fix(platform): bind token group authorization by QuantumExplorer · Pull Request #4154 · dashpay/platform

QuantumExplorer · 2026-07-20T14:24:43Z

Issue being fixed or feature implemented

Keeps grouped token actions and configuration updates bound to their approved scope and current authority. Covers internal review items 115 and 241-248.

What was done?

Bound group confirmations to the contract and token position recorded by the proposal.
Made unresolved main-group authorization fail closed.
Required configuration actions to use the group selected by the current control rule.
Validated the full prospective token configuration before persistence.
Covered every change-control rule family, including direct-purchase pricing.
Activated the consensus behavior through protocol version 13 while preserving version 12 behavior.

How Has This Been Tested?

172 DPP token-configuration tests.
All 16 Drive token configuration-update tests.
All 15 Drive group-mint authorization tests.
Stateful regressions for cross-token confirmation, required main-group preservation, and configured-quorum enforcement.
Protocol-version activation regression covering v12 and v13.
Strict Clippy for the affected library targets and workspace formatting.

The all-target Clippy run also reaches an unrelated pre-existing DPP factory test warning; the affected library targets are clean with warnings denied.

Breaking Changes

Consensus validation changes activate with protocol version 13. Protocol version 12 retains its existing behavior.

Checklist:

I have performed a self-review of my own code.
I have added tests that prove my fix is effective.
New and existing targeted tests pass locally.
I have preserved legacy behavior before the activation version.
I have run formatting and strict lint checks for the affected libraries.

Summary by CodeRabbit

New Features
- Added controlling action-taker authorization for token configuration changes, including main-group handling.
- Introduced platform v1 token configuration group existence validation with detailed missing-group errors.
- Enabled stricter token base/config update/group-action validation for newer protocol versions.
Bug Fixes
- Rejects unauthorized token configuration updates and substitute group attempts.
- Prevents confirmed mint actions from changing group action main parameters.
- Ensures failed config updates preserve required main-group state and do not unset valid fields.
Tests
- Expanded validation, authorization, and regression coverage for the above scenarios.

coderabbitai · 2026-07-20T14:24:58Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 856c073f-d786-493c-a19d-80191903dcda

📥 Commits

Reviewing files that changed from the base of the PR and between 322c835 and 706f167.

📒 Files selected for processing (2)

packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/validate_token_configuration_groups_exist/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_base_transition_action/state_v1/mod.rs

🚧 Files skipped from review as they are similar to previous changes (2)

packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/validate_token_configuration_groups_exist/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_base_transition_action/state_v1/mod.rs

📝 Walkthrough

Walkthrough

Changes

Token authorization hardening

Layer / File(s)	Summary
DPP authority and group validation `packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/...`	Adds controlling action-taker resolution and V1 validation for missing group positions and undefined main groups.
Base transition validation `packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/...`, `packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/mint/mod.rs`	Adds V1 checks preventing group-action parameter changes and unauthorized main-group substitutions.
Configuration update validation `packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_config_update_transition_action/...`, `packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/config_update/mod.rs`	Binds configuration updates to expected controlling groups, validates proposed group references, and adds regression coverage.
Platform v13 activation `packages/rs-platform-version/src/version/...`	Adds DPP validation v4 and enables token authorization validators for platform v13 while preserving disabled settings in v12.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant TokenConfigUpdateTransitionAction
  participant TokenConfiguration
  participant GroupStore
  participant TokenConfigurationValidator
  TokenConfigUpdateTransitionAction->>TokenConfiguration: resolve controlling action takers
  TokenConfigUpdateTransitionAction->>GroupStore: resolve stored transition group
  TokenConfigUpdateTransitionAction->>TokenConfigurationValidator: validate proposed configuration groups
  TokenConfigurationValidator-->>TokenConfigUpdateTransitionAction: return validation result

Suggested reviewers: shumkov, llbartekll, zocolini

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 61.11% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change: binding token group authorization to approved scope and current authority.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/fix-token-group-authorization

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

thepastaclaw · 2026-07-21T02:06:22Z

🕓 Ready for review — 38 ahead in queue (commit 706f167)
Queue position: 39/72 · 2 reviews active
ETA: start ~04:50 UTC · complete ~05:18 UTC (median 28m across 30 recent reviews; 2 slots)
Queued 12h 36m ago · Last checked: 2026-07-22 19:40 UTC

…roup-authorization # Conflicts: # packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v9.rs # packages/rs-platform-version/src/version/v13.rs

codecov · 2026-07-22T00:36:16Z

Codecov Report

❌ Patch coverage is 95.04950% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.50%. Comparing base (a542cba) to head (706f167).
⚠️ Report is 43 commits behind head on v4.1-dev.

Files with missing lines	Patch %	Lines
...token/token_base_transition_action/state_v1/mod.rs	91.45%	10 Missing ⚠️
...lidation/token/token_base_transition_action/mod.rs	88.23%	2 Missing ⚠️
...s/validate_token_configuration_groups_exist/mod.rs	50.00%	1 Missing ⚠️
...token/token_config_update_transition_action/mod.rs	87.50%	1 Missing ⚠️
...en_config_update_transition_action/state_v1/mod.rs	98.59%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           v4.1-dev    #4154      +/-   ##
============================================
+ Coverage     87.46%   87.50%   +0.03%     
============================================
  Files          2651     2666      +15     
  Lines        334868   336713    +1845     
============================================
+ Hits         292905   294653    +1748     
- Misses        41963    42060      +97

Components	Coverage Δ
dpp	`88.47% <98.88%> (+0.03%)`	⬆️
drive	`86.24% <ø> (+0.08%)`	⬆️
drive-abci	`89.56% <82.35%> (-0.03%)`	⬇️
sdk	`∅ <ø> (∅)`
dapi-client	`∅ <ø> (∅)`
platform-version	`∅ <ø> (∅)`
platform-value	`92.90% <ø> (ø)`
platform-wallet	`∅ <ø> (∅)`
drive-proof-verifier	`49.79% <ø> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/validate_token_configuration_groups_exist/mod.rs (1)
44-47: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Docstring is now stale.

