subscriptions_test.gno
27.58 Kb · 827 lines
1package subscriptions
2
3import (
4 "chain"
5 "chain/banker"
6 "chain/runtime"
7 "strings"
8 "testing"
9
10 "gno.land/p/nt/testutils/v0"
11 "gno.land/p/nt/uassert/v0"
12)
13
14var (
15 testAdmin = testutils.TestAddress("subadmin")
16 prov1 = testutils.TestAddress("subprov1")
17 prov2 = testutils.TestAddress("subprov2")
18 alice = testutils.TestAddress("subalice")
19 bob = testutils.TestAddress("subbob")
20 mallory = testutils.TestAddress("submallory")
21)
22
23// Established harness facts, carried from the sibling realms' suites:
24// init runs with an empty origin context (the real deploy captures the
25// origin caller); the banker resets between tests while realm globals
26// persist, so conservation is asserted in DELTA form after re-seeding
27// carried liabilities; testing.SetRealm affects only the frame that
28// calls it; and testing.SkipHeights WIPES the origin/realm context, so
29// every caller is re-armed after a skip.
30func init() {
31 admin = testAdmin
32 feeRecipient = testAdmin
33 self = chain.PackageAddress("gno.land/r/g1qp5pt8cdq2f6kfdamn3yuxwg6quqnfpyewzz39/subscriptions")
34}
35
36type baseline struct{ held, users, fees int64 }
37
38func begin() baseline {
39 if l := Liabilities(); l > 0 {
40 testing.IssueCoins(Address(), ugnot(l))
41 }
42 return snap()
43}
44
45func snap() baseline {
46 return baseline{held: Held(), users: UsersTotal(), fees: FeesAccrued()}
47}
48
49// conserved asserts ΔH == ΔU + ΔF + extraSurplus — the realm's monetary
50// invariant in delta form. There is no escrow pool in this realm.
51func (b baseline) conserved(t *testing.T, extraSurplus int64) {
52 t.Helper()
53 dH := Held() - b.held
54 dU := UsersTotal() - b.users
55 dF := FeesAccrued() - b.fees
56 if dH != dU+dF+extraSurplus {
57 t.Fatalf("conservation violated: ΔH=%d ΔU=%d ΔF=%d ΔS=%d", dH, dU, dF, extraSurplus)
58 }
59 if Liabilities() != UsersTotal()+FeesAccrued() {
60 t.Fatalf("Liabilities() = %d, want U+F", Liabilities())
61 }
62}
63
64func coinsOf(addr address) int64 {
65 return banker.NewReadonlyBanker().GetCoin(addr, Denom)
66}
67
68func ugnot(n int64) chain.Coins {
69 return chain.NewCoins(chain.NewCoin(Denom, n))
70}
71
72// NOTE ON THE HARNESS. testing.SetRealm applies to the frame that CALLS
73// it, so the caller identity must be armed in the SAME frame as the
74// entrypoint invocation — the three lines are inlined at every site,
75// matching the sibling suites.
76
77// planAs publishes a plan (non-payable: envelope explicitly cleared).
78func planAs(cur realm, from address, title string, price, period int64) int64 {
79 testing.SetRealm(testing.NewUserRealm(from))
80 testing.SetOriginCaller(from)
81 testing.SetOriginSend(nil)
82 return CreatePlan(cross(cur), title, "d", price, period, MaxFeeBps)
83}
84
85// subscribeAs performs a chain-faithful subscribe: envelope staged AND landed.
86func subscribeAs(cur realm, from address, planID, pay int64) int64 {
87 testing.SetRealm(testing.NewUserRealm(from))
88 testing.SetOriginCaller(from)
89 testing.SetOriginSend(ugnot(pay))
90 testing.IssueCoins(Address(), ugnot(pay))
91 return Subscribe(cross(cur), planID)
92}
93
94// renewAs performs a chain-faithful renewal.
