timelock_guardian_test.gno

  1package timelock_guardian
  2
  3import (
  4	"chain"
  5	"strings"
  6	"testing"
  7
  8	"gno.land/p/nt/testutils/v0"
  9	"gno.land/p/nt/uassert/v0"
 10)
 11
 12var (
 13	owner    = testutils.TestAddress("owner")
 14	guardian = testutils.TestAddress("guardian")
 15	attacker = testutils.TestAddress("attacker")
 16	newOwner = testutils.TestAddress("newowner")
 17)
 18
 19// resetState resets all package-level state between tests.
 20func resetState() {
 21	targets = make(map[string]*TargetConfig)
 22	targetNames = []string{}
 23	ownerTargets = make(map[address]int)
 24	actions = make(map[string]*Action)
 25	actionIDs = []string{}
 26	pending = make(map[string][]string)
 27	pendingTargets = []string{}
 28	ptIndex = make(map[string]int)
 29	nextID = 1
 30}
 31
 32// heights advancing time: SkipHeights moves the clock 5s per height.
 33func skipSeconds(sec int64) {
 34	testing.SkipHeights((sec + 4) / 5)
 35}
 36
 37func registerUpgrades(cur realm) string {
 38	testing.SetRealm(testing.NewUserRealm(owner))
 39	RegisterTarget(cross(cur), "upgrades", MinDelayFloor, guardian)
 40	return "upgrades"
 41}
 42
 43// ---------- RegisterTarget ----------
 44
 45func TestRegisterTarget_Basic(cur realm, t *testing.T) {
 46	resetState()
 47	testing.SetRealm(testing.NewUserRealm(owner))
 48
 49	RegisterTarget(cross(cur), "upgrades", 120, guardian)
 50
 51	tc := targets["upgrades"]
 52	uassert.Equal(t, string(owner), string(tc.Owner))
 53	uassert.Equal(t, string(guardian), string(tc.Guardian))
 54	uassert.Equal(t, int64(120), tc.MinDelay)
 55}
 56
 57func TestRegisterTarget_NoGuardianAllowed(cur realm, t *testing.T) {
 58	resetState()
 59	testing.SetRealm(testing.NewUserRealm(owner))
 60
 61	RegisterTarget(cross(cur), "plain", MinDelayFloor, "")
 62	uassert.Equal(t, "", string(targets["plain"].Guardian))
 63}
 64
 65func TestRegisterTarget_DuplicateRejected(cur realm, t *testing.T) {
 66	resetState()
 67	testing.SetRealm(testing.NewUserRealm(owner))
 68	registerUpgrades(cur)
 69
 70	uassert.AbortsWithMessage(t, cur,
 71		"target already registered: upgrades",
 72		func() { RegisterTarget(cross(cur), "upgrades", MinDelayFloor, "") },
 73	)
 74}
 75
 76func TestRegisterTarget_InvalidNameRejected(cur realm, t *testing.T) {
 77	resetState()
 78	testing.SetRealm(testing.NewUserRealm(owner))
 79
 80	for _, bad := range []string{"", "Upgrades", "has space", strings.Repeat("a", MaxTargetNameLen+1)} {
 81		uassert.AbortsContains(t, cur,
 82			"target name must be",
 83			func() { RegisterTarget(cross(cur), bad, MinDelayFloor, "") },
 84		)
 85	}
 86}
 87
 88func TestRegisterTarget_DelayBoundsEnforced(cur realm, t *testing.T) {
 89	resetState()
 90	testing.SetRealm(testing.NewUserRealm(owner))
 91
 92	uassert.AbortsContains(t, cur,
 93		"minimum delay must be at least",
 94		func() { RegisterTarget(cross(cur), "too_fast", MinDelayFloor-1, "") },
 95	)
 96	uassert.AbortsContains(t, cur,
 97		"minimum delay exceeds the maximum",
 98		func() { RegisterTarget(cross(cur), "too_slow", MaxDelay+1, "") },
 99	)
100}
101
102func TestRegisterTarget_InvalidGuardianRejected(cur realm, t *testing.T) {
103	resetState()
104	testing.SetRealm(testing.NewUserRealm(owner))
105
106	uassert.AbortsWithMessage(t, cur,
107		"invalid guardian address: junk",
108		func() { RegisterTarget(cross(cur), "upgrades", MinDelayFloor, address("junk")) },
109	)
110}
111
112// ---------- SetGuardian / two-step TransferTargetOwnership ----------
113
114func TestSetGuardian_OwnerOnly(cur realm, t *testing.T) {
115	resetState()
116	testing.SetRealm(testing.NewUserRealm(owner))
117	registerUpgrades(cur)
118
119	testing.SetRealm(testing.NewUserRealm(attacker))
120	uassert.AbortsWithMessage(t, cur,
121		"only the target owner can set the guardian",
122		func() { SetGuardian(cross(cur), "upgrades", attacker) },
123	)
124
125	testing.SetRealm(testing.NewUserRealm(owner))
126	SetGuardian(cross(cur), "upgrades", "")
127	uassert.Equal(t, "", string(targets["upgrades"].Guardian))
128}
129
130func TestTransferTargetOwnership_TwoStep(cur realm, t *testing.T) {
131	resetState()
132	testing.SetRealm(testing.NewUserRealm(owner))
133	registerUpgrades(cur)
134
135	testing.SetRealm(testing.NewUserRealm(attacker))
136	uassert.AbortsWithMessage(t, cur,
137		"only the target owner can transfer ownership",
138		func() { TransferTargetOwnership(cross(cur), "upgrades", attacker) },