The doc comment above (# Versioning section) still states this method only "Currently supports validate_token_config_groups_exist_v0 for version 0", but the dispatch now also routes to validate_token_config_groups_exist_v1. Please update the doc to mention v1.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/validate_token_configuration_groups_exist/mod.rs`
around lines 44 - 47, Update the # Versioning section of
validate_token_config_groups_exist to document support for both
validate_token_config_groups_exist_v0 (version 0) and
validate_token_config_groups_exist_v1 (version 1), matching the dispatch in the
method.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_base_transition_action/state_v1/mod.rs`:
- Around line 88-109: In the validation block using
ModificationOfGroupActionMainParametersNotPermittedError::new, replace the
second event-name argument with the current base-transition action’s distinct
descriptor, while retaining original_group_action.event().event_name() as the
original label and preserving changed_fields.

---

Nitpick comments:
In
`@packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/validate_token_configuration_groups_exist/mod.rs`:
- Around line 44-47: Update the # Versioning section of
validate_token_config_groups_exist to document support for both
validate_token_config_groups_exist_v0 (version 0) and
validate_token_config_groups_exist_v1 (version 1), matching the dispatch in the
method.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b7c3eb63-05b6-4d0f-958f-842c2e28c3f7

📥 Commits

Reviewing files that changed from the base of the PR and between f54cdcb and 322c835.

📒 Files selected for processing (14)

packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/authorized_action_takers_for_configuration_item/mod.rs
packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/authorized_action_takers_for_configuration_item/v0/mod.rs
packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/validate_token_configuration_groups_exist/mod.rs
packages/rs-dpp/src/data_contract/associated_token/token_configuration/methods/validate_token_configuration_groups_exist/v1/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_base_transition_action/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_base_transition_action/state_v1/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_config_update_transition_action/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/action_validation/token/token_config_update_transition_action/state_v1/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/config_update/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/mint/mod.rs
packages/rs-platform-version/src/version/dpp_versions/dpp_validation_versions/mod.rs
packages/rs-platform-version/src/version/dpp_versions/dpp_validation_versions/v4.rs
packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v9.rs
packages/rs-platform-version/src/version/v13.rs

…nd error The base-field mismatch error passed the original event name for both the original and modified slots, so the message never said where the confirming transition tried to rebind the action. Include the current contract id and token position in the modified slot. Also update the groups-exist dispatcher docstring to cover v1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

QuantumExplorer

Reviewed

fix(platform): bind token group authorization

7b7294e

github-actions Bot added this to the v4.1.0 milestone Jul 20, 2026

QuantumExplorer marked this pull request as ready for review July 21, 2026 02:04

QuantumExplorer added 7 commits July 22, 2026 03:50

Merge remote-tracking branch 'origin/v4.1-dev' into codex/fix-token-g…

2cb056e

…roup-authorization # Conflicts: # packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v9.rs # packages/rs-platform-version/src/version/v13.rs

style(jni): format transaction decoder

c566254

ci(kotlin): submit emulator unlock credential

21f33cb

ci(kotlin): retry emulator credential unlock

4cc0a11

ci(rust): tolerate transient coverage cleanup races

81e537e

ci(rust): allow cold macOS workspace builds to finish

593b513

ci(rust): cover shielded tests in macOS timeout

6074b24

fix(swift-sdk): set CI keychain in user domain

0e55d80

QuantumExplorer requested review from ZocoLini, llbartekll and shumkov as code owners July 22, 2026 01:01

Merge branch 'v4.1-dev' into codex/fix-token-group-authorization

322c835

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread ...state_transitions/batch/action_validation/token/token_base_transition_action/state_v1/mod.rs

QuantumExplorer commented Jul 22, 2026

View reviewed changes

QuantumExplorer merged commit 470d445 into v4.1-dev Jul 22, 2026
40 checks passed

QuantumExplorer deleted the codex/fix-token-group-authorization branch July 22, 2026 07:30

This was referenced Jul 23, 2026

fix(drive-abci): report configured main control group authority when unauthorized #4000

Closed

fix(drive-abci): report configured main control group authority when unauthorized #4209

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(platform): bind token group authorization#4154

fix(platform): bind token group authorization#4154
QuantumExplorer merged 11 commits into
v4.1-devfrom
codex/fix-token-group-authorization

QuantumExplorer commented Jul 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

thepastaclaw commented Jul 21, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

QuantumExplorer left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

QuantumExplorer commented Jul 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue being fixed or feature implemented

What was done?

How Has This Been Tested?

Breaking Changes

Checklist:

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

thepastaclaw commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

QuantumExplorer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

QuantumExplorer commented Jul 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

thepastaclaw commented Jul 21, 2026 •

edited

Loading

codecov Bot commented Jul 22, 2026 •

edited

Loading