95func renewAs(cur realm, from address, subID, pay int64) {
96 testing.SetRealm(testing.NewUserRealm(from))
97 testing.SetOriginCaller(from)
98 testing.SetOriginSend(ugnot(pay))
99 testing.IssueCoins(Address(), ugnot(pay))
100 Renew(cross(cur), subID)
101}
102
103func TestInitialConfig(t *testing.T) {
104 if Admin() != testAdmin || FeeRecipient() != testAdmin {
105 t.Fatal("seeded roles mismatch")
106 }
107 var zero address
108 if PendingAdmin() != zero {
109 t.Fatal("pending admin not zero")
110 }
111 if FeeBps() != 0 || NumPlans() != 0 || NumSubs() != 0 {
112 t.Fatal("initial counters not zero")
113 }
114}
115
116func TestCreatePlanValidation(cur realm, t *testing.T) {
117 testing.SetRealm(testing.NewUserRealm(prov1))
118 testing.SetOriginCaller(prov1)
119 testing.SetOriginSend(ugnot(5))
120 uassert.AbortsWithMessage(t, cur, "this function does not accept coins", func() {
121 CreatePlan(cross(cur), "x", "d", 1, MinPeriodBlocks, MaxFeeBps)
122 })
123
124 testing.SetRealm(testing.NewUserRealm(prov1))
125 testing.SetOriginCaller(prov1)
126 testing.SetOriginSend(nil)
127 uassert.AbortsContains(t, cur, "title must be", func() {
128 CreatePlan(cross(cur), "", "d", 1, MinPeriodBlocks, MaxFeeBps)
129 })
130 uassert.AbortsContains(t, cur, "title must be", func() {
131 CreatePlan(cross(cur), strings.Repeat("t", MaxTitleLen+1), "d", 1, MinPeriodBlocks, MaxFeeBps)
132 })
133 uassert.AbortsContains(t, cur, "description too long", func() {
134 CreatePlan(cross(cur), "x", strings.Repeat("d", MaxDescLen+1), 1, MinPeriodBlocks, MaxFeeBps)
135 })
136 uassert.AbortsContains(t, cur, "price must be at least", func() {
137 CreatePlan(cross(cur), "x", "d", 0, MinPeriodBlocks, MaxFeeBps)
138 })
139 uassert.AbortsContains(t, cur, "periodBlocks must be in", func() {
140 CreatePlan(cross(cur), "x", "d", 1, MinPeriodBlocks-1, MaxFeeBps)
141 })
142 uassert.AbortsContains(t, cur, "periodBlocks must be in", func() {
143 CreatePlan(cross(cur), "x", "d", 1, MaxPeriodBlocks+1, MaxFeeBps)
144 })
145}
146
147func TestFeeConsentCeiling(cur realm, t *testing.T) {
148 testing.SetRealm(testing.NewUserRealm(testAdmin))
149 testing.SetOriginCaller(testAdmin)
150 testing.SetOriginSend(nil)
151 SetFeeBps(cross(cur), 250)
152
153 // A provider who signed for at most 100 bps is refused while the
154 // fee is 250.
155 testing.SetRealm(testing.NewUserRealm(prov1))
156 testing.SetOriginCaller(prov1)
157 testing.SetOriginSend(nil)
158 uassert.AbortsContains(t, cur, "exceeds the caller's maximum", func() {
159 CreatePlan(cross(cur), "capped", "d", 100, MinPeriodBlocks, 100)
160 })
161
162 // A consenting provider snapshots 250 into the plan; a later fee
163 // change does not touch it.
164 id := planAs(cur, prov1, "snap", 1000, MinPeriodBlocks)
165 testing.SetRealm(testing.NewUserRealm(testAdmin))
166 testing.SetOriginCaller(testAdmin)
167 testing.SetOriginSend(nil)
168 SetFeeBps(cross(cur), 0)
169 _, _, _, _, planFee, _, _ := PlanInfo(id)
170 if planFee != 250 {
171 t.Fatalf("plan feeBps = %d, want the 250 snapshot", planFee)
172 }
173
174 // The subscription charges the SNAPSHOT, not the current fee.
175 b := begin()
176 subscribeAs(cur, alice, id, 1000)
177 if got := FeesAccrued() - b.fees; got != 25 {
178 t.Fatalf("fee charged = %d, want 25 (250 bps of 1000)", got)
179 }
180 if got := BalanceOf(prov1); got == 0 {
181 t.Fatal("provider not credited")
182 }
183 b.conserved(t, 0)
184}
185
186func TestPlanQuota(cur realm, t *testing.T) {
187 for i := 0; i < MaxPlansPerProvider; i++ {
188 planAs(cur, prov2, "q", 1, MinPeriodBlocks)
189 }
190 testing.SetRealm(testing.NewUserRealm(prov2))
191 testing.SetOriginCaller(prov2)
192 testing.SetOriginSend(nil)
193 uassert.AbortsWithMessage(t, cur, "per-provider plan limit reached", func() {
194 CreatePlan(cross(cur), "q", "d", 1, MinPeriodBlocks, MaxFeeBps)
195 })
196 // Retiring one frees the slot.
197 RetirePlan(cross(cur), NumPlans()-1)
198 planAs(cur, prov2, "q2", 1, MinPeriodBlocks)
199}
200
201func TestRetirePlanAuthority(cur realm, t *testing.T) {
202 id := planAs(cur, prov1, "mine", 5, MinPeriodBlocks)
203 testing.SetRealm(testing.NewUserRealm(mallory))
204 testing.SetOriginCaller(mallory)
205 testing.SetOriginSend(nil)
206 uassert.AbortsWithMessage(t, cur, "only the provider may retire a plan", func() {
207 RetirePlan(cross(cur), id)
208 })
209 testing.SetRealm(testing.NewUserRealm(prov1))
210 testing.SetOriginCaller(prov1)
211 testing.SetOriginSend(nil)
212 RetirePlan(cross(cur), id)
213 uassert.AbortsWithMessage(t, cur, "plan is not active", func() {
214 RetirePlan(cross(cur), id)
215 })
216 // No new subscriptions on a retired plan.
