From 9c423d274368dd5440629c6c36a07585ec8909bf Mon Sep 17 00:00:00 2001 From: TimothyBanks Date: Mon, 10 Aug 2026 18:04:25 -0400 Subject: [PATCH] feat: Hook up credential_id host function --- crates/xrpl-host-functions/src/lib.rs | 13 +++++++ .../tests/generated_abi.rs | 28 +++++++++++++++ crates/xrpl-wasm-vm-ffi/src/lib.rs | 23 ++++++++++++ crates/xrpl-wasm-vm/src/abi.rs | 9 +++++ crates/xrpl-wasm-vm/src/register.rs | 29 +++++++++++++++ crates/xrpl-wasm-vm/tests/budgets.rs | 5 +++ crates/xrpl-wasm-vm/tests/host_calls.rs | 31 ++++++++++++++++ crates/xrpl-wasm-vm/tests/preflight.rs | 3 +- crates/xrpl-wasm-vm/tests/support/mod.rs | 35 +++++++++++++++++++ include/xrpl/tx/wasm/HostContext.h | 9 +++++ src/libxrpl/tx/wasm/HostContext.cpp | 22 ++++++++++++ 11 files changed, 206 insertions(+), 1 deletion(-) diff --git a/crates/xrpl-host-functions/src/lib.rs b/crates/xrpl-host-functions/src/lib.rs index 39a5f20662..f088d018d9 100644 --- a/crates/xrpl-host-functions/src/lib.rs +++ b/crates/xrpl-host-functions/src/lib.rs @@ -254,6 +254,19 @@ host_functions! { #[wasm_name = "check_id"] fn check_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult; + /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and + /// issuer account ids and a credential-type byte string. Reads all three regions + /// and writes the keylet. + #[gas = 350] + #[wasm_name = "credential_id"] + fn credential_keylet( + &self, + subject: &[u8], + issuer: &[u8], + credential_type: &[u8], + out: &mut [u8], + ) -> HostResult; + /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512. #[gas = 2000] #[wasm_name = "sha512_half"] diff --git a/crates/xrpl-host-functions/tests/generated_abi.rs b/crates/xrpl-host-functions/tests/generated_abi.rs index f1761235b3..8ab48d1525 100644 --- a/crates/xrpl-host-functions/tests/generated_abi.rs +++ b/crates/xrpl-host-functions/tests/generated_abi.rs @@ -198,6 +198,24 @@ impl HostFunctions for FakeHost { put(out, &[account[0]; HASH_LEN]) } + /// A keylet from subject, issuer, and credential type; `InvalidAccount` if either + /// account is empty, `InvalidParams` if the type is empty. + fn credential_keylet( + &self, + subject: &[u8], + issuer: &[u8], + credential_type: &[u8], + out: &mut [u8], + ) -> HostResult { + if subject.is_empty() || issuer.is_empty() { + return Err(HostError::InvalidAccount); + } + if credential_type.is_empty() { + return Err(HostError::InvalidParams); + } + put(out, &[subject[0]; HASH_LEN]) + } + fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult { let mut digest = [0; HASH_LEN]; digest[0] = data.len() as u8; @@ -302,6 +320,15 @@ fn the_trait_is_implementable() { host.check_keylet(&[], 5, &mut out), Err(HostError::InvalidAccount) ); + assert_eq!( + host.credential_keylet(&[7; 20], &[8; 20], b"cred", &mut out), + Ok(HASH_LEN) + ); + assert_eq!(out[0], 7); + assert_eq!( + host.credential_keylet(&[], &[8; 20], b"cred", &mut out), + Err(HostError::InvalidAccount) + ); assert_eq!(host.sha512_half(b"abc", &mut out), Ok(HASH_LEN)); assert_eq!(out[0], 3); assert_eq!