139	)
140
141	testing.SetRealm(testing.NewUserRealm(owner))
142	uassert.AbortsWithMessage(t, cur,
143		"invalid new owner address: junk",
144		func() { TransferTargetOwnership(cross(cur), "upgrades", address("junk")) },
145	)
146
147	uassert.AbortsWithMessage(t, cur,
148		"new owner is already the owner",
149		func() { TransferTargetOwnership(cross(cur), "upgrades", owner) },
150	)
151
152	// the offer alone changes nothing
153	TransferTargetOwnership(cross(cur), "upgrades", newOwner)
154	uassert.Equal(t, string(owner), string(targets["upgrades"].Owner))
155	uassert.Equal(t, string(newOwner), string(targets["upgrades"].PendingOwner))
156	uassert.Equal(t, 1, ownerTargets[owner])
157	uassert.Equal(t, 0, ownerTargets[newOwner])
158
159	// only the nominee can accept
160	testing.SetRealm(testing.NewUserRealm(attacker))
161	uassert.AbortsWithMessage(t, cur,
162		"caller is not the pending owner",
163		func() { AcceptTargetOwnership(cross(cur), "upgrades") },
164	)
165
166	testing.SetRealm(testing.NewUserRealm(newOwner))
167	AcceptTargetOwnership(cross(cur), "upgrades")
168	uassert.Equal(t, string(newOwner), string(targets["upgrades"].Owner))
169	uassert.Equal(t, "", string(targets["upgrades"].PendingOwner))
170	uassert.Equal(t, 0, ownerTargets[owner])
171	uassert.Equal(t, 1, ownerTargets[newOwner])
172}
173
174func TestTransferTargetOwnership_ClearOffer(cur realm, t *testing.T) {
175	resetState()
176	testing.SetRealm(testing.NewUserRealm(owner))
177	registerUpgrades(cur)
178
179	TransferTargetOwnership(cross(cur), "upgrades", newOwner)
180	TransferTargetOwnership(cross(cur), "upgrades", "") // clear
181
182	testing.SetRealm(testing.NewUserRealm(newOwner))
183	uassert.AbortsWithMessage(t, cur,
184		"caller is not the pending owner",
185		func() { AcceptTargetOwnership(cross(cur), "upgrades") },
186	)
187}
188
189func TestTransferTargetOwnership_QuotaCheckedAtAccept(cur realm, t *testing.T) {
190	resetState()
191	testing.SetRealm(testing.NewUserRealm(newOwner))
192	for i := 0; i < MaxTargetsPerOwner; i++ {
193		RegisterTarget(cross(cur), "t_"+strings.Repeat("x", i+1), MinDelayFloor, "")
194	}
195
196	testing.SetRealm(testing.NewUserRealm(owner))
197	registerUpgrades(cur)
198	TransferTargetOwnership(cross(cur), "upgrades", newOwner) // offer succeeds
199
200	// ...but accepting past the quota is refused, and ownership is unchanged
201	testing.SetRealm(testing.NewUserRealm(newOwner))
202	uassert.AbortsWithMessage(t, cur,
203		"accepting would exceed the per-owner target limit",
204		func() { AcceptTargetOwnership(cross(cur), "upgrades") },
205	)
206	uassert.Equal(t, string(owner), string(targets["upgrades"].Owner))
207}
208
209func TestUnsolicitedOfferConsumesNothing(cur realm, t *testing.T) {
210	resetState()
211	victim := testutils.TestAddress("victim")
212
213	// fix Y5 regression: an attacker offering targets to a victim must
214	// not consume the victim's quota or change any of their state
215	testing.SetRealm(testing.NewUserRealm(attacker))
216	for i := 0; i < MaxTargetsPerOwner; i++ {
217		name := "junk_" + strings.Repeat("x", i+1)
218		RegisterTarget(cross(cur), name, MinDelayFloor, "")
219		TransferTargetOwnership(cross(cur), name, victim)
220	}
221	uassert.Equal(t, 0, ownerTargets[victim])
222
223	// the victim can still register a full quota of their own targets
224	testing.SetRealm(testing.NewUserRealm(victim))
225	for i := 0; i < MaxTargetsPerOwner; i++ {
226		RegisterTarget(cross(cur), "mine_"+strings.Repeat("y", i+1), MinDelayFloor, "")
227	}
228}
229
230// ---------- Schedule ----------
231
232func TestSchedule_OwnerOnly(cur realm, t *testing.T) {
233	resetState()
234	testing.SetRealm(testing.NewUserRealm(owner))
235	registerUpgrades(cur)
236
237	// an attacker cannot schedule an action against someone else's
238	// target — the core binding the audit found missing
239	testing.SetRealm(testing.NewUserRealm(attacker))
240	uassert.AbortsWithMessage(t, cur,
241		"only the target owner can schedule actions for upgrades",
242		func() { Schedule(cross(cur), "upgrades", "malicious upgrade", MinDelayFloor) },
243	)
244}
245
246func TestSchedule_UnregisteredTargetRejected(cur realm, t *testing.T) {
247	resetState()
248	testing.SetRealm(testing.NewUserRealm(owner))
249
250	uassert.AbortsWithMessage(t, cur,
251		"target not found: ghost",
252		func() { Schedule(cross(cur), "ghost", "data", MinDelayFloor) },
