Merge remote-tracking branch 'origin/develop' into a1q123456/add-loan-invariants

include/xrpl/config/Constants.h

@@ -125,6 +125,7 @@ struct Keys
     static constexpr auto kMaximumTxnInLedger = "maximum_txn_in_ledger";
     static constexpr auto kMaximumTxnPerAccount = "maximum_txn_per_account";
     static constexpr auto kMemoryLevel = "memory_level";
+    static constexpr auto kMaxWaitingLedgers = "max_waiting_ledgers";
     static constexpr auto kMinLedgersToComputeSizeLimit = "min_ledgers_to_compute_size_limit";
     static constexpr auto kMinimumEscalationMultiplier = "minimum_escalation_multiplier";
     static constexpr auto kMinimumLastLedgerBuffer = "minimum_last_ledger_buffer";

include/xrpl/ledger/helpers/CredentialHelpers.h

@@ -14,6 +14,7 @@
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/TER.h>
 
+#include <cstdint>
 #include <memory>
 #include <set>
 #include <utility>
@@ -33,6 +34,32 @@ checkExpired(SLE const& sleCredential, NetClock::time_point const& closed);
 [[nodiscard]] TER
 deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j);
 
+/**
+ * @brief Remove credentials pinned to a pseudo-account's owner directory.
+ *
+ * Cleans up credentials that were linked to a pseudo-account (Vault, LoanBroker,
+ * AMM), which such an account can neither accept nor delete. Only credentials
+ * are removed; every other object is left in place. The walk visits at most
+ * @p maxNodesToDelete directory entries and charges the ones it leaves alone
+ * against that budget too, so a directory holding other objects yields fewer
+ * than @p maxNodesToDelete deletions. On reaching the bound the result is
+ * `tecINCOMPLETE` and the caller must propagate it so a later transaction
+ * resumes.
+ *
+ * @param view Mutable ledger view.
+ * @param pseudoAcct The pseudo-account whose directory is cleaned.
+ * @param maxNodesToDelete Upper bound on directory entries processed in one call.
+ * @param j Journal for diagnostics.
+ * @return tesSUCCESS once no credentials remain, tecINCOMPLETE if the bound was
+ *         reached, or a deletion error.
+ */
+[[nodiscard]] TER
+deletePseudoAccountCredentials(
+    ApplyView& view,
+    AccountID const& pseudoAcct,
+    std::uint16_t maxNodesToDelete,
+    beast::Journal j);
+
 // Amendment and parameters checks for sfCredentialIDs field
 NotTEC
 checkFields(STTx const& tx, Rules const& rules, beast::Journal j);

include/xrpl/ledger/helpers/VaultHelpers.h

@@ -7,6 +7,7 @@
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
 
 #include <cstdint>
 #include <optional>
@@ -238,4 +239,40 @@ getVaultPhase(
     std::optional<std::uint32_t> subscriptionDate,
     std::optional<std::uint32_t> redemptionDate);
 
+/**
+ * Controls whether checkVaultDomain reports an expired credential as an
+ * error. A caller that deletes expired credentials later, in doApply, passes
+ * Yes and treats the subject as authorized; a caller with no such cleanup
+ * step must keep the error.
+ */
+enum class SuppressExpired : bool { No = false, Yes = true };
+
+/**
+ * Checks that subject belongs to the permissioned domain governing a vault's
+ * shares.
+ *
+ * The domain is read from the share issuance rather than from the vault. Vault
+ * shares are issued by the vault's pseudo-account, which cannot grant an
+ * authorization explicitly, so domain membership is the only route to being
+ * authorized: a vault with no domain set has no authorized participants at
+ * all, and every subject fails with tecNO_AUTH.
+ *
+ * Which accounts to check, and whether to check at all, is left to the caller.
+ * This says nothing about vault privacy or about the roles of the accounts.
+ *
+ * @param view The ledger view.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares.
+ * @param subject The account whose domain membership is checked.
+ * @param suppressExpired Whether an expired credential counts as authorized.
+ *
+ * @return tesSUCCESS if the subject is a domain member, otherwise the reason
+ * it is not.
+ */
+[[nodiscard]] TER
+checkVaultDomain(
+    ReadView const& view,
+    SLE::const_ref issuance,
+    AccountID const& subject,
+    SuppressExpired suppressExpired);
+
 }  // namespace xrpl

include/xrpl/protocol/Protocol.h

@@ -396,6 +396,16 @@ using TxID = uint256;
  */
 constexpr std::uint16_t kMaxDeletableAmmTrustLines = 512;
 
+/**
+ * The maximum number of owner-directory entries to walk when clearing
+ * credentials pinned to a pseudo-account, in a single transaction.
+ *
+ * The walk stops after this many entries whether or not each one turns out to
+ * be a credential, so a directory that also holds other objects yields fewer
+ * deletions per transaction.
+ */
+constexpr std::uint16_t kMaxDeletablePseudoAccountCredentials = 512;
+
 /**
  * The maximum length of a URI inside an Oracle
  */

include/xrpl/protocol/STLedgerEntry.h

@@ -19,7 +19,7 @@ namespace xrpl {
 
 class Rules;
 namespace test {
-class Invariants_test;
+class InvariantsMisc_test;
 }  // namespace test
 
 class STLedgerEntry final : public STObject, public CountedObject<STLedgerEntry>
@@ -83,8 +83,8 @@ private:
     void
     setSLEType();
 
-    friend test::Invariants_test;  // this test wants access to the private
-                                   // type_
+    friend test::InvariantsMisc_test;  // this test wants access to the
+                                       // private type_
 
     STBase*
     copy(std::size_t n, void* buf) const override;