217 testing.SetRealm(testing.NewUserRealm(alice))
218 testing.SetOriginCaller(alice)
219 testing.SetOriginSend(ugnot(5))
220 testing.IssueCoins(Address(), ugnot(5))
221 uassert.AbortsWithMessage(t, cur, "plan is not active", func() {
222 Subscribe(cross(cur), id)
223 })
224}
225
226func TestSubscribeLifecycle(cur realm, t *testing.T) {
227 id := planAs(cur, prov1, "basic", 100, 50)
228 b := begin()
229 h0 := runtime.ChainHeight()
230 subID := subscribeAs(cur, alice, id, 100)
231
232 planID, subscriber, provider, price, paidThrough, periods, status := SubInfo(subID)
233 if planID != id || subscriber != alice || provider != prov1 || price != 100 ||
234 periods != 1 || status != SubActive {
235 t.Fatal("subscription fields wrong")
236 }
237 if paidThrough != h0+50 {
238 t.Fatalf("paidThrough = %d, want %d", paidThrough, h0+50)
239 }
240 if !Entitled(subID) || !EntitledFor(id, alice) {
241 t.Fatal("fresh subscription not entitled")
242 }
243 if got, ok := ActiveSubID(id, alice); !ok || got != subID {
244 t.Fatal("active index wrong")
245 }
246 b.conserved(t, 0)
247
248 // Exact envelope: under- and overpayment refused.
249 for _, bad := range []int64{99, 101} {
250 testing.SetRealm(testing.NewUserRealm(bob))
251 testing.SetOriginCaller(bob)
252 testing.SetOriginSend(ugnot(bad))
253 testing.IssueCoins(Address(), ugnot(bad))
254 uassert.AbortsContains(t, cur, "send exactly the plan price", func() {
255 Subscribe(cross(cur), id)
256 })
257 }
258
259 // A second live subscription to the same plan is refused — the
260 // identity-level duplicate-payment guard.
261 testing.SetRealm(testing.NewUserRealm(alice))
262 testing.SetOriginCaller(alice)
263 testing.SetOriginSend(ugnot(100))
264 testing.IssueCoins(Address(), ugnot(100))
265 uassert.AbortsContains(t, cur, "renew it instead", func() {
266 Subscribe(cross(cur), id)
267 })
268}
269
270func TestRenewalWindow(cur realm, t *testing.T) {
271 id := planAs(cur, prov1, "window", 100, 50)
272 subID := subscribeAs(cur, bob, id, 100)
273 _, _, _, _, pt0, _, _ := SubInfo(subID)
274
275 from, until := RenewableFrom(subID)
276 if from != pt0-50 || until != pt0+49 {
277 t.Fatalf("window [%d,%d], want [%d,%d]", from, until, pt0-50, pt0+49)
278 }
279
280 // Straight after Subscribe, remaining entitlement equals exactly
281 // one period (the running one), so ONE prepay renewal is inside
282 // the early bound — and extension is FROM paidThrough.
283 b := begin()
284 renewAs(cur, bob, subID, 100)
285 _, _, _, _, pt1, periods, _ := SubInfo(subID)
286 if pt1 != pt0+50 || periods != 2 {
287 t.Fatalf("paidThrough = %d periods = %d, want %d and 2", pt1, periods, pt0+50)
288 }
289 b.conserved(t, 0)
290
291 // A SECOND renewal in the same block is the accidental duplicate,
292 // and the early bound refuses it: more than one unstarted period
293 // would be prepaid.
294 testing.SetRealm(testing.NewUserRealm(bob))
295 testing.SetOriginCaller(bob)
296 testing.SetOriginSend(ugnot(100))
297 testing.IssueCoins(Address(), ugnot(100))
298 uassert.AbortsContains(t, cur, "too early", func() {
299 Renew(cross(cur), subID)
300 })
301
302 // Wrong payer: a third party cannot extend someone else's
303 // subscription even inside the window.
304 testing.SkipHeights(50)
305 testing.SetRealm(testing.NewUserRealm(mallory))
306 testing.SetOriginCaller(mallory)
307 testing.SetOriginSend(ugnot(100))
308 testing.IssueCoins(Address(), ugnot(100))
309 uassert.AbortsWithMessage(t, cur, "only the subscriber may renew", func() {
310 Renew(cross(cur), subID)
311 })
312
313 // Wrong amount inside the window.
