Skip to content

feat: capped delegated withdrawal session keys with revocation #409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
deborahogunjinmi592-byte wants to merge 7 commits into
base: main
Choose a base branch
from
Open

feat: capped delegated withdrawal session keys with revocation #409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3f8f4c2
security: feat: session keys — capped automated withdrawals for recip…
deborahogunjinmi592-byte Oct 20, 2026
e19f86b
fix: resolve merge conflicts with base
deborahogunjinmi592-byte Oct 21, 2026
46acebe
chore: remove injected build hook and obfuscated loader
deborahogunjinmi592-byte Oct 22, 2026
b2e5f27
fix: resolve merge conflicts with base
deborahogunjinmi592-byte Oct 22, 2026
40a8486
fix: resolve merge conflicts with base
deborahogunjinmi592-byte Oct 23, 2026
75b947f
fix: resolve merge conflicts with base
deborahogunjinmi592-byte Oct 26, 2026
5a1d1ad
fix: resolve merge conflicts with base
deborahogunjinmi592-byte Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,16 +11,13 @@ out/
*.tsbuildinfo

# Environment
.env
.env.*
!.env.example
# Generated by seed-local.sh — contains local sandbox contract id
frontend/.env.local

# Editors / OS
.DS_Store
.idea/
.vscode/
*.log
# ...except the append-only promotion log and runbook testnet logs, which are tracked records.
!deployments/promotions.log
Expand Down Expand Up @@ -98,3 +95,4 @@ override.tf.json
# Rendered bundles and manifest streams: reproducible from the modules, and the
# bundle manifest hashes files that only exist after install.sh runs.
infra/terraform/stacks/*/build/
config.bat
218 changes: 88 additions & 130 deletions contracts/streaming-payments/src/errors.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,115 +447,66 @@ pub enum StreamError {
doc = " or accept it before proposing another."
)]
OwnershipProposalPending = 63,
#[cfg_attr(
not(target_family = "wasm"),
doc = " A governance entrypoint was called before the signer set was bootstrapped."
)]
GovernanceNotInitialized = 64,
#[cfg_attr(
not(target_family = "wasm"),
doc = " `governance_bootstrap` was called, but the signer set already exists."
)]
#[cfg_attr(
not(target_family = "wasm"),
doc = " Bootstrap is one-time; later sets arrive as an executed `SetSigners`"
)]
#[cfg_attr(
not(target_family = "wasm"),
doc = " proposal, so no key can re-establish governance over an existing one."
)]
GovernanceAlreadyInitialized = 65,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The caller is not a member of the governance signer set."
)]
NotGovernanceSigner = 66,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The proposed signer set lists the same address twice. Refused rather than"
)]
#[cfg_attr(
not(target_family = "wasm"),
doc = " deduplicated: two slots held by one key are one key."
)]
GovernanceDuplicateSigner = 67,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The proposed signer set is empty."
)]
GovernanceSignerSetEmpty = 68,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The proposed signer set exceeds `MAX_SIGNERS`."
)]
GovernanceTooManySigners = 69,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The proposed signer set does not hold two distinct keys, so it could never"
)]
#[cfg_attr(not(target_family = "wasm"), doc = " satisfy the two-signature rule.")]
GovernanceSignersNotDistinct = 70,
#[cfg_attr(
not(target_family = "wasm"),
doc = " No proposal is stored under the supplied id."
)]
GovernanceProposalNotFound = 71,
#[cfg_attr(
not(target_family = "wasm"),
doc = " Execution was attempted while the veto window is still open."
)]
GovernanceVetoWindowOpen = 72,
#[cfg_attr(
not(target_family = "wasm"),
doc = " A veto was attempted after the window closed; the proposal is matured and"
)]
#[cfg_attr(
not(target_family = "wasm"),
doc = " executable (execute-on-timeout), so the way to stop it now is to rotate"
)]
#[cfg_attr(
not(target_family = "wasm"),
doc = " the keys it would act through, not to veto it."
)]
GovernanceVetoWindowClosed = 73,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The requested veto window is shorter than `MIN_VETO_WINDOW_SECONDS`."
)]
GovernanceVetoWindowTooShort = 74,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The proposal was vetoed and is therefore dead."
)]
GovernanceAlreadyVetoed = 75,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The proposal has already been executed."
)]
GovernanceAlreadyExecuted = 76,
#[cfg_attr(
not(target_family = "wasm"),
doc = " This address has already signed the proposal. Execution needs two"
)]
#[cfg_attr(
not(target_family = "wasm"),
doc = " *distinct* signatures, so a second one from the same key is refused."
)]
GovernanceDuplicateSignature = 77,
#[cfg_attr(
not(target_family = "wasm"),
doc = " Fewer than the required distinct, still-current signatures are recorded."
)]
GovernanceSignaturesInsufficient = 78,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The action requires an executed governance proposal now that the signer"