253	)
254}
255
256func TestSchedule_MinDelayEnforced(cur realm, t *testing.T) {
257	resetState()
258	testing.SetRealm(testing.NewUserRealm(owner))
259	RegisterTarget(cross(cur), "upgrades", 3600, "")
260
261	// a delay below the target's registered minimum is rejected — no
262	// more 1-second "timelocks"
263	uassert.AbortsWithMessage(t, cur,
264		"delay below the target's minimum of 3600 seconds",
265		func() { Schedule(cross(cur), "upgrades", "data", 60) },
266	)
267}
268
269func TestSchedule_MaxDelayEnforced(cur realm, t *testing.T) {
270	resetState()
271	testing.SetRealm(testing.NewUserRealm(owner))
272	registerUpgrades(cur)
273
274	// overflow regression: a delay past MaxDelay must abort, never wrap
275	// ExecuteAfter into the past
276	uassert.AbortsContains(t, cur,
277		"delay exceeds the maximum",
278		func() { Schedule(cross(cur), "upgrades", "data", MaxDelay+1) },
279	)
280}
281
282func TestSchedule_DataValidation(cur realm, t *testing.T) {
283	resetState()
284	testing.SetRealm(testing.NewUserRealm(owner))
285	registerUpgrades(cur)
286
287	uassert.AbortsWithMessage(t, cur,
288		"data must not be empty",
289		func() { Schedule(cross(cur), "upgrades", "", MinDelayFloor) },
290	)
291	uassert.AbortsContains(t, cur,
292		"data exceeds",
293		func() { Schedule(cross(cur), "upgrades", strings.Repeat("x", MaxDataLen+1), MinDelayFloor) },
294	)
295}
296
297func TestSchedule_PendingCap(cur realm, t *testing.T) {
298	resetState()
299	testing.SetRealm(testing.NewUserRealm(owner))
300	registerUpgrades(cur)
301
302	for i := 0; i < MaxPendingPerTarget; i++ {
303		Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
304	}
305	uassert.AbortsWithMessage(t, cur,
306		"too many pending actions for target upgrades",
307		func() { Schedule(cross(cur), "upgrades", "op", MinDelayFloor) },
308	)
309}
310
311func TestSchedule_SetsWindows(cur realm, t *testing.T) {
312	resetState()
313	testing.SetRealm(testing.NewUserRealm(owner))
314	registerUpgrades(cur)
315
316	id := Schedule(cross(cur), "upgrades", "rotate keys", 120)
317	a := actions[id]
318	uassert.Equal(t, int64(120), int64(a.ExecuteAfter.Sub(a.ScheduledAt).Seconds()))
319	uassert.Equal(t, GracePeriod, int64(a.ExpiresAt.Sub(a.ExecuteAfter).Seconds()))
320}
321
322// ---------- Execute ----------
323
324func TestExecute_TooEarlyBlocked(cur realm, t *testing.T) {
325	resetState()
326	testing.SetRealm(testing.NewUserRealm(owner))
327	registerUpgrades(cur)
328	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
329
330	uassert.AbortsContains(t, cur, "too early", func() { Execute(cross(cur), id) })
331	uassert.False(t, IsReady(id), "must not be ready before the delay")
332}
333
334func TestExecute_ReadyAfterDelay_AnyoneCanExecute(cur realm, t *testing.T) {
335	resetState()
336	testing.SetRealm(testing.NewUserRealm(owner))
337	registerUpgrades(cur)
338	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
339
340	skipSeconds(MinDelayFloor)
341	uassert.True(t, IsReady(id), "must be ready after the delay")
342
343	// executor identity is deliberately unrestricted
344	testing.SetRealm(testing.NewUserRealm(attacker))
345	uassert.Equal(t, "executed: "+id, Execute(cross(cur), id))
346	uassert.True(t, IsExecuted(id), "must record execution")
347}
348
349func TestExecute_TwiceBlocked(cur realm, t *testing.T) {
350	resetState()
351	testing.SetRealm(testing.NewUserRealm(owner))
352	registerUpgrades(cur)
353	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
354	skipSeconds(MinDelayFloor)
355	Execute(cross(cur), id)
356
357	uassert.AbortsWithMessage(t, cur, "action already executed", func() { Execute(cross(cur), id) })
358}
359
360func TestExecute_ExpiredBlocked(cur realm, t *testing.T) {
361	resetState()
362	testing.SetRealm(testing.NewUserRealm(owner))
363	registerUpgrades(cur)
364	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
365
366	// travel past the grace window: stale actions cannot be sprung later
367	skipSeconds(MinDelayFloor + GracePeriod + 10)
368	uassert.False(t, IsReady(id), "expired action must not be ready")
369	uassert.AbortsContains(t, cur, "action expired", func() { Execute(cross(cur), id) })
370	uassert.Equal(t, "none", GetPending())
371}
372
373// ---------- Cancel / Veto ----------
374
375func TestCancel_CurrentOwnerOnly(cur realm, t *testing.T) {
376	resetState()
377	testing.SetRealm(testing.NewUserRealm(owner))
378	registerUpgrades(cur)