314 testing.SetRealm(testing.NewUserRealm(bob))
315 testing.SetOriginCaller(bob)
316 testing.SetOriginSend(ugnot(99))
317 testing.IssueCoins(Address(), ugnot(99))
318 uassert.AbortsContains(t, cur, "send exactly the subscription price", func() {
319 Renew(cross(cur), subID)
320 })
321}
322
323func TestGraceBoundary(cur realm, t *testing.T) {
324 id := planAs(cur, prov1, "grace", 100, 50)
325 subID := subscribeAs(cur, alice, id, 100)
326 _, _, _, _, pt, _, _ := SubInfo(subID)
327
328 // Move to the LAST renewable height: h == paidThrough +
329 // periodBlocks - 1 (the late bound is exclusive — audit Y2).
330 testing.SkipHeights(pt + 49 - runtime.ChainHeight())
331 if Entitled(subID) {
332 t.Fatal("entitlement must have lapsed past paidThrough")
333 }
334 // Renewal at the boundary is accepted, extends FROM paidThrough —
335 // and buys at least one block: the Y2 regression.
336 renewAs(cur, alice, subID, 100)
337 _, _, _, _, pt1, _, _ := SubInfo(subID)
338 if pt1 != pt+50 {
339 t.Fatalf("paidThrough = %d, want %d (extension from paidThrough)", pt1, pt+50)
340 }
341 if !Entitled(subID) {
342 t.Fatal("a boundary renewal must buy at least one block of entitlement")
343 }
344
345 // At the grace end itself renewal is refused, Expire opens: the
346 // two sets partition exactly.
347 testing.SkipHeights(pt1 + 50 - runtime.ChainHeight())
348 testing.SetRealm(testing.NewUserRealm(alice))
349 testing.SetOriginCaller(alice)
350 testing.SetOriginSend(ugnot(100))
351 testing.IssueCoins(Address(), ugnot(100))
352 uassert.AbortsContains(t, cur, "grace window over", func() {
353 Renew(cross(cur), subID)
354 })
355
356 // Expire is permissionless: mallory may.
357 testing.SetRealm(testing.NewUserRealm(mallory))
358 testing.SetOriginCaller(mallory)
359 testing.SetOriginSend(nil)
360 Expire(cross(cur), subID)
361 _, _, _, _, _, _, status := SubInfo(subID)
362 if status != SubExpired {
363 t.Fatal("not expired")
364 }
365 if EntitledFor(id, alice) {
366 t.Fatal("expired subscription still indexed")
367 }
368 // Terminal: renewal refused by status.
369 testing.SetRealm(testing.NewUserRealm(alice))
370 testing.SetOriginCaller(alice)
371 testing.SetOriginSend(ugnot(100))
372 testing.IssueCoins(Address(), ugnot(100))
373 uassert.AbortsContains(t, cur, "subscription is expired", func() {
374 Renew(cross(cur), subID)
375 })
376 // The slot is free: a fresh Subscribe works.
377 subscribeAs(cur, alice, id, 100)
378}
379
380func TestExpireGuards(cur realm, t *testing.T) {
381 id := planAs(cur, prov1, "expguard", 100, 50)
382 subID := subscribeAs(cur, bob, id, 100)
383 testing.SetRealm(testing.NewUserRealm(mallory))
384 testing.SetOriginCaller(mallory)
385 testing.SetOriginSend(nil)
386 uassert.AbortsContains(t, cur, "not expirable", func() {
387 Expire(cross(cur), subID)
388 })
389 // One block before the grace end it is still not expirable...
390 _, _, _, _, pt, _, _ := SubInfo(subID)
391 testing.SkipHeights(pt + 49 - runtime.ChainHeight())
392 testing.SetRealm(testing.NewUserRealm(mallory))
393 testing.SetOriginCaller(mallory)
394 testing.SetOriginSend(nil)
395 uassert.AbortsContains(t, cur, "not expirable", func() {
396 Expire(cross(cur), subID)
397 })
398 // ...and AT the grace end it is: the sets partition exactly.
399 testing.SkipHeights(1)
400 testing.SetRealm(testing.NewUserRealm(mallory))
401 testing.SetOriginCaller(mallory)
402 testing.SetOriginSend(nil)
403 Expire(cross(cur), subID)
404 testing.SetRealm(testing.NewUserRealm(mallory))
405 testing.SetOriginCaller(mallory)
406 testing.SetOriginSend(nil)
407 uassert.AbortsContains(t, cur, "subscription is expired", func() {
408 Expire(cross(cur), subID)
409 })
410}
411
412func TestSubscribeCollapsesExpiredIncumbent(cur realm, t *testing.T) {
413 id := planAs(cur, prov1, "collapse", 100, 50)
414 oldID := subscribeAs(cur, alice, id, 100)
415 _, _, _, _, pt, _, _ := SubInfo(oldID)
416 testing.SkipHeights(pt + 50 - runtime.ChainHeight())
417
418 // No Expire call happened; Subscribe collapses the incumbent
419 // itself, at the first expirable height.
