MarketTakers/arbiter
6
0
Fork 0
Code Issues 14 Pull Requests 7 Packages Projects Releases Wiki Activity

fix(db): enable foreign key enforcement on pooled connections

Browse Source
This commit is contained in:
CleverWild
2026-09-07 14:40:34 +02:00
parent 5d811f2ee9
commit a37af6bc1c
5 changed files with 319 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
server/crates/arbiter-server/src/db/mod.rs
View File

@@ -123,6 +123,10 @@ pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetu
conn.batch_execute("PRAGMA journal_mode = WAL;")
.await
.map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;
// Per-connection in SQLite: the migration connection enabling it is not enough.
conn.batch_execute("PRAGMA foreign_keys = ON;")
.await
.map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;
Ok(conn)
})
@@ -156,3 +160,33 @@ pub async fn create_test_pool() -> DatabasePool {
.await
.expect("Failed to create test database pool")
}
#[cfg(test)]
mod tests {
use super::*;
use diesel::{ExpressionMethods as _, dsl::insert_into};
use diesel_async::RunQueryDsl;
/// `operator.id` references `operator_identity(id)`. Without `PRAGMA foreign_keys = ON`
/// on the pooled connection, SQLite accepts a share row for an operator that does not exist.
#[tokio::test]
async fn pooled_connections_enforce_foreign_keys() {
let pool = create_test_pool().await;
let mut conn = pool.get().await.unwrap();
let result = insert_into(schema::operator::table)
.values((
schema::operator::id.eq(4242),
schema::operator::share.eq(vec![0u8; 32]),
schema::operator::share_nonce.eq(vec![0u8; 24]),
schema::operator::share_salt.eq(vec![0u8; 32]),
))
.execute(&mut conn)
.await;
assert!(
result.is_err(),
"insert with a dangling operator_identity reference was accepted"
);
}
}

81
server/crates/arbiter-server/src/evm/mod.rs
View File

@@ -352,16 +352,17 @@ impl Engine {
mod tests {
use alloy::primitives::{Address, Bytes, U256, address};
use chrono::{Duration, Utc};
use diesel::{SelectableHelper, insert_into};
use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
use diesel_async::RunQueryDsl;
use rstest::rstest;
use crate::db::{
self, DatabaseConnection,
self, DatabaseConnection, models,
models::{
EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
SqliteTimestamp,
},
schema,
schema::{evm_basic_grant, evm_transaction_log},
};
use crate::evm::policies::{
@@ -403,10 +404,82 @@ mod tests {
}
}
/// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
/// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and
/// returns the new access row's id.
async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
.values(&models::NewRootKeyHistory {
ciphertext: vec![0u8; 32],
tag: vec![0u8; 16],
root_key_encryption_nonce: vec![0u8; 24],
data_encryption_nonce: vec![0u8; 24],
schema_version: 1,
salt: vec![0u8; 16],
})
.returning(schema::root_key_history::id)
.get_result(conn)
.await
.unwrap();
let aead_id: i32 = insert_into(schema::aead_encrypted::table)
.values(&models::NewAeadEncrypted {
ciphertext: vec![0u8; 32],
tag: vec![0u8; 16],
current_nonce: vec![0u8; 24],
schema_version: 1,
associated_root_key_id: root_key_id,
created_at: Utc::now().into(),
})
.returning(schema::aead_encrypted::id)
.get_result(conn)
.await
.unwrap();
let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
.values((
schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
schema::evm_wallet::aead_encrypted_id.eq(aead_id),
))
.returning(schema::evm_wallet::id)
.get_result(conn)
.await
.unwrap();
let metadata_id: i32 = insert_into(schema::client_metadata::table)
.values(schema::client_metadata::name.eq("test"))
.returning(schema::client_metadata::id)
.get_result(conn)
.await
.unwrap();
let client_id: i32 = insert_into(schema::program_client::table)
.values((
schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
schema::program_client::metadata_id.eq(metadata_id),
))
.returning(schema::program_client::id)
.get_result(conn)
.await
.unwrap();
insert_into(schema::evm_wallet_access::table)
.values((
schema::evm_wallet_access::wallet_id.eq(wallet_id),
schema::evm_wallet_access::client_id.eq(client_id),
))
.returning(schema::evm_wallet_access::id)
.get_result(conn)
.await
.unwrap()
}
async fn insert_basic_grant(
conn: &mut DatabaseConnection,
shared: &SharedGrantSettings,
) -> EvmBasicGrant {
let wallet_access_id = seed_wallet_access(conn).await;
#[expect(
clippy::cast_possible_truncation,
clippy::cast_possible_wrap,
@@ -415,7 +488,7 @@ mod tests {
)]
insert_into(evm_basic_grant::table)
.values(NewEvmBasicGrant {
wallet_access_id: shared.wallet_access_id,
wallet_access_id,
chain_id: shared.chain.into(),
valid_from: shared.valid_from.map(SqliteTimestamp),
valid_until: shared.valid_until.map(SqliteTimestamp),
@@ -579,7 +652,7 @@ mod tests {
insert_into(evm_transaction_log::table)
.values(NewEvmTransactionLog {
grant_id: basic_grant.id,
wallet_access_id: WALLET_ACCESS_ID,
wallet_access_id: basic_grant.wallet_access_id,
chain_id: CHAIN_ID.into(),
eth_value: super::utils::u256_to_bytes(U256::ZERO).to_vec(),
signed_at: SqliteTimestamp(Utc::now()),