(host.trace("hello", b"xy", true), Ok(())); @@ -391,6 +418,7 @@ fn the_spec_table_matches_the_declarations() { ("accountroot_id", 350), ("amm_id", 450), ("check_id", 350), + ("credential_id", 350), ("sha512_half", 2000), ("trace", 500), ("trace_num", 500), diff --git a/crates/xrpl-wasm-vm-ffi/src/lib.rs b/crates/xrpl-wasm-vm-ffi/src/lib.rs index 5db3eabaaf..210a192ed1 100644 --- a/crates/xrpl-wasm-vm-ffi/src/lib.rs +++ b/crates/xrpl-wasm-vm-ffi/src/lib.rs @@ -272,6 +272,16 @@ mod ffi { #[cxx_name = "checkKeylet"] fn check_keylet(self: &HostContext, account: &[u8], seq: i32, out: &mut [u8]) -> i32; + #[namespace = "xrpl"] + #[cxx_name = "credentialKeylet"] + fn credential_keylet( + self: &HostContext, + subject: &[u8], + issuer: &[u8], + credential_type: &[u8], + out: &mut [u8], + ) -> i32; + #[namespace = "xrpl"] #[cxx_name = "sha512Half"] fn sha512_half(self: &HostContext, data: &[u8], out: &mut [u8]) -> i32; @@ -431,6 +441,19 @@ impl HostFunctions for CxxHost<'_> { bytes_written(self.ctx.check_keylet(account, seq, out)) } + fn credential_keylet( + &self, + subject: &[u8], + issuer: &[u8], + credential_type: &[u8], + out: &mut [u8], + ) -> HostResult { + bytes_written( + self.ctx + .credential_keylet(subject, issuer, credential_type, out), + ) + } + fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult { bytes_written(self.ctx.sha512_half(data, out)) } diff --git a/crates/xrpl-wasm-vm/src/abi.rs b/crates/xrpl-wasm-vm/src/abi.rs index 78d8bfa523..f8d7b535e1 100644 --- a/crates/xrpl-wasm-vm/src/abi.rs +++ b/crates/xrpl-wasm-vm/src/abi.rs @@ -274,6 +274,15 @@ mod tests { fn check_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult { unreachable!("no unit test in this module calls the host") } + fn credential_keylet( + &self, + _subject: &[u8], + _issuer: &[u8], + _credential_type: &[u8], + _out: &mut [u8], + ) -> HostResult { + unreachable!("no unit test in this module calls the host") + } fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult { unreachable!("no unit test in this module calls the host") } diff --git a/crates/xrpl-wasm-vm/src/register.rs b/crates/xrpl-wasm-vm/src/register.rs index 82544efaab..8034d7bf1e 100644 --- a/crates/xrpl-wasm-vm/src/register.rs +++ b/crates/xrpl-wasm-vm/src/register.rs @@ -382,6 +382,35 @@ pub(crate) fn register_host_functions( }) }, ), + HostFunctionSpec::CredentialKeylet => linker.func_wrap( + HOST_MODULE, + op.wasm_name(), + |mut caller: Caller<'_, VmState<'_>>, + subj_ptr: i32, + subj_len: i32, + iss_ptr: i32, + iss_len: i32, + ct_ptr: i32, + ct_len: i32, + out_ptr: i32, + out_len: i32| + -> Result { + charged(&mut caller, HostFunctionSpec::CredentialKeylet, |c| { + let out = Region::new(out_ptr, out_len); + let subject = Region::new(subj_ptr, subj_len); + let issuer = Region::new(iss_ptr, iss_len); + let cred_type = Region::new(ct_ptr, ct_len); + write_buffered(c, out, |host, data, buf| { + host.credential_keylet( + subject.read(data)?, + issuer.read(data)?, + cred_type.read(data)?, + buf, + ) + }) + }) + }, + ), HostFunctionSpec::Sha512Half => linker.func_wrap( HOST_MODULE, op.wasm_name(), diff --git a/crates/xrpl-wasm-vm/tests/budgets.rs b/crates/xrpl-wasm-vm/tests/budgets.rs index ab2a610ac9..97ab613b50 100644 --- a/crates/xrpl-wasm-vm/tests/budgets.rs +++ b/crates/xrpl-wasm-vm/tests/budgets.rs @@ -159,6 +159,11 @@ fn call_for(op: HostFunctionSpec) -> Call { "(call $check_id (i32.const 0) (i32.const 20) (i32.const 5) (i32.const 32) (i32.const 32))", 5, ), + HostFunctionSpec::CredentialKeylet => ( + import::CREDENTIAL_ID, + "(call $credential_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 4) (i32.const 44) (i32.const 20))", + 8, + ), HostFunctionSpec::Sha512Half => ( import::SHA512_HALF, "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 32))", diff --git a/crates/xrpl-wasm-vm/tests/host_calls.rs b/crates/xrpl-wasm-vm/tests/host_calls.rs index 8ac05a152d..994aa87608 100644 --- a/crates/xrpl-wasm-vm/tests/host_calls.rs +++ b/crates/xrpl-wasm-vm/tests/host_calls.rs @@ -431,6 +431,37 @@ fn check_id_reads_the_account_and_seq_and_writes_the_keylet() { assert_eq!