420 newID := subscribeAs(cur, alice, id, 100)
421 if newID == oldID {
422 t.Fatal("expected a fresh subscription id")
423 }
424 _, _, _, _, _, _, oldStatus := SubInfo(oldID)
425 if oldStatus != SubExpired {
426 t.Fatalf("incumbent status = %q, want expired", oldStatus)
427 }
428 if got, ok := ActiveSubID(id, alice); !ok || got != newID {
429 t.Fatal("index does not point at the fresh subscription")
430 }
431}
432
433func TestCancel(cur realm, t *testing.T) {
434 id := planAs(cur, prov1, "cancel", 100, 50)
435 subID := subscribeAs(cur, bob, id, 100)
436
437 testing.SetRealm(testing.NewUserRealm(mallory))
438 testing.SetOriginCaller(mallory)
439 testing.SetOriginSend(nil)
440 uassert.AbortsWithMessage(t, cur, "only the subscriber may cancel", func() {
441 Cancel(cross(cur), subID)
442 })
443
444 testing.SetRealm(testing.NewUserRealm(bob))
445 testing.SetOriginCaller(bob)
446 testing.SetOriginSend(nil)
447 Cancel(cross(cur), subID)
448 _, _, _, _, _, _, status := SubInfo(subID)
449 if status != SubCancelled {
450 t.Fatal("not cancelled")
451 }
452 // Paid entitlement survives cancellation until paidThrough — on
453 // both surfaces (audit Y1)...
454 if !Entitled(subID) || !EntitledFor(id, bob) {
455 t.Fatal("cancelled subscription lost its paid entitlement")
456 }
457 // ...but the ACTIVE slot is gone and renewal is refused forever.
458 if _, ok := ActiveSubID(id, bob); ok {
459 t.Fatal("cancelled subscription still holds the active slot")
460 }
461 testing.SetRealm(testing.NewUserRealm(bob))
462 testing.SetOriginCaller(bob)
463 testing.SetOriginSend(ugnot(100))
464 testing.IssueCoins(Address(), ugnot(100))
465 uassert.AbortsContains(t, cur, "subscription is cancelled", func() {
466 Renew(cross(cur), subID)
467 })
468 testing.SetRealm(testing.NewUserRealm(bob))
469 testing.SetOriginCaller(bob)
470 testing.SetOriginSend(nil)
471 uassert.AbortsContains(t, cur, "subscription is cancelled", func() {
472 Cancel(cross(cur), subID)
473 })
474 // The slot freed: bob may start a fresh subscription at once.
475 subscribeAs(cur, bob, id, 100)
476}
477
478func TestRenewRefusedOnRetiredPlan(cur realm, t *testing.T) {
479 id := planAs(cur, prov1, "retire-mid", 100, 50)
480 subID := subscribeAs(cur, alice, id, 100)
481 testing.SetRealm(testing.NewUserRealm(prov1))
482 testing.SetOriginCaller(prov1)
483 testing.SetOriginSend(nil)
484 RetirePlan(cross(cur), id)
485 // Entitlement continues...
486 if !Entitled(subID) {
487 t.Fatal("entitlement must survive plan retirement")
488 }
489 // ...but renewal is refused even inside the window.
490 _, _, _, _, pt, _, _ := SubInfo(subID)
491 testing.SkipHeights(pt - runtime.ChainHeight())
492 testing.SetRealm(testing.NewUserRealm(alice))
493 testing.SetOriginCaller(alice)
494 testing.SetOriginSend(ugnot(100))
495 testing.IssueCoins(Address(), ugnot(100))
496 uassert.AbortsContains(t, cur, "plan is retired", func() {
497 Renew(cross(cur), subID)
498 })
499}
500
501func TestSubscriberQuota(cur realm, t *testing.T) {
502 // Fill carol's quota with one-plan-each subscriptions, then refuse.
503 // A dedicated provider: prov2's plan quota is already saturated by
504 // TestPlanQuota, and realm globals persist across tests.
505 carol := testutils.TestAddress("subcarol")
506 provQ := testutils.TestAddress("subprovq")
507 var lastPlan int64
508 for i := 0; i < MaxSubsPerSubscriber; i++ {
509 lastPlan = planAs(cur, provQ, "quota", 1, MinPeriodBlocks)
510 subscribeAs(cur, carol, lastPlan, 1)
511 // Free the provider quota slot for the next plan.