379	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
380
381	testing.SetRealm(testing.NewUserRealm(attacker))
382	uassert.AbortsWithMessage(t, cur,
383		"only the target owner can cancel",
384		func() { Cancel(cross(cur), id) },
385	)
386
387	testing.SetRealm(testing.NewUserRealm(owner))
388	uassert.Equal(t, "cancelled: "+id, Cancel(cross(cur), id))
389	_, present := actions[id]
390	uassert.False(t, present, "cancelled action must be reaped from state")
391
392	// re-audit P3: after an ownership transfer the SCHEDULING creator
393	// loses cancel rights; only the current owner holds them
394	id2 := Schedule(cross(cur), "upgrades", "op2", MinDelayFloor)
395	TransferTargetOwnership(cross(cur), "upgrades", newOwner)
396	testing.SetRealm(testing.NewUserRealm(newOwner))
397	AcceptTargetOwnership(cross(cur), "upgrades")
398	testing.SetRealm(testing.NewUserRealm(owner))
399	uassert.AbortsWithMessage(t, cur,
400		"only the target owner can cancel",
401		func() { Cancel(cross(cur), id2) },
402	)
403	testing.SetRealm(testing.NewUserRealm(newOwner))
404	uassert.Equal(t, "cancelled: "+id2, Cancel(cross(cur), id2))
405}
406
407func TestCancel_ExecutedBlocked(cur realm, t *testing.T) {
408	resetState()
409	testing.SetRealm(testing.NewUserRealm(owner))
410	registerUpgrades(cur)
411	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
412	skipSeconds(MinDelayFloor)
413	Execute(cross(cur), id)
414
415	uassert.AbortsWithMessage(t, cur,
416		"cannot cancel an already-executed action",
417		func() { Cancel(cross(cur), id) },
418	)
419}
420
421func TestVeto_GuardianOnly(cur realm, t *testing.T) {
422	resetState()
423	testing.SetRealm(testing.NewUserRealm(owner))
424	registerUpgrades(cur)
425	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
426
427	testing.SetRealm(testing.NewUserRealm(attacker))
428	uassert.AbortsWithMessage(t, cur,
429		"only the target guardian can veto",
430		func() { Veto(cross(cur), id) },
431	)
432
433	testing.SetRealm(testing.NewUserRealm(guardian))
434	uassert.Equal(t, "vetoed: "+id, Veto(cross(cur), id))
435	_, present := actions[id]
436	uassert.False(t, present, "vetoed action must be reaped from state")
437
438	// a vetoed action can never execute
439	skipSeconds(MinDelayFloor)
440	uassert.AbortsWithMessage(t, cur, "action not found: "+id, func() { Execute(cross(cur), id) })
441}
442
443func TestVeto_NoGuardianTargetBlocked(cur realm, t *testing.T) {
444	resetState()
445	testing.SetRealm(testing.NewUserRealm(owner))
446	RegisterTarget(cross(cur), "plain", MinDelayFloor, "")
447	id := Schedule(cross(cur), "plain", "op", MinDelayFloor)
448
449	testing.SetRealm(testing.NewUserRealm(guardian))
450	uassert.AbortsWithMessage(t, cur,
451		"target has no guardian: plain",
452		func() { Veto(cross(cur), id) },
453	)
454}
455
456// ---------- Expire (fix Y2) ----------
457
458func TestExpire_PermissionlessRecovery(cur realm, t *testing.T) {
459	resetState()
460	testing.SetRealm(testing.NewUserRealm(owner))
461	registerUpgrades(cur)
462
463	// fill the target's quota, then let everything expire
464	var ids []string
465	for i := 0; i < MaxPendingPerTarget; i++ {
466		ids = append(ids, Schedule(cross(cur), "upgrades", "op", MinDelayFloor))
467	}
468	skipSeconds(MinDelayFloor + GracePeriod + 10)
469
470	// fix Y2 regression: ANYONE — not just a lucky sweep window — can
471	// reap a provably expired action and free the slot it wedges
472	testing.SetRealm(testing.NewUserRealm(attacker))
473	uassert.Equal(t, "expired: "+ids[0], Expire(cross(cur), ids[0]))
474	_, present := actions[ids[0]]
475	uassert.False(t, present, "expired action must be reaped from state")
476
477	// reap the rest as the owner; quota and SetGuardian both recover
478	testing.SetRealm(testing.NewUserRealm(owner))
479	for _, id := range ids[1:] {
480		Expire(cross(cur), id)
481	}
482	uassert.Equal(t, 0, pendingCount("upgrades"))
483	SetGuardian(cross(cur), "upgrades", "") // no longer blocked
484	Schedule(cross(cur), "upgrades", "fresh", MinDelayFloor)
485}
486
487func TestExpire_RefusesLiveAndExecuted(cur realm, t *testing.T) {
488	resetState()
489	testing.SetRealm(testing.NewUserRealm(owner))
490	registerUpgrades(cur)
491	live := Schedule(cross(cur), "upgrades", "live", MinDelayFloor)
492	done := Schedule(cross(cur), "upgrades", "done", MinDelayFloor)
493	skipSeconds(MinDelayFloor)
494	Execute(cross(cur), done)
495