(*host.check_keylets_asked.borrow(), vec![(account, 5)]); } +/// A keylet getter that reads three input regions — two accounts and a credential +/// type: all three reach the host keyed together, and the keylet lands where asked. +#[test] +fn credential_id_reads_subject_issuer_and_type() { + // Guest memory is zeroed, so the two 20-byte accounts and the 4-byte type read + // as zeros of their declared lengths. + let subject = vec![0u8; 20]; + let issuer = vec![0u8; 20]; + let cred_type = vec![0u8; 4]; + let host = FakeHost::new().answering_credential_keylet( + subject.clone(), + issuer.clone(), + cred_type.clone(), + support::Answer::filler(32), + ); + + let wat = module( + &[import::CREDENTIAL_ID, ONE_PAGE], + "(call $credential_id + (i32.const 0) (i32.const 20) + (i32.const 20) (i32.const 20) + (i32.const 40) (i32.const 4) + (i32.const 64) (i32.const 64))", + ); + assert_eq!(status(&wat, &host), 32, "the 32-byte keylet length"); + assert_eq!( + *host.credential_keylets_asked.borrow(), + vec![(subject, issuer, cred_type)] + ); +} + /// A leading scalar parameter reaches the host as declared. #[test] fn home_le_field_passes_the_field_selector_through() { diff --git a/crates/xrpl-wasm-vm/tests/preflight.rs b/crates/xrpl-wasm-vm/tests/preflight.rs index c494de5630..d968769999 100644 --- a/crates/xrpl-wasm-vm/tests/preflight.rs +++ b/crates/xrpl-wasm-vm/tests/preflight.rs @@ -98,7 +98,7 @@ fn a_disabled_feature_does_not_pass() { /// Every host function the ABI declares, spelled as a guest imports it. The count /// is asserted against the ABI so a function added to it cannot be left out here. -const ALL_IMPORTS: [&str; 25] = [ +const ALL_IMPORTS: [&str; 26] = [ import::LDGR_INDEX, import::PARENT_LDGR_TIME, import::PARENT_LDGR_HASH, @@ -121,6 +121,7 @@ const ALL_IMPORTS: [&str; 25] = [ import::ACCOUNTROOT_ID, import::AMM_ID, import::CHECK_ID, + import::CREDENTIAL_ID, import::SHA512_HALF, import::TRACE, import::TRACE_NUM, diff --git a/crates/xrpl-wasm-vm/tests/support/mod.rs b/crates/xrpl-wasm-vm/tests/support/mod.rs index 9ef3aade86..300ddd3047 100644 --- a/crates/xrpl-wasm-vm/tests/support/mod.rs +++ b/crates/xrpl-wasm-vm/tests/support/mod.rs @@ -194,6 +194,11 @@ pub struct FakeHost { pub check_keylets: HashMap<(Vec, i32), Answer>, /// Every (account, seq) `check_keylet` was asked for. pub check_keylets_asked: RefCell, i32)>>, + /// What `credential_keylet` answers, by (subject, issuer, type) bytes. An unlisted + /// key answers `InvalidAccount`. + pub credential_keylets: HashMap<(Vec, Vec, Vec), Answer>, + /// Every (subject, issuer, type) `credential_keylet` was asked for. + pub credential_keylets_asked: RefCell, Vec, Vec)>>, /// What `sha512_half` answers, whatever it is given. pub digest: Answer, /// Every field selector `get_current_ledger_obj_field` was asked for. @@ -254,6 +259,8 @@ impl Default for FakeHost { amm_keylets_asked: RefCell::new(Vec::new()), check_keylets: HashMap::new(), check_keylets_asked: RefCell::new(Vec::new()), + credential_keylets: HashMap::new(), + credential_keylets_asked: RefCell::new(Vec::new()), digest: Answer::filler(32), fields_asked: RefCell::new(Vec::new()), digested: RefCell::new(Vec::new()), @@ -397,6 +404,18 @@ impl FakeHost { self } + pub fn answering_credential_keylet( + mut self, + subject: Vec, + issuer: Vec, + credential_type: Vec, + answer: Answer, + ) -> FakeHost { + self.credential_keylets + .insert((subject, issuer, credential_type), answer); + self + } + pub fn answering_digest(mut self, answer: Answer) -> FakeHost { self.digest = answer; self @@ -593,6 +612,21 @@ impl HostFunctions for FakeHost { } } + fn credential_keylet( + &self, + subject: &[u8], + issuer: &[u8], + credential_type: &[u8], + out: &mut [u8], + ) -> HostResult { + let key = (subject.to_vec(), issuer.to_vec(), credential_type.to_vec()); + self.credential_keylets_asked.borrow_mut().push(key.clone()); + match self.credential_keylets.get(&key) { + Some(answer) => answer.fill(out), + None => Err(HostError::InvalidAccount), + } + } + fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult { self.digested.borrow_mut().push(data.to_vec()); self.digest.fill(out) @@ -655,6 +689,7 @@ pub mod import { pub const ACCOUNTROOT_ID: &str = r#"(import "host_lib" "accountroot_id" (func $accountroot_id (param i32 i32 i32 i32) (result i32)))"#; pub const AMM_ID: &str = r#"(import "host_lib" "amm_id" (func $amm_id (param i32 i32 i32 i32 i32 i32) (result i32)))"#; pub const CHECK_ID: &str = r#"(import "host_lib" "check_id" (func $check_id (param i32 i32 i32 i32 i32) (result i32)))"#; + pub const CREDENTIAL_ID: &str = r#"(import "host_lib" "credential_id" (func $credential_id (param i32 i32 i32 i32 i32 i32 i32 i32) (result i32)))"#; pub const SHA512_HALF: &str = r#"(import "host_lib" "sha512_half" (func $sha512_half (param i32 i32 i32 i32) (result i32)))"#; pub const TRACE: &str = r#"(import "host_lib" "trace" (func $trace (param i32 i32 i32 i32 i32) (result i32)))"#; diff --git a/include/xrpl/tx/wasm/HostContext.h b/include/xrpl/tx/wasm/HostContext.h index 8e0b3c5a11..f39302dd31 100644 --- a/include/xrpl/tx/wasm/HostContext.h +++ b/include/xrpl/tx/wasm/HostContext.h @@ -141,6 +141,15 @@ public: std::int32_t seq, rust::Slice out) const noexcept; + // Subject and issuer must each be 20 bytes, else `InvalidParams`. Writes the + // 32-byte keylet. + [[nodiscard]] std::int32_t + credentialKeylet( + rust::Slice subject, + rust::Slice issuer, + rust::Slice credentialType, + rust::Slice out) const noexcept; + [[nodiscard]] std::int32_t sha512Half(rust::Slice data, rust::Slice out) const noexcept; diff --git a/src/libxrpl/tx/wasm/HostContext.cpp b/src/libxrpl/tx/wasm/HostContext.cpp index a739bb9e54..5bd1e3fe3f 100644 --- a/src/libxrpl/tx/wasm/HostContext.cpp +++ b/src/libxrpl/tx/wasm/HostContext.cpp @@ -505,6 +505,28 @@ HostContext::checkKeylet( }); } +std::int32_t +HostContext::credentialKeylet( + rust::Slice subject, + rust::Slice issuer, + rust::Slice credentialType, + rust::Slice out) const noexcept +{ + return guarded(hostFunctions_.getJournal(), kHostInternal, [&] { + if (subject.size() != AccountID::size() || issuer.size() != AccountID::size()) + return hfErrorToInt(HostFunctionError::InvalidParams); + + auto const value = hostFunctions_.credentialKeylet( + AccountID::fromVoid(subject.data()), + AccountID::fromVoid(issuer.data()), + Slice{credentialType.data(), credentialType.size()}); + if (!value) + return hfErrorToInt(value.error()); + + return answer(out, value->data(), value->size()); + }); +} + std::int32_t HostContext::sha512Half(rust::Slice data, rust::Slice out) const noexcept