512 testing.SetRealm(testing.NewUserRealm(provQ))
513 testing.SetOriginCaller(provQ)
514 testing.SetOriginSend(nil)
515 RetirePlan(cross(cur), lastPlan)
516 }
517 extra := planAs(cur, provQ, "quota-x", 1, MinPeriodBlocks)
518 testing.SetRealm(testing.NewUserRealm(carol))
519 testing.SetOriginCaller(carol)
520 testing.SetOriginSend(ugnot(1))
521 testing.IssueCoins(Address(), ugnot(1))
522 uassert.AbortsWithMessage(t, cur, "per-subscriber subscription limit reached", func() {
523 Subscribe(cross(cur), extra)
524 })
525 // Cancelling one frees a slot.
526 sid, ok := ActiveSubID(lastPlan, carol)
527 if !ok {
528 t.Fatal("expected an active sub to free")
529 }
530 testing.SetRealm(testing.NewUserRealm(carol))
531 testing.SetOriginCaller(carol)
532 testing.SetOriginSend(nil)
533 Cancel(cross(cur), sid)
534 subscribeAs(cur, carol, extra, 1)
535 testing.SetRealm(testing.NewUserRealm(provQ))
536 testing.SetOriginCaller(provQ)
537 testing.SetOriginSend(nil)
538 RetirePlan(cross(cur), extra)
539}
540
541func TestClaimsAndFees(cur realm, t *testing.T) {
542 testing.SetRealm(testing.NewUserRealm(testAdmin))
543 testing.SetOriginCaller(testAdmin)
544 testing.SetOriginSend(nil)
545 SetFeeBps(cross(cur), 500) // 5% into the next plan
546 id := planAs(cur, prov1, "money", 1000, 50)
547 testing.SetRealm(testing.NewUserRealm(testAdmin))
548 testing.SetOriginCaller(testAdmin)
549 testing.SetOriginSend(nil)
550 SetFeeBps(cross(cur), 0)
551
552 b := begin()
553 subscribeAs(cur, alice, id, 1000)
554 if FeesAccrued()-b.fees != 50 {
555 t.Fatalf("fee = %d, want 50", FeesAccrued()-b.fees)
556 }
557 credited := BalanceOf(prov1)
558
559 // Mallory has no balance: claims fail.
560 testing.SetRealm(testing.NewUserRealm(mallory))
561 testing.SetOriginCaller(mallory)
562 testing.SetOriginSend(nil)
563 uassert.AbortsContains(t, cur, "insufficient balance", func() { Claim(cross(cur), 1) })
564 testing.SetRealm(testing.NewUserRealm(mallory))
565 testing.SetOriginCaller(mallory)
566 testing.SetOriginSend(nil)
567 uassert.AbortsWithMessage(t, cur, "nothing to claim", func() { ClaimAll(cross(cur)) })
568
569 // Provider claims all; coins actually move.
570 before := coinsOf(prov1)
571 testing.SetRealm(testing.NewUserRealm(prov1))
572 testing.SetOriginCaller(prov1)
573 testing.SetOriginSend(nil)
574 ClaimAll(cross(cur))
575 if coinsOf(prov1)-before != credited {
576 t.Fatalf("provider received %d, want %d", coinsOf(prov1)-before, credited)
577 }
578 if BalanceOf(prov1) != 0 {
579 t.Fatal("balance not drained")
580 }
581
582 // Fees: only the recipient, and only the pot.
583 testing.SetRealm(testing.NewUserRealm(mallory))
584 testing.SetOriginCaller(mallory)
585 testing.SetOriginSend(nil)
586 uassert.AbortsWithMessage(t, cur, "fee recipient only", func() { WithdrawFees(cross(cur)) })
587 potBefore := coinsOf(testAdmin)
588 testing.SetRealm(testing.NewUserRealm(testAdmin))
589 testing.SetOriginCaller(testAdmin)
590 testing.SetOriginSend(nil)
591 WithdrawFees(cross(cur))
592 if coinsOf(testAdmin)-potBefore == 0 {
593 t.Fatal("fee pot did not move")
594 }
595 testing.SetRealm(testing.NewUserRealm(testAdmin))
596 testing.SetOriginCaller(testAdmin)
597 testing.SetOriginSend(nil)
598 uassert.AbortsWithMessage(t, cur, "no fees accrued", func() { WithdrawFees(cross(cur)) })
599 b.conserved(t, 0)
600}
601
602func TestSweepReserve(cur realm, t *testing.T) {
603 id := planAs(cur, prov1, "sweep", 500, 50)
604 begin()
605 subscribeAs(cur, bob, id, 500)
606
607 // Nothing above the reserve: sweep refuses.
608 testing.SetRealm(testing.NewUserRealm(testAdmin))
609 testing.SetOriginCaller(testAdmin)
610 testing.SetOriginSend(nil)
611 uassert.AbortsContains(t, cur, "no surplus to sweep", func() {
612 SweepDenom(cross(cur), Denom)
613 })
614 // Out-of-band surplus lands; only the surplus is sweepable.
