fix(vault): require an elapsed wake-up before a recovery share can unseal

server/crates/arbiter-server/src/actors/proposal_manager.rs

@@ -25,10 +25,6 @@ pub mod store;
 pub const DEFAULT_TTL_SECS: u32 = 7 * 24 * 60 * 60; // 7 days
 pub const MAX_TTL_SECS: u32 = DEFAULT_TTL_SECS;
 
-/// Recovery operators stay asleep for this long after a wake-up is requested, so the other
-/// operators have time to dispute it (§3.6).
-const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60; // 14 days
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum VoteOutcome {
     Pending,

server/crates/arbiter-server/src/actors/proposal_manager/store.rs

@@ -3,10 +3,9 @@
 //! The actor holds a `dyn ProposalStore` rather than a connection pool, so the quorum
 //! rules can be exercised against a mock instead of a live SQLite file.
 
-use super::{Error, ProposalSummary, WAKEUP_DELAY_SECS};
+use super::{Error, ProposalSummary};
 use crate::db::{
     self,
-    functions::unixepoch,
     models::{
         NewProposal, NewProposalVote, NewRecoveryProposalVote, NewRecoveryWakeupRequest,
         OperatorIdentityId, Proposal, ProposalId, ProposalStatus, RecoveryOperatorIdentityId,
@@ -360,17 +359,9 @@ impl ProposalStore for DieselProposalStore {
 
     async fn is_recovery_active(&self) -> Result<bool, Error> {
         let mut conn = self.db.get().await?;
-        select(exists(
-            schema::recovery_wakeup_request::table
-                .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
-                .filter(
-                    schema::recovery_wakeup_request::requested_at
-                        .le(unixepoch("now") - WAKEUP_DELAY_SECS),
-                ),
-        ))
-        .get_result(&mut conn)
-        .await
-        .map_err(Error::from)
+        db::recovery::is_active(&mut conn)
+            .await
+            .map_err(Error::from)
     }
 
     async fn has_uncancelled_wakeup(&self) -> Result<bool, Error> {

server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs

@@ -54,6 +54,8 @@ pub enum Error {
     BrokenDatabase,
     #[error("A committee must have at least one ordinary operator")]
     EmptyCommittee,
+    #[error("Recovery operators are sleeping")]
+    RecoveryNotActive,
 }
 
 // Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
@@ -583,6 +585,13 @@ impl VaultCoordinator {
         recovery_operator_id: i32,
         mut passphrase: SafeCell<Vec<u8>>,
     ) -> Result<bool, Error> {
+        {
+            let mut conn = self.db.get().await?;
+            if !db::recovery::is_active(&mut conn).await? {
+                return Err(Error::RecoveryNotActive);
+            }
+        }
+
         self.ensure_unsealing_state().await?;
 
         let CoordinatorState::Unsealing {

server/crates/arbiter-server/src/db/mod.rs

@@ -11,6 +11,7 @@ use tracing::info;
 pub mod functions;
 pub mod models;
 pub mod proposal;
+pub mod recovery;
 pub mod schema;
 
 pub type DatabaseConnection = SyncConnectionWrapper<SqliteConnection>;

server/crates/arbiter-server/src/db/recovery.rs

@@ -0,0 +1,102 @@
+//! Whether the recovery committee is awake.
+//!
+//! §3.6: a wake-up request opens a dispute window; recovery powers only become active once
+//! that window has elapsed without cancellation. Both the proposal manager (for voting) and
+//! the vault coordinator (for unsealing) gate on this, so the rule lives in one place.
+
+use crate::db::{functions::unixepoch, schema};
+
+use diesel::{
+    ExpressionMethods as _, QueryDsl as _,
+    dsl::{exists, select},
+};
+use diesel_async::RunQueryDsl;
+
+/// Recovery operators stay asleep for this long after a wake-up is requested, so the other
+/// operators have time to dispute it (§3.6).
+pub const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60;
+
+/// True when an uncancelled wake-up request is older than the dispute window.
+pub async fn is_active(
+    conn: &mut crate::db::DatabaseConnection,
+) -> Result<bool, diesel::result::Error> {
+    select(exists(
+        schema::recovery_wakeup_request::table
+            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
+            .filter(
+                schema::recovery_wakeup_request::requested_at
+                    .le(unixepoch("now") - WAKEUP_DELAY_SECS),
+            ),
+    ))
+    .get_result(conn)
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{WAKEUP_DELAY_SECS, is_active};
+    use crate::db::{self, schema};
+
+    use diesel::{ExpressionMethods as _, insert_into};
+    use diesel_async::RunQueryDsl;
+
+    /// `recovery_wakeup_request.requested_by` references `operator_identity(id)`, and pooled
+    /// connections enforce foreign keys, so every wake-up row needs a real identity behind it.
+    async fn insert_operator(pool: &db::DatabasePool) -> i32 {
+        let mut conn = pool.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![7u8; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    }
+
+    /// Pins `.filter(requested_at.le(...))`: a wake-up requested moments ago must not be
+    /// active yet, even though nothing has cancelled it. Deleting that filter turns this
+    /// assertion false without touching any other test in the suite.
+    #[tokio::test]
+    async fn a_recent_wakeup_is_not_yet_active() {
+        let pool = db::create_test_pool().await;
+        let operator_id = insert_operator(&pool).await;
+        let mut conn = pool.get().await.unwrap();
+
+        diesel::sql_query(format!(
+            "INSERT INTO recovery_wakeup_request (requested_by, requested_at) \
+             VALUES ({operator_id}, unixepoch('now'))"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+
+        assert!(
+            !is_active(&mut conn).await.unwrap(),
+            "a wake-up requested moments ago must still be asleep"
+        );
+    }
+
+    /// Pins `.filter(cancelled_at.is_null())`: a cancelled wake-up must not count towards
+    /// activity even once its original request has outlived the dispute window. Deleting
+    /// that filter turns this assertion false without touching any other test in the suite.
+    #[tokio::test]
+    async fn a_cancelled_wakeup_is_not_active_even_past_the_window() {
+        let pool = db::create_test_pool().await;
+        let operator_id = insert_operator(&pool).await;
+        let mut conn = pool.get().await.unwrap();
+
+        diesel::sql_query(format!(
+            "INSERT INTO recovery_wakeup_request \
+             (requested_by, requested_at, cancelled_by, cancelled_at) \
+             VALUES ({operator_id}, unixepoch('now') - {WAKEUP_DELAY_SECS} - 1, \
+             {operator_id}, unixepoch('now'))"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+
+        assert!(
+            !is_active(&mut conn).await.unwrap(),
+            "a cancelled wake-up must not activate recovery even past the window"
+        );
+    }
+}