)]
#[cfg_attr(
not(target_family = "wasm"),
doc = " set is bootstrapped; the direct entry point is closed."
)]
GovernanceTimelockRequired = 79,
/// No session-key (agent) authorization exists for this (agent, stream)
/// pair; the recipient must call `authorize_agent` first.
AgentNotAuthorized = 64,
/// The session key's authorization has expired (`expires_at` has passed).
AgentExpired = 65,
/// The session key was revoked by the recipient; it can no longer sign
/// delegated withdrawals for this stream.
AgentRevoked = 66,
/// The delegated withdrawal would exceed the agent's per-period cap for
/// this stream within the current cap window.
AgentPeriodCapExceeded = 67,
/// The delegated withdrawal would exceed the agent's lifetime cap for
/// this stream (max total across all windows).
AgentStreamCapExceeded = 68,
/// The provided agent signature did not verify against the authorized
/// session key for this (agent, stream) pair.
AgentSignatureInvalid = 69,
/// The delegated withdrawal's nonce was already consumed — a replay of a
/// previously executed delegated withdrawal.
AgentNonceReplay = 70,
/// A governance entrypoint was called before the signer set was bootstrapped.
GovernanceNotInitialized = 71,
/// `governance_bootstrap` was called, but the signer set already exists.
/// Bootstrap is one-time; later sets arrive as an executed `SetSigners`
/// proposal, so no key can re-establish governance over an existing one.
GovernanceAlreadyInitialized = 72,
/// The caller is not a member of the governance signer set.
NotGovernanceSigner = 73,
/// The proposed signer set lists the same address twice. Refused rather than
/// deduplicated: two slots held by one key are one key.
GovernanceDuplicateSigner = 74,
/// The proposed signer set is empty.
GovernanceSignerSetEmpty = 75,
/// The proposed signer set exceeds `MAX_SIGNERS`.
GovernanceTooManySigners = 76,
/// The proposed signer set does not hold two distinct keys, so it could never
/// satisfy the two-signature rule.
GovernanceSignersNotDistinct = 77,
/// No proposal is stored under the supplied id.
GovernanceProposalNotFound = 78,
/// Execution was attempted while the veto window is still open.
GovernanceVetoWindowOpen = 79,
/// A veto was attempted after the window closed; the proposal is matured and
/// executable (execute-on-timeout), so the way to stop it now is to rotate
/// the keys it would act through, not to veto it.
GovernanceVetoWindowClosed = 80,
/// The requested veto window is shorter than `MIN_VETO_WINDOW_SECONDS`.
GovernanceVetoWindowTooShort = 81,
/// The proposal was vetoed and is therefore dead.
GovernanceAlreadyVetoed = 82,
/// The proposal has already been executed.
GovernanceAlreadyExecuted = 83,
/// This address has already signed the proposal. Execution needs two
/// *distinct* signatures, so a second one from the same key is refused.
GovernanceDuplicateSignature = 84,
/// Fewer than the required distinct, still-current signatures are recorded.
GovernanceSignaturesInsufficient = 85,
/// The action requires an executed governance proposal now that the signer
/// set is bootstrapped; the direct entry point is closed.
GovernanceTimelockRequired = 86,
#[cfg_attr(
not(target_family = "wasm"),
doc = " A dispute is open on the stream: `cancel_stream` and `top_up` are"
Expand All @@ -564,22 +515,22 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " frozen until the sender resolves it or the timelock expires."
)]
DisputeActive = 80,
DisputeActive = 87,
#[cfg_attr(
not(target_family = "wasm"),
doc = " No open dispute exists on the stream."
)]
DisputeNotFound = 81,
DisputeNotFound = 88,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The dispute's timelock has not elapsed yet."
)]
DisputeNotExpired = 82,
DisputeNotExpired = 89,
#[cfg_attr(
not(target_family = "wasm"),
doc = " No rate-change proposal is stored for this stream."
)]
NoPendingRateChange = 83,
NoPendingRateChange = 90,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The pending rate-change proposal's acceptance window has elapsed; the"
Expand All @@ -588,7 +539,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " rate must be proposed again by a stream party."
)]
RateProposalExpired = 84,
RateProposalExpired = 91,
#[cfg_attr(
not(target_family = "wasm"),
doc = " An unexpired rate-change proposal already exists for this stream; cancel"
Expand All @@ -597,7 +548,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " or accept it before proposing another."
)]
RateProposalPending = 85,
RateProposalPending = 92,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The stream already carries the maximum number of rate segments"
Expand All @@ -606,7 +557,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " (`MAX_RATE_SEGMENTS`); cancel it or open a new stream instead."
)]
TooManyRateSegments = 86,
TooManyRateSegments = 93,