496	uassert.AbortsWithMessage(t, cur, "action is not expired",
497		func() { Expire(cross(cur), live) })
498	uassert.AbortsWithMessage(t, cur, "action already executed",
499		func() { Expire(cross(cur), done) })
500	uassert.AbortsWithMessage(t, cur, "action not found: ghost",
501		func() { Expire(cross(cur), "ghost") })
502}
503
504// ---------- stray sends (fix Y6) ----------
505
506func TestStraySendRejectedEverywhere(cur realm, t *testing.T) {
507	resetState()
508	testing.SetRealm(testing.NewUserRealm(owner))
509	registerUpgrades(cur)
510	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
511
512	// fix Y6 regression: this realm holds no banker, so an attached
513	// send would strand on the realm address forever — every crossing
514	// function must abort it (the abort reverts the transfer)
515	msg := "this realm does not accept coins"
516	testing.SetOriginSend(chain.Coins{{Denom: "ugnot", Amount: 5}})
517	uassert.AbortsWithMessage(t, cur, msg, func() { RegisterTarget(cross(cur), "paid", MinDelayFloor, "") })
518	uassert.AbortsWithMessage(t, cur, msg, func() { Schedule(cross(cur), "upgrades", "op2", MinDelayFloor) })
519	uassert.AbortsWithMessage(t, cur, msg, func() { Cancel(cross(cur), id) })
520	uassert.AbortsWithMessage(t, cur, msg, func() { SetGuardian(cross(cur), "upgrades", "") })
521	uassert.AbortsWithMessage(t, cur, msg, func() { TransferTargetOwnership(cross(cur), "upgrades", newOwner) })
522	uassert.AbortsWithMessage(t, cur, msg, func() { AcceptTargetOwnership(cross(cur), "upgrades") })
523	uassert.AbortsWithMessage(t, cur, msg, func() { Veto(cross(cur), id) })
524	uassert.AbortsWithMessage(t, cur, msg, func() { Expire(cross(cur), id) })
525	// SkipHeights resets the test context (wiping the send envelope),
526	// so re-arm it before probing the ready-action Execute path
527	skipSeconds(MinDelayFloor)
528	testing.SetRealm(testing.NewUserRealm(owner))
529	testing.SetOriginSend(chain.Coins{{Denom: "ugnot", Amount: 5}})
530	uassert.AbortsWithMessage(t, cur, msg, func() { Execute(cross(cur), id) })
531	testing.SetOriginSend(nil)
532
533	// without coins the same call succeeds
534	uassert.Equal(t, "executed: "+id, Execute(cross(cur), id))
535}
536
537// ---------- queries + render ----------
538
539func TestGetPending_ExcludesFinished(cur realm, t *testing.T) {
540	resetState()
541	testing.SetRealm(testing.NewUserRealm(owner))
542	registerUpgrades(cur)
543	id1 := Schedule(cross(cur), "upgrades", "op1", MinDelayFloor)
544	id2 := Schedule(cross(cur), "upgrades", "op2", MinDelayFloor)
545	id3 := Schedule(cross(cur), "upgrades", "op3", MinDelayFloor)
546
547	Cancel(cross(cur), id2)
548	skipSeconds(MinDelayFloor)
549	Execute(cross(cur), id1)
550
551	uassert.Equal(t, id3, GetPending())
552}
553
554func TestGetPending_GroupedByTarget(cur realm, t *testing.T) {
555	resetState()
556	testing.SetRealm(testing.NewUserRealm(owner))
557	RegisterTarget(cross(cur), "alpha", MinDelayFloor, "")
558	RegisterTarget(cross(cur), "beta", MinDelayFloor, "")
559
560	// interleave scheduling across targets; output groups by target in
561	// registration order (fix Y4 bookkeeping), insertion-ordered within
562	a1 := Schedule(cross(cur), "alpha", "a1", MinDelayFloor)
563	b1 := Schedule(cross(cur), "beta", "b1", MinDelayFloor)
564	a2 := Schedule(cross(cur), "alpha", "a2", MinDelayFloor)
565
566	uassert.Equal(t, a1+", "+a2+", "+b1, GetPending())
567	uassert.Equal(t, 2, pendingCount("alpha"))
568	uassert.Equal(t, 1, pendingCount("beta"))
569
570	Cancel(cross(cur), a1)
571	uassert.Equal(t, a2+", "+b1, GetPending())
572	uassert.Equal(t, 1, pendingCount("alpha"))
573}
574
575func TestGetTarget_Summary(cur realm, t *testing.T) {
576	resetState()
577	testing.SetRealm(testing.NewUserRealm(owner))
578	registerUpgrades(cur)
579
580	out := GetTarget("upgrades")
581	uassert.True(t, strings.Contains(out, string(owner)), "must show owner")
582	uassert.True(t, strings.Contains(out, string(guardian)), "must show guardian")
583	uassert.True(t, strings.Contains(out, "Min delay: 60s"), "must show min delay")
584
585	TransferTargetOwnership(cross(cur), "upgrades", newOwner)
586	uassert.True(t, strings.Contains(GetTarget("upgrades"), "Pending owner: "+string(newOwner)),
587		"must show a pending ownership offer")
588}
589
590func TestRender_SanitizesInjection(cur realm, t *testing.T) {
591	resetState()
592	testing.SetRealm(testing.NewUserRealm(owner))