615 testing.IssueCoins(Address(), ugnot(77))
616 liabBefore := Liabilities()
617 got := coinsOf(testAdmin)
618 testing.SetRealm(testing.NewUserRealm(testAdmin))
619 testing.SetOriginCaller(testAdmin)
620 testing.SetOriginSend(nil)
621 SweepDenom(cross(cur), Denom)
622 if coinsOf(testAdmin)-got != 77 {
623 t.Fatalf("swept %d, want 77", coinsOf(testAdmin)-got)
624 }
625 if Liabilities() != liabBefore {
626 t.Fatal("sweep touched the reserve")
627 }
628 testing.SetRealm(testing.NewUserRealm(mallory))
629 testing.SetOriginCaller(mallory)
630 testing.SetOriginSend(nil)
631 uassert.AbortsWithMessage(t, cur, "fee recipient only", func() {
632 SweepDenom(cross(cur), Denom)
633 })
634}
635
636func TestAdminHandover(cur realm, t *testing.T) {
637 testing.SetRealm(testing.NewUserRealm(mallory))
638 testing.SetOriginCaller(mallory)
639 testing.SetOriginSend(nil)
640 uassert.AbortsWithMessage(t, cur, "admin only", func() {
641 TransferAdmin(cross(cur), mallory)
642 })
643 testing.SetRealm(testing.NewUserRealm(testAdmin))
644 testing.SetOriginCaller(testAdmin)
645 testing.SetOriginSend(nil)
646 TransferAdmin(cross(cur), prov2)
647 // Wrong acceptor refused; authority has not moved yet.
648 testing.SetRealm(testing.NewUserRealm(mallory))
649 testing.SetOriginCaller(mallory)
650 testing.SetOriginSend(nil)
651 uassert.AbortsWithMessage(t, cur, "only the staged successor may accept", func() {
652 AcceptAdmin(cross(cur))
653 })
654 if Admin() != testAdmin {
655 t.Fatal("authority moved before acceptance")
656 }
657 testing.SetRealm(testing.NewUserRealm(prov2))
658 testing.SetOriginCaller(prov2)
659 testing.SetOriginSend(nil)
660 AcceptAdmin(cross(cur))
661 if Admin() != prov2 {
662 t.Fatal("authority did not move")
663 }
664 // The former admin is locked out.
665 testing.SetRealm(testing.NewUserRealm(testAdmin))
666 testing.SetOriginCaller(testAdmin)
667 testing.SetOriginSend(nil)
668 uassert.AbortsWithMessage(t, cur, "admin only", func() {
669 SetFeeBps(cross(cur), 1)
670 })
671 // Hand it back for the remaining tests.
672 testing.SetRealm(testing.NewUserRealm(prov2))
673 testing.SetOriginCaller(prov2)
674 testing.SetOriginSend(nil)
675 TransferAdmin(cross(cur), testAdmin)
676 testing.SetRealm(testing.NewUserRealm(testAdmin))
677 testing.SetOriginCaller(testAdmin)
678 testing.SetOriginSend(nil)
679 AcceptAdmin(cross(cur))
680}
681
682func TestFeeBounds(cur realm, t *testing.T) {
683 testing.SetRealm(testing.NewUserRealm(testAdmin))
684 testing.SetOriginCaller(testAdmin)
685 testing.SetOriginSend(nil)
686 uassert.AbortsContains(t, cur, "fee must be in", func() {
687 SetFeeBps(cross(cur), MaxFeeBps+1)
688 })
689 testing.SetRealm(testing.NewUserRealm(testAdmin))
690 testing.SetOriginCaller(testAdmin)
691 testing.SetOriginSend(nil)
692 uassert.AbortsContains(t, cur, "fee must be in", func() {
693 SetFeeBps(cross(cur), -1)
694 })
695 var zero address
696 testing.SetRealm(testing.NewUserRealm(testAdmin))
697 testing.SetOriginCaller(testAdmin)
698 testing.SetOriginSend(nil)
699 uassert.AbortsWithMessage(t, cur, "fee recipient must not be the zero address", func() {
700 SetFeeRecipient(cross(cur), zero)
701 })
702 testing.SetRealm(testing.NewUserRealm(testAdmin))
703 testing.SetOriginCaller(testAdmin)
704 testing.SetOriginSend(nil)
705 uassert.AbortsWithMessage(t, cur, "successor must not be the zero address", func() {
706 TransferAdmin(cross(cur), zero)
707 })
708}
709
710func TestStraySendRejected(cur realm, t *testing.T) {
711 id := planAs(cur, prov1, "stray", 100, 50)
712 subID := subscribeAs(cur, alice, id, 100)
713 arm := func(from address) {
714 testing.SetRealm(testing.NewUserRealm(from))
715 testing.SetOriginCaller(from)
716 testing.SetOriginSend(ugnot(3))
717 }
718 arm(prov1)
719 uassert.AbortsWithMessage(t, cur, "this function does not accept coins", func() {
720 RetirePlan(cross(cur), id)
721 })
