WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

Bounded test succeeded; native RandomX miner accepted one block

Browse Source
This commit is contained in:
eric
2026-10-22 21:25:39 -04:00
parent 176d1927a8
commit bd3d36a7e1
12 changed files with 607 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/market/postgres-schema.ts
+36
View File
@@ -964,6 +964,42 @@ export async function grantPilotMoneroObserverRuntime(pool: Pool, role: string,
finally { c.release(); }
}
/** Read-only pilot review role. It can inspect persisted evidence, but not observer or financial state. */
export async function grantPilotMoneroDepositReviewRuntime(pool: Pool, role: string,
addressRole = 'pilot_deposit_address', reservationRole = 'pilot_deposit_reservation',
observerRole = 'pilot_monero_observer', custodyRuntimeRole = 'custody_runtime',
creditRole = 'monero_deposit_credit'): Promise<void> {
if (!/^[a-z][a-z0-9_]{0,62}$/.test(role)) throw new Error('Invalid pilot deposit review role identifier');
if ([addressRole, reservationRole, observerRole, custodyRuntimeRole, creditRole].includes(role)) {
throw new Error('Pilot deposit review role must be separate from observer, allocator, custody, and credit roles');
}
const name = `"${role}"`;
const c = await pool.connect();
try {
await c.query('BEGIN'); await verifyCustodySchema(c);
const r = await c.query('SELECT rolsuper,rolcreatedb,rolcreaterole,rolreplication,rolbypassrls FROM pg_roles WHERE rolname=$1', [role]);
if (!r.rowCount || Object.values(r.rows[0]).some(Boolean)) throw new Error('Pilot deposit review role must exist without administrative privileges');
const memberships = await c.query('SELECT 1 FROM pg_auth_members WHERE member=(SELECT oid FROM pg_roles WHERE rolname=$1) LIMIT 1', [role]);
if (memberships.rowCount) throw new Error('Pilot deposit review role must not inherit privileges through role membership');
const owner = await c.query("SELECT pg_get_userbyid(nspowner) AS owner FROM pg_namespace WHERE nspname='wk_custody'");
if (owner.rows[0].owner === role) throw new Error('Pilot deposit review role must not own the custody schema');
const owned = await c.query(`SELECT 1 FROM pg_class rel JOIN pg_namespace n ON n.oid=rel.relnamespace
WHERE n.nspname='wk_custody' AND rel.relowner=(SELECT oid FROM pg_roles WHERE rolname=$1) LIMIT 1`, [role]);
if (owned.rowCount) throw new Error('Pilot deposit review role must not own custody tables or sequences');
const databaseCreate = await c.query('SELECT has_database_privilege($1,current_database(),\'CREATE\') AS allowed', [role]);
if (databaseCreate.rows[0].allowed) throw new Error('Pilot deposit review role must not create database objects');
await c.query(`GRANT USAGE ON SCHEMA wk_custody TO ${name};
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA wk_custody FROM ${name};
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA wk_custody FROM ${name};
GRANT SELECT ON wk_custody.schema_versions,wk_custody.pilot_custody_identity,
wk_custody.pilot_monero_deposit_reservations,wk_custody.pilot_monero_observer_state,
wk_custody.pilot_monero_observation_scans,wk_custody.pilot_monero_observations,
wk_custody.pilot_monero_observation_events TO ${name};`);
await c.query('COMMIT');
} catch (error) { await c.query('ROLLBACK').catch(() => {}); throw error; }
finally { c.release(); }
}
/** Mainnet customer withdrawal-intent role. It can reserve/cancel liabilities but has no signing or relay authority. */
export async function grantMoneroWithdrawalRuntime(pool: Pool, role: string,
custodyRuntimeRole = 'custody_runtime', observerRole = 'monero_observer',