chore: assert amulet.admin is present before building commands that need it - #2326
Merged
rukmini-basu-da merged 5 commits intoAug 25, 2026
Merged
Conversation
fetchAmulet() returns AssetBody with admin: PartyId typed as always present, but parseAssets does no runtime validation of the registry response it comes from. Three call sites (preapproval create command, traffic buyMemberTraffic, namespace tap) pass amulet.admin straight into ledger commands unchecked -- if a registry response is missing it, this silently builds a command (e.g. transfer preapproval) with an undefined expectedDso instead of failing loudly. Add one guard in fetchAmulet() that protects all three call sites. Fixes canton-network#1797 Signed-off-by: ayushsingh82 <ayushsinghmi711@gmail.com>
Contributor
Author
|
@alexmatson-da whenever you have a chance, would appreciate a look at this one. |
mjuchli-da
changed the title
Contributor
|
@rukmini-basu-da to review |
rukmini-basu-da
requested changes
Aug 20, 2026
Validating the registry response's admin field in fetchAmulet() only covered the amulet call site. parseAssets is the shared function that converts raw registry data into AssetBody for all callers (amulet, token transfer, token utxos), so the guard belongs there instead. Adds a unit test covering the missing-admin case. Signed-off-by: ayushsingh82 <ayushsinghmi711@gmail.com>
Address review feedback: annotate the return type as AssetBody[] instead of relying on inference. Signed-off-by: ayushsingh82 <ayushsinghmi711@gmail.com>
rukmini-basu-da
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fetchAmulet()(sdk/wallet-sdk/src/wallet/namespace/amulet/namespace.ts) returnsAssetBodywithadmin: PartyIdtyped as always-present, butparseAssets(sdk/wallet-sdk/src/wallet/namespace/utils/url.ts) does no runtime validation of the raw registry response it's built from --admincan actually beundefinedat runtime despite what the type claims.Three call sites currently pass
amulet.adminstraight into ledger commands with no guard:preapproval.ts's create command (expectedDso: amulet.admin)traffic.ts'sbuyMemberTrafficnamespace.ts'stapIf a registry response omits
admin, this silently builds a command (e.g. a transfer preapproval with an undefinedexpectedDso) that can even be submitted but won't work correctly, instead of failing loudly at the point where the bad data enters the SDK.Added one guard inside
fetchAmulet(), using the SDK's existingctx.error.throw(...)convention, which protects all three call sites at once.Fixes #1797
Test plan
tsc --noEmitinsdk/wallet-sdk: 115 errors before and after (exact match, confirmed viagit stashcomparison) -- all pre-existing from unbuilt workspace deps, zero new errors from this changeamulet.test.ts/preapproval.test.ts/traffic.test.tssuite -- it transitively needscore-token-standard, whose build requires Daml-generated codegen artifacts (damljs/token-standard-models) not available in the environment I worked in