85
server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
View File

@@ -1,11 +1,12 @@
use super::{EtherTransfer, Settings};
use crate::{
db::{
self, DatabaseConnection,
self, DatabaseConnection, models,
models::{
EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
SqliteTimestamp,
},
schema,
schema::{evm_basic_grant, evm_transaction_log},
},
evm::{
@@ -19,7 +20,7 @@ use crate::{
use alloy::primitives::{Address, Bytes, U256, address};
use chrono::{Duration, Utc};
use diesel::{SelectableHelper, insert_into};
use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
use diesel_async::RunQueryDsl;
const WALLET_ACCESS_ID: i32 = 1;
@@ -45,10 +46,82 @@ fn ctx(to: Address, value: U256) -> EvalContext {
}
}
/// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
/// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
/// the new access row's id.
async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
.values(&models::NewRootKeyHistory {
ciphertext: vec![0u8; 32],
tag: vec![0u8; 16],
root_key_encryption_nonce: vec![0u8; 24],
data_encryption_nonce: vec![0u8; 24],
schema_version: 1,
salt: vec![0u8; 16],
})
.returning(schema::root_key_history::id)
.get_result(conn)
.await
.unwrap();
let aead_id: i32 = insert_into(schema::aead_encrypted::table)
.values(&models::NewAeadEncrypted {
ciphertext: vec![0u8; 32],
tag: vec![0u8; 16],
current_nonce: vec![0u8; 24],
schema_version: 1,
associated_root_key_id: root_key_id,
created_at: Utc::now().into(),
})
.returning(schema::aead_encrypted::id)
.get_result(conn)
.await
.unwrap();
let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
.values((
schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
schema::evm_wallet::aead_encrypted_id.eq(aead_id),
))
.returning(schema::evm_wallet::id)
.get_result(conn)
.await
.unwrap();
let metadata_id: i32 = insert_into(schema::client_metadata::table)
.values(schema::client_metadata::name.eq("test"))
.returning(schema::client_metadata::id)
.get_result(conn)
.await
.unwrap();
let client_id: i32 = insert_into(schema::program_client::table)
.values((
schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
schema::program_client::metadata_id.eq(metadata_id),
))
.returning(schema::program_client::id)
.get_result(conn)
.await
.unwrap();
insert_into(schema::evm_wallet_access::table)
.values((
schema::evm_wallet_access::wallet_id.eq(wallet_id),
schema::evm_wallet_access::client_id.eq(client_id),
))
.returning(schema::evm_wallet_access::id)
.get_result(conn)
.await
.unwrap()
}
async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
let wallet_access_id = seed_wallet_access(conn).await;
insert_into(evm_basic_grant::table)
.values(NewEvmBasicGrant {
wallet_access_id: WALLET_ACCESS_ID,
wallet_access_id,
chain_id: CHAIN_ID.into(),
valid_from: None,
valid_until: None,
@@ -161,7 +234,7 @@ async fn evaluate_passes_when_volume_within_limit() {
insert_into(evm_transaction_log::table)
.values(NewEvmTransactionLog {
grant_id,
wallet_access_id: WALLET_ACCESS_ID,
wallet_access_id: basic.wallet_access_id,
chain_id: CHAIN_ID.into(),
eth_value: utils::u256_to_bytes(U256::from(500u64)).to_vec(),
signed_at: SqliteTimestamp(Utc::now()),
@@ -203,7 +276,7 @@ async fn evaluate_rejects_volume_over_limit() {
insert_into(evm_transaction_log::table)
.values(NewEvmTransactionLog {
grant_id,
wallet_access_id: WALLET_ACCESS_ID,
wallet_access_id: basic.wallet_access_id,
chain_id: CHAIN_ID.into(),
eth_value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
signed_at: SqliteTimestamp(Utc::now()),
@@ -246,7 +319,7 @@ async fn evaluate_passes_at_exactly_volume_limit() {
insert_into(evm_transaction_log::table)
.values(NewEvmTransactionLog {
grant_id,
wallet_access_id: WALLET_ACCESS_ID,
wallet_access_id: basic.wallet_access_id,
chain_id: CHAIN_ID.into(),
eth_value: utils::u256_to_bytes(U256::from(900u64)).to_vec(),
signed_at: SqliteTimestamp(Utc::now()),