593	registerUpgrades(cur)
594	Schedule(cross(cur), "upgrades", "evil` | injected\nrow", MinDelayFloor)
595
596	out := Render("")
597	uassert.False(t, strings.Contains(out, "evil`"), "backticks must be sanitized")
598	uassert.False(t, strings.Contains(out, "injected\nrow"), "newlines must be sanitized")
599}
600
601func TestRender_SanitizesHTMLBrackets(cur realm, t *testing.T) {
602	resetState()
603	testing.SetRealm(testing.NewUserRealm(owner))
604	registerUpgrades(cur)
605	// fix Y3 regression: raw HTML must never reach the page
606	Schedule(cross(cur), "upgrades", "<script>alert(1)</script>", MinDelayFloor)
607
608	out := Render("")
609	uassert.False(t, strings.Contains(out, "<script"), "script tags must be sanitized in Render")
610	uassert.False(t, strings.Contains(out, "</script"), "closing tags must be sanitized in Render")
611	one := GetAction(GetPending())
612	uassert.False(t, strings.Contains(one, "<script"), "script tags must be sanitized in GetAction")
613}
614
615func TestRender_EmptyState(cur realm, t *testing.T) {
616	resetState()
617	uassert.Equal(t, "# Timelock Guardian\n\nNo actions scheduled.\n", Render(""))
618}
619
620func TestRender_Sections(cur realm, t *testing.T) {
621	resetState()
622	testing.SetRealm(testing.NewUserRealm(owner))
623	registerUpgrades(cur)
624	id1 := Schedule(cross(cur), "upgrades", "op1", MinDelayFloor)
625	id2 := Schedule(cross(cur), "upgrades", "op2", MinDelayFloor)
626	Schedule(cross(cur), "upgrades", "op3", MinDelayFloor)
627	skipSeconds(MinDelayFloor)
628	Execute(cross(cur), id1)
629	Cancel(cross(cur), id2)
630
631	out := Render("")
632	uassert.True(t, strings.Contains(out, "## Executed (1)"), "executed section")
633	uassert.True(t, strings.Contains(out, "## Pending (1)"), "pending section")
634	uassert.False(t, strings.Contains(out, "Cancelled"), "cancelled actions are reaped, not rendered")
635}
636
637// ---------- re-audit regressions (2026-09-02) ----------
638
639func TestScheduleCancelCycling_CannotBrickTheRealm(cur realm, t *testing.T) {
640	resetState()
641	testing.SetRealm(testing.NewUserRealm(owner))
642	registerUpgrades(cur)
643
644	// re-audit P1: the old lifetime cap could be consumed forever by
645	// schedule+cancel cycling; the cap now bounds LIVE actions and
646	// cancelled records are reaped, so heavy cycling leaves no residue
647	for i := 0; i < 3*MaxPendingPerTarget; i++ {
648		id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
649		Cancel(cross(cur), id)
650	}
651	uassert.Equal(t, 0, len(actions), "cycling must leave no state residue")
652	uassert.Equal(t, 0, pendingCount("upgrades"), "no live actions after cycling")
653	Schedule(cross(cur), "upgrades", "op", MinDelayFloor) // must not abort
654}
655
656func TestSetGuardian_BlockedWhilePending(cur realm, t *testing.T) {
657	resetState()
658	testing.SetRealm(testing.NewUserRealm(owner))
659	registerUpgrades(cur)
660	id := Schedule(cross(cur), "upgrades", "rug", MinDelayFloor)
661
662	// re-audit P2: the owner must not be able to strip the guardian
663	// during the delay window the guardian exists to police
664	uassert.AbortsWithMessage(t, cur,
665		"cannot change the guardian while actions are pending",
666		func() { SetGuardian(cross(cur), "upgrades", "") },
667	)
668
669	// once nothing is pending, the owner may change the guardian
670	Cancel(cross(cur), id)
671	SetGuardian(cross(cur), "upgrades", "")
672	uassert.Equal(t, "", string(targets["upgrades"].Guardian))
673}
674
675func TestVetoAndCancel_RefuseExpired(cur realm, t *testing.T) {
676	resetState()
677	testing.SetRealm(testing.NewUserRealm(owner))
678	registerUpgrades(cur)
679	id := Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
680	skipSeconds(MinDelayFloor + GracePeriod + 10)
681
682	// re-audit P3: terminal-state writes on expired actions rewrote
683	// history; both must refuse and point at the Expire valve
684	uassert.AbortsWithMessage(t, cur, "action expired: nothing to cancel (use Expire)",
685		func() { Cancel(cross(cur), id) })
686	testing.SetRealm(testing.NewUserRealm(guardian))
687	uassert.AbortsWithMessage(t, cur, "action expired: nothing to veto (use Expire)",
688		func() { Veto(cross(cur), id) })
689}
690
691func TestExpiredActions_ReapedOnSchedule(cur realm, t *testing.T) {
692	resetState()
693	testing.SetRealm(testing.NewUserRealm(owner))
694	registerUpgrades(cur)
695	Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