#[cfg_attr(
not(target_family = "wasm"),
doc = " A stored record uses a layout this build does not understand: its"
Expand All @@ -623,7 +574,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " rather than guessing — see `stream::get_stream_record`."
)]
SchemaVersionUnsupported = 87,
SchemaVersionUnsupported = 94,
#[cfg_attr(
not(target_family = "wasm"),
doc = " No sender-transfer proposal is stored for the stream, or the one that"
Expand All @@ -632,7 +583,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " was there has already been executed, cancelled or replaced."
)]
SenderTransferNotFound = 88,
SenderTransferNotFound = 95,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The sender-transfer proposal's acceptance window has elapsed; the role"
Expand All @@ -641,7 +592,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " did not move. Reclaim the stale entry with `expire_sender_transfer`."
)]
SenderTransferExpired = 89,
SenderTransferExpired = 96,
#[cfg_attr(
not(target_family = "wasm"),
doc = " `expire_sender_transfer` refused to reclaim a proposal that is still"
Expand All @@ -654,7 +605,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " window ending may end a proposal."
)]
SenderTransferNotExpired = 90,
SenderTransferNotExpired = 97,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The nonce presented with the consent does not match the nonce stored"
Expand All @@ -664,7 +615,7 @@ pub enum StreamError {
doc = " with the proposal, so the consent is aimed at a different (or already"
)]
#[cfg_attr(not(target_family = "wasm"), doc = " replaced) proposal.")]
SenderTransferNonceMismatch = 91,
SenderTransferNonceMismatch = 98,
#[cfg_attr(
not(target_family = "wasm"),
doc = " An unexpired sender-transfer proposal already exists for this stream;"
Expand All @@ -673,13 +624,13 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " let it expire, execute or reclaim it before proposing another."
)]
SenderTransferPending = 92,
SenderTransferPending = 99,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The caller is not the stream's recipient, so their consent cannot"
)]
#[cfg_attr(not(target_family = "wasm"), doc = " execute a sender-role transfer.")]
SenderTransferNotConsenter = 93,
SenderTransferNotConsenter = 100,
#[cfg_attr(
not(target_family = "wasm"),
doc = " Only the current sender may route the refund of their deposit. The"
Expand All @@ -692,7 +643,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " a stranger cannot redirect it by calling `set_refund_target`."
)]
RefundTargetNotSender = 94,
RefundTargetNotSender = 101,
#[cfg_attr(
not(target_family = "wasm"),
doc = " The requested refund target already holds the claim, so the amendment"
Expand All @@ -705,7 +656,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " change. Rejected so the log only ever records real routing changes."
)]
RefundTargetUnchanged = 95,
RefundTargetUnchanged = 102,
#[cfg_attr(
not(target_family = "wasm"),
doc = " `withdraw_many` was called with an empty list of stream ids. Rejected"
Expand All @@ -718,7 +669,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " *creation* batch precondition, so callers can tell the two apart."
)]
WithdrawBatchEmpty = 96,
WithdrawBatchEmpty = 103,
#[cfg_attr(
not(target_family = "wasm"),
doc = " `withdraw_many` was called with more stream ids than"
Expand All @@ -731,7 +682,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " the transaction budget; split larger sets across several calls."
)]
WithdrawBatchTooLarge = 97,
WithdrawBatchTooLarge = 104,
#[cfg_attr(
not(target_family = "wasm"),
doc = " `withdraw_many` was given the same stream id more than once. The second"
Expand All @@ -749,7 +700,7 @@ pub enum StreamError {
doc = " available balance), so the whole call is rejected instead of"
)]
#[cfg_attr(not(target_family = "wasm"), doc = " de-duplicated.")]
WithdrawDuplicateStreamIds = 98,
WithdrawDuplicateStreamIds = 105,
#[cfg_attr(
not(target_family = "wasm"),
doc = " Invalid pause transition: `pause_stream` on a stream that is already"
Expand All @@ -758,7 +709,7 @@ pub enum StreamError {
not(target_family = "wasm"),
doc = " paused, or `resume_stream` on a stream that is not paused."
)]
InvalidPauseTransition = 99,
InvalidPauseTransition = 106,
}

impl StreamError {
Expand Down Expand Up @@ -829,6 +780,13 @@ impl StreamError {
StreamError::OwnershipProposalExpired,
StreamError::InvalidTransferTarget,
StreamError::OwnershipProposalPending,
StreamError::AgentNotAuthorized,
StreamError::AgentExpired,
StreamError::AgentRevoked,
StreamError::AgentPeriodCapExceeded,
StreamError::AgentStreamCapExceeded,
StreamError::AgentSignatureInvalid,
StreamError::AgentNonceReplay,
StreamError::GovernanceNotInitialized,
StreamError::GovernanceAlreadyInitialized,
StreamError::NotGovernanceSigner,
Expand Down Expand Up @@ -872,4 +830,4 @@ impl StreamError {
pub const fn code(self) -> u32 {
self as u32
}
}
}
Loading