this pull request
Sep 22, 2026
…istration, agreement refused (#4922 port) Takes from the independent implementation in #4922 what it did better: - `class_methods/parse_typed_array` is its own versioned method run before the scalar parser, whose signature and "array" arm are restored byte-for-byte; below protocol version 14 the historical refusal is reached exactly as before. - The `maxItems` requirement and its `SystemLimits::max_typed_array_items` cap move to the generation 3 driver under full validation, like the other registration limits, so a later, lower cap can never make a stored contract unreadable; `TypedArrayProperty::max_items` is `Option<u16>`. - drive-abci refuses a `propertyAgreement` on a typed array on either side (fixture + test): the write-time check compares index key encodings, which a list does not have. - The ranked key-length check skips typed arrays so the type error is the one reported; a test pins it. - Byte array items whose bounds pin 20, 32 or 36 bytes read back as `Bytes20/32/36`, boolean items must be 0 or 1, item bounds are read at u16 like the scalar bounds. - Meta-schema v3: `items` is allowed on `type: array` only. - wasm-dpp2: `maxItems` is optional on the surface; a mocha spec covers the accessors. Merges v4.2-dev (#4915). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue being fixed or feature implemented
#4909 introduced
contractRequirementsonrefersTo: { "type": "contract" }withmoderation: "elected", and #4913 addedminimumAgeSecondsandminimumSecondsSinceUpdate. This adds four more requirements on the referenced contract, following the same grammar: each key names an aspect of the referenced contract and its value the requirement on it, closed sets of values, checked when the referring document is written against the contract already fetched for the existence check, so none costs a further read. An unmet requirement refuses the write with the existingReferencedContractRequirementNotMetError(40135),fieldthe key andrequiredthe value as the schema spells it. No new error code and no newStateErrordiscriminant.The first user is the moderation charter contract's
targetContractId(#4898), but the requirements are general. Two consequences for #4898 worth deciding there: the charter'stargetContractIdcan now declareowner: "other"if owners may not charter a team over their own contract, and a target declaredreadonly: truemakesminimumSecondsSinceUpdatemoot for it, since a read-only contract is never updated again.What was done?
Two commits, one per group of requirements.
Commit 1:
owner("self" | "other").selfrequires the referenced contract's owner to be the$ownerIdof the referring document (the transition's owner), a write gate like the$ownerIdproperty agreement of a document reference;otherrequires it not to be. Modelled asContractReferenceOwner { Writer, Other }with wire namesselfandother(as_str/from_wire_name, likeContractReferenceModeration). The requirements are now checked against a smallReferringWrite { owner_id, block_time_ms }instead of the block time alone;validate_document_references_v0already had the owner id.Commit 2:
readonly,keepsHistory,ownerProtected, read from the referenced contract's config:readonly: truerequiresconfig().readonly(), a contract that can never be updated again. Onlytrueis meaningful, so the parser and the meta-schema ("const": true) refusefalse.keepsHistory: truerequiresconfig().keeps_history(), the same way.ownerProtected: true | falserequires an elected moderation declaration whoseowner_protectedequals the value. A contract with no moderation or non-elected moderation meets neither value, so the check implies elected moderation without the schema having to saymoderation: "elected"too.Surfaces extended in place (protocol version 14 is unreleased):
ContractReferenceRequirements/ContractReferenceRequirementin rs-dpp, thecontractRequirementsparser, meta-schema v3,Displayof the reference target, the 40135 error docs, the wasm-dpp2contractRequirementsTypeScript type andreference_to_js, the v14 changelog item 24 and the book paragraph on referencing an elected contract.How Has This Been Tested?
Displaycases, unit tests ofis_met_byfor the owner relation and each config flag (including appointed and elected moderation forownerProtected), and the update compatibility test now covers a changedowner, a changedownerProtected, an addedreadonlyand a removedkeepsHistory(each reported at its own path).ownerself/other against a contract owned by the writer versus the fixture owned by someone else;readonlyandkeepsHistoryagainst a contract whose config sets the flag versus the plain fixture;ownerProtectedagainst an elected declaration with the flag set, one with it unset, and a contract with no moderation at all. The reference-validation test helper's setup step now receives the reference targets (the writer's identity among them) so a test can write a contract owned by the writer.cargo test -p dpp --lib(targeted:contract_refers_to contract_requirements reference_targets should_display_reference_targets meta_validators owner_requirement config_flag contract_reference_requirement_changes),cargo test -p drive-abci --lib -- referenced_contract owned_contract readonly_contract history_keeping owner_protection,cargo check -p wasm-dpp2 --target wasm32-unknown-unknown,cargo clippy -p dpp --all-targets --features validation,fixtures-and-mocks,cargo clippy -p drive-abci --lib --tests,cargo fmt --all.#4914 merged in. The electionDelay PR landed on
v4.2-devwhile this one was open and touched the same type, meta-schema block and the drive-abci elected-contract test helper. The merge commit keeps both key sets (moderation: "elected" | "electionOpen"beside the four keys here); the elected-contract helper now takes the election delay, the recorded creation time and the owner protection flag, and all 29 reference tests (the four electionOpen ones included) pass on the merged tree.Breaking Changes
Consensus: a document type may now declare requirements a referenced contract did not have to meet before, and a write against a contract that does not meet one is refused with 40135. Contracts on protocol version 14 (unreleased) only; existing declarations are unaffected. Meta-schema v3 gains four
contractRequirementskeys, extended in place.Checklist:
structure.rs, regeneratedgrovedb-structure.json, and checked the structure viewer link posted on this pull requestFor repository code-owners and collaborators only
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
PR Hygiene ·
4effae2/skip-botsproceeds without the ones not yet reported/self-reviewedonce the bots are doneWhen every box is checked the
PR Hygienecheck passes and this can merge.