696	skipSeconds(MinDelayFloor + GracePeriod + 10)
697
698	// the next Schedule sweeps expired actions out of state
699	Schedule(cross(cur), "upgrades", "op2", MinDelayFloor)
700	uassert.Equal(t, 1, len(actions), "expired action must be reaped by the sweep")
701}
702
703func TestRender_LinkInjectionSanitized(cur realm, t *testing.T) {
704	resetState()
705	testing.SetRealm(testing.NewUserRealm(owner))
706	registerUpgrades(cur)
707	Schedule(cross(cur), "upgrades", "[approve](https://evil.example)", MinDelayFloor)
708
709	out := Render("")
710	uassert.False(t, strings.Contains(out, "[approve]"), "link syntax must be sanitized")
711}
712
713func TestPerOwnerTargetCap(cur realm, t *testing.T) {
714	resetState()
715	testing.SetRealm(testing.NewUserRealm(owner))
716	for i := 0; i < MaxTargetsPerOwner; i++ {
717		RegisterTarget(cross(cur), "t_"+strings.Repeat("x", i+1), MinDelayFloor, "")
718	}
719	uassert.AbortsWithMessage(t, cur,
720		"per-owner target limit reached",
721		func() { RegisterTarget(cross(cur), "one_more", MinDelayFloor, "") },
722	)
723}
724
725// ---------- round-3 audit regressions (2026-09-02) ----------
726
727func TestSybilsCannotExhaustSharedCapacity(cur realm, t *testing.T) {
728	resetState()
729
730	// round-3 P1: two attackers filling their OWN per-owner quotas must
731	// never block a third owner's Schedule — there is no shared cap left
732	// to exhaust
733	sybils := []address{testutils.TestAddress("sybil_a"), testutils.TestAddress("sybil_b")}
734	for _, syb := range sybils {
735		testing.SetRealm(testing.NewUserRealm(syb))
736		for i := 0; i < MaxTargetsPerOwner; i++ {
737			name := "t_" + string(syb[len(syb)-4:]) + "_" + strings.Repeat("x", i+1)
738			RegisterTarget(cross(cur), name, MinDelayFloor, "")
739			for j := 0; j < MaxPendingPerTarget; j++ {
740				Schedule(cross(cur), name, "spam", MaxDelay) // 10y delay: sweep reclaims nothing
741			}
742		}
743	}
744
745	// a legitimate owner is entirely unaffected
746	testing.SetRealm(testing.NewUserRealm(owner))
747	RegisterTarget(cross(cur), "legit", MinDelayFloor, "")
748	Schedule(cross(cur), "legit", "real work", MinDelayFloor) // must not abort
749}
750
751func TestVictimRecoversBehindSybilWall(cur realm, t *testing.T) {
752	resetState()
753
754	// fix Y2/Y4 regression — the exact starvation case the old global
755	// budget-windowed sweep could not recover from: a wall of long-delay
756	// sybil actions in front, a victim whose actions expired behind it.
757	// Per-target sweeps and permissionless Expire make recovery local.
758	syb := testutils.TestAddress("wall")
759	testing.SetRealm(testing.NewUserRealm(syb))
760	for i := 0; i < 5; i++ {
761		name := "wall_" + strings.Repeat("w", i+1)
762		RegisterTarget(cross(cur), name, MinDelayFloor, "")
763		for j := 0; j < MaxPendingPerTarget; j++ {
764			Schedule(cross(cur), name, "wall", MaxDelay) // 100 live 10y entries
765		}
766	}
767
768	victim := testutils.TestAddress("victim2")
769	testing.SetRealm(testing.NewUserRealm(victim))
770	RegisterTarget(cross(cur), "vt", MinDelayFloor, guardian)
771	var ids []string
772	for j := 0; j < MaxPendingPerTarget; j++ {
773		ids = append(ids, Schedule(cross(cur), "vt", "op", MinDelayFloor))
774	}
775	skipSeconds(MinDelayFloor + GracePeriod + 10) // all 20 expire
776
777	// the victim's own next Schedule sweeps THEIR target despite the wall
778	Schedule(cross(cur), "vt", "recovered", MinDelayFloor)
779	uassert.Equal(t, 1, pendingCount("vt"), "expired actions swept despite the sybil wall")
780
781	// and Expire frees a wedged slot directly, from any key
782	id2 := Schedule(cross(cur), "vt", "will expire", MinDelayFloor)
783	testing.SetRealm(testing.NewUserRealm(attacker))
784	skipSeconds(MinDelayFloor + GracePeriod + 10)
785	Expire(cross(cur), id2)
786	_, present := actions[id2]
787	uassert.False(t, present, "Expire must reap regardless of global queue position")
788}
789
790func TestPendingCounterConsistency(cur realm, t *testing.T) {
791	resetState()
792	testing.SetRealm(testing.NewUserRealm(owner))
793	registerUpgrades(cur)
794
795	id1 := Schedule(cross(cur), "upgrades", "a", MinDelayFloor)
796	id2 := Schedule(cross(cur), "upgrades", "b", MinDelayFloor)
797	Schedule(cross(cur), "upgrades", "c", MinDelayFloor)
798	uassert.Equal(t, 3, pendingCount("upgrades"))
799
800	Cancel(cross(cur), id1)
801	uassert.Equal(t, 2, pendingCount("upgrades"))