114
server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
View File

@@ -1,8 +1,9 @@
use super::{Settings, TokenTransfer};
use crate::{
db::{
self, DatabaseConnection,
self, DatabaseConnection, models,
models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
schema,
schema::evm_basic_grant,
},
evm::{
@@ -20,7 +21,7 @@ use alloy::{
sol_types::SolCall,
};
use chrono::{Duration, Utc};
use diesel::{SelectableHelper, insert_into};
use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
use diesel_async::RunQueryDsl;
// DAI on Ethereum mainnet — present in the static token registry
@@ -58,10 +59,82 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
}
}
/// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
/// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
/// the new access row's id.
async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
.values(&models::NewRootKeyHistory {
ciphertext: vec![0u8; 32],
tag: vec![0u8; 16],
root_key_encryption_nonce: vec![0u8; 24],
data_encryption_nonce: vec![0u8; 24],
schema_version: 1,
salt: vec![0u8; 16],
})
.returning(schema::root_key_history::id)
.get_result(conn)
.await
.unwrap();
let aead_id: i32 = insert_into(schema::aead_encrypted::table)
.values(&models::NewAeadEncrypted {
ciphertext: vec![0u8; 32],
tag: vec![0u8; 16],
current_nonce: vec![0u8; 24],
schema_version: 1,
associated_root_key_id: root_key_id,
created_at: Utc::now().into(),
})
.returning(schema::aead_encrypted::id)
.get_result(conn)
.await
.unwrap();
let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
.values((
schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
schema::evm_wallet::aead_encrypted_id.eq(aead_id),
))
.returning(schema::evm_wallet::id)
.get_result(conn)
.await
.unwrap();
let metadata_id: i32 = insert_into(schema::client_metadata::table)
.values(schema::client_metadata::name.eq("test"))
.returning(schema::client_metadata::id)
.get_result(conn)
.await
.unwrap();
let client_id: i32 = insert_into(schema::program_client::table)
.values((
schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
schema::program_client::metadata_id.eq(metadata_id),
))
.returning(schema::program_client::id)
.get_result(conn)
.await
.unwrap();
insert_into(schema::evm_wallet_access::table)
.values((
schema::evm_wallet_access::wallet_id.eq(wallet_id),
schema::evm_wallet_access::client_id.eq(client_id),
))
.returning(schema::evm_wallet_access::id)
.get_result(conn)
.await
.unwrap()
}
async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
let wallet_access_id = seed_wallet_access(conn).await;
insert_into(evm_basic_grant::table)
.values(NewEvmBasicGrant {
wallet_access_id: WALLET_ACCESS_ID,
wallet_access_id,
chain_id: CHAIN_ID.into(),
valid_from: None,
valid_until: None,
@@ -77,6 +150,27 @@ async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicG
.unwrap()
}
/// `evm_token_transfer_log.log_id` references the shared `evm_transaction_log` table, so
/// tests recording a token transfer need a real row there to point at.
async fn insert_transaction_log(
conn: &mut DatabaseConnection,
basic: &EvmBasicGrant,
eth_value: U256,
) -> i32 {
insert_into(schema::evm_transaction_log::table)
.values(models::NewEvmTransactionLog {
grant_id: basic.id,
wallet_access_id: basic.wallet_access_id,
chain_id: CHAIN_ID.into(),
eth_value: utils::u256_to_bytes(eth_value).to_vec(),
signed_at: SqliteTimestamp(Utc::now()),
})
.returning(schema::evm_transaction_log::id)
.get_result(conn)
.await
.unwrap()
}
fn make_settings(target: Option<Address>, max_volume: Option<u64>) -> Settings {
Settings {
token_contract: DAI,
@@ -241,10 +335,11 @@ async fn evaluate_passes_volume_at_exact_limit() {
.unwrap();
// Record a past transfer of 900, with current transfer 100 => exactly 1000 limit
insert_into(db::schema::evm_token_transfer_log::table)
.values(db::models::NewEvmTokenTransferLog {
let log_id = insert_transaction_log(&mut conn, &basic, U256::from(900u64)).await;
insert_into(schema::evm_token_transfer_log::table)
.values(models::NewEvmTokenTransferLog {
grant_id,
log_id: 0,
log_id,
chain_id: CHAIN_ID.into(),
token_contract: DAI.to_vec(),
recipient_address: RECIPIENT.to_vec(),
@@ -285,10 +380,11 @@ async fn evaluate_rejects_volume_over_limit() {
.await
.unwrap();
insert_into(db::schema::evm_token_transfer_log::table)
.values(db::models::NewEvmTokenTransferLog {
let log_id = insert_transaction_log(&mut conn, &basic, U256::from(1_000u64)).await;
insert_into(schema::evm_token_transfer_log::table)
.values(models::NewEvmTokenTransferLog {
grant_id,
log_id: 0,
log_id,
chain_id: CHAIN_ID.into(),
token_contract: DAI.to_vec(),
recipient_address: RECIPIENT.to_vec(),