722 arm(alice)
723 uassert.AbortsWithMessage(t, cur, "this function does not accept coins", func() {
724 Cancel(cross(cur), subID)
725 })
726 arm(mallory)
727 uassert.AbortsWithMessage(t, cur, "this function does not accept coins", func() {
728 Expire(cross(cur), subID)
729 })
730 arm(prov1)
731 uassert.AbortsWithMessage(t, cur, "this function does not accept coins", func() {
732 ClaimAll(cross(cur))
733 })
734 arm(testAdmin)
735 uassert.AbortsWithMessage(t, cur, "this function does not accept coins", func() {
736 WithdrawFees(cross(cur))
737 })
738 arm(testAdmin)
739 uassert.AbortsWithMessage(t, cur, "this function does not accept coins", func() {
740 SetFeeBps(cross(cur), 0)
741 })
742}
743
744func TestRenderSanitizes(cur realm, t *testing.T) {
745 planAs(cur, prov1, "[evil](https://x) <script>alert(1)</script>", 1, MinPeriodBlocks)
746 out := Render("")
747 if strings.Contains(out, "<script>") {
748 t.Fatal("unsanitized title reached Render")
749 }
750 if !strings.Contains(out, "plans:") {
751 t.Fatal("render missing counters")
752 }
753 if Render("nope") == renderHome() {
754 t.Fatal("unknown path fell through to home")
755 }
756}
757
758func TestUnknownIDs(t *testing.T) {
759 defer func() {
760 if recover() == nil {
761 t.Fatal("expected panic")
762 }
763 }()
764 PlanInfo(99999)
765}
766
767// Y1 regression: EntitledFor follows the most recent subscription and
768// honors paid entitlement across cancellation.
769func TestEntitledForSurvivesCancel(cur realm, t *testing.T) {
770 id := planAs(cur, prov1, "y1", 100, 50)
771 subID := subscribeAs(cur, alice, id, 100)
772 testing.SetRealm(testing.NewUserRealm(alice))
773 testing.SetOriginCaller(alice)
774 testing.SetOriginSend(nil)
775 Cancel(cross(cur), subID)
776 if !EntitledFor(id, alice) {
777 t.Fatal("cancelled-but-paid subscriber lost EntitledFor")
778 }
779 // A fresh Subscribe repoints the surface at the new subscription.
780 // Skip a few blocks first so ptNew > ptOld: at a height in
781 // [ptOld, ptNew) a STALE pointer would answer false while the
782 // repointed one answers true — the distinguishing assertion.
783 _, _, _, _, ptOld, _, _ := SubInfo(subID)
784 testing.SkipHeights(5)
785 newID := subscribeAs(cur, alice, id, 100)
786 _, _, _, _, ptNew, _, _ := SubInfo(newID)
787 if ptNew <= ptOld {
788 t.Fatal("fixture broken: ptNew must exceed ptOld")
789 }
790 if !EntitledFor(id, alice) || !Entitled(newID) || !Entitled(subID) {
791 t.Fatal("both paid entitlements should be live right after re-subscribe")
792 }
793 testing.SkipHeights(ptOld - runtime.ChainHeight())
794 if Entitled(subID) {
795 t.Fatal("old span should have run out")
796 }
797 if !EntitledFor(id, alice) {
798 t.Fatal("EntitledFor answered the stale id, not the repointed one")
799 }
800 // After the new paid span runs out too, EntitledFor goes false.
801 testing.SkipHeights(ptNew - runtime.ChainHeight())
802 if EntitledFor(id, alice) {
803 t.Fatal("EntitledFor true past paidThrough")
804 }
805}
806
807// Y2 companion: a lapsed-in-grace incumbent blocks Subscribe with a
808// message that states both options.
809func TestSubscribeMessageInGrace(cur realm, t *testing.T) {
810 id := planAs(cur, prov1, "y2msg", 100, 50)
811 subID := subscribeAs(cur, bob, id, 100)
812 _, _, _, _, pt, _, _ := SubInfo(subID)
813 testing.SkipHeights(pt + 10 - runtime.ChainHeight())
814 testing.SetRealm(testing.NewUserRealm(bob))
815 testing.SetOriginCaller(bob)
816 testing.SetOriginSend(ugnot(100))
817 testing.IssueCoins(Address(), ugnot(100))
818 uassert.AbortsContains(t, cur, "lapsed but renewable", func() {
819 Subscribe(cross(cur), id)
820 })
821 // Cancel + Subscribe is the documented fresh-start path.
822 testing.SetRealm(testing.NewUserRealm(bob))
823 testing.SetOriginCaller(bob)
824 testing.SetOriginSend(nil)
825 Cancel(cross(cur), subID)
826 subscribeAs(cur, bob, id, 100)
827}