802	skipSeconds(MinDelayFloor)
803	Execute(cross(cur), id2)
804	uassert.Equal(t, 1, pendingCount("upgrades"))
805
806	// expiry: the count drops when the sweep reaps
807	skipSeconds(GracePeriod + 10)
808	Schedule(cross(cur), "upgrades", "d", MinDelayFloor) // triggers sweep of expired "c"
809	uassert.Equal(t, 1, pendingCount("upgrades"))
810}
811
812func TestSanitize_EmphasisMarkers(cur realm, t *testing.T) {
813	resetState()
814	testing.SetRealm(testing.NewUserRealm(owner))
815	registerUpgrades(cur)
816	Schedule(cross(cur), "upgrades", "**ready** _now_", MinDelayFloor)
817
818	out := Render("")
819	uassert.False(t, strings.Contains(out, "**ready** _now_"),
820		"emphasis markers in Data must be sanitized")
821}
822
823// ---------- render-index bounds (fix Y4) ----------
824
825func TestRenderIndexSelfTrims(cur realm, t *testing.T) {
826	resetState()
827	testing.SetRealm(testing.NewUserRealm(owner))
828	RegisterTarget(cross(cur), "churn", MinDelayFloor, "")
829
830	// execute many actions so actionIDs would grow unboundedly without
831	// the trim; the index must stay within RenderIndexCap and old
832	// executed records must stay queryable via the map reads
833	var first string
834	for i := 0; i < RenderIndexCap+30; i++ {
835		id := Schedule(cross(cur), "churn", "op", MinDelayFloor)
836		if i == 0 {
837			first = id
838		}
839		skipSeconds(MinDelayFloor)
840		Execute(cross(cur), id)
841	}
842	uassert.True(t, len(actionIDs) <= RenderIndexCap, "render index must self-trim")
843	uassert.True(t, IsExecuted(first), "trimmed records stay queryable forever")
844	uassert.True(t, strings.Contains(GetAction(first), "Status: executed"),
845		"GetAction must still serve trimmed records")
846}
847
848// ---------- round-2 audit regressions ----------
849
850func TestSetGuardian_SweepsExpiredFirst(cur realm, t *testing.T) {
851	resetState()
852	testing.SetRealm(testing.NewUserRealm(owner))
853	registerUpgrades(cur)
854	Schedule(cross(cur), "upgrades", "op", MinDelayFloor)
855	skipSeconds(MinDelayFloor + GracePeriod + 10)
856
857	// round-2 hardening: expired-but-unswept actions protect nothing
858	// and must not block a guardian rotation
859	SetGuardian(cross(cur), "upgrades", "")
860	uassert.Equal(t, "", string(targets["upgrades"].Guardian))
861	uassert.Equal(t, 0, pendingCount("upgrades"), "the gate sweep must reap expired actions")
862}
863
864func TestRenderShowsPendingDespiteChurn(cur realm, t *testing.T) {
865	resetState()
866	testing.SetRealm(testing.NewUserRealm(owner))
867	RegisterTarget(cross(cur), "vis", MinDelayFloor, "")
868	watched := Schedule(cross(cur), "vis", "watched rug", 2*(MinDelayFloor+5*(RenderIndexCap+30)))
869
870	// round-2 fix Y-2: flood the render index with executed churn; the
871	// live pending action must remain visible for its whole window
872	RegisterTarget(cross(cur), "churn2", MinDelayFloor, "")
873	for i := 0; i < RenderIndexCap+30; i++ {
874		id := Schedule(cross(cur), "churn2", "noise", MinDelayFloor)
875		skipSeconds(MinDelayFloor)
876		Execute(cross(cur), id)
877	}
878
879	out := Render("")
880	uassert.True(t, strings.Contains(out, watched), "a live pending action must survive render-index churn")
881	uassert.True(t, strings.Contains(out, "## Pending (1)"), "pending section from live lists")
882
883	// and state stays consistent for an action trimmed out of the
884	// render index: Cancel still works (absent-id removeID is a no-op)
885	uassert.Equal(t, "cancelled: "+watched, Cancel(cross(cur), watched))
886	uassert.Equal(t, 0, pendingCount("vis"))
887}
888
889func TestPendingTargetsBookkeeping(cur realm, t *testing.T) {
890	resetState()
891	testing.SetRealm(testing.NewUserRealm(owner))
892	RegisterTarget(cross(cur), "one", MinDelayFloor, "")
893	RegisterTarget(cross(cur), "two", MinDelayFloor, "")
894
895	// round-2 fix Y-1: only targets with live pendings are tracked
896	uassert.Equal(t, 0, len(pendingTargets))
897	a1 := Schedule(cross(cur), "one", "a", MinDelayFloor)
898	Schedule(cross(cur), "two", "b", MinDelayFloor)
899	uassert.Equal(t, 2, len(pendingTargets))
900
901	Cancel(cross(cur), a1)
902	uassert.Equal(t, 1, len(pendingTargets), "emptied target leaves the with-pendings list")
903	uassert.Equal(t, 1, len(ptIndex))
904
905	// registration alone never inflates the list
906	RegisterTarget(cross(cur), "three", MinDelayFloor, "")
907	uassert.Equal(t, 1, len(pendingTargets))
908}