fix(builder): harden keyless contract paths - action guard, utxoRef address check, ?? datums, eval-order and signer pins

packages/builder/test/build-contracts.test.ts

@@ -1,7 +1,7 @@
 // packages/builder/test/build-contracts.test.ts
 import { describe, test, before } from 'node:test';
 import assert from 'node:assert/strict';
-import { CML, applyDoubleCborEncoding, validatorToAddress } from '@lucid-evolution/lucid';
+import { CML, applyDoubleCborEncoding, validatorToAddress, validatorToScriptHash, getAddressDetails } from '@lucid-evolution/lucid';
 import type { LucidEvolution, SpendingValidator, UTxO } from '@lucid-evolution/lucid';
 import { FixtureProvider, FIXTURE_UTXOS, OWN_ADDRESS, FOREIGN_ADDRESS, FIXTURE_TXHASH } from './fixtures/fixture-provider.ts';
 import { lucidForAddress, buildMultiOutput, buildDeployContract, buildInteractContract } from '../src/vector/build.ts';
@@ -42,6 +42,13 @@ describe('buildMultiOutput', () => {
   test('rejects an empty output list', async () => {
     await assert.rejects(() => buildMultiOutput(lucid, { outputs: [] }), /At least one output/);
   });
+
+  test('rejects an invalid recipient address among the outputs', async () => {
+    await assert.rejects(
+      () => buildMultiOutput(lucid, { outputs: [{ address: 'addr1garbage', lovelace: 2_000_000 }] }),
+      /Invalid recipient address/,
+    );
+  });
 });
 
 describe('buildDeployContract', () => {
@@ -50,6 +57,7 @@ describe('buildDeployContract', () => {
       scriptCbor: ALWAYS_SUCCEEDS_V2, scriptType: 'PlutusV2', lovelaceAmount: 2_000_000,
     });
     assert.equal(r.scriptAddress, SCRIPT_ADDRESS);
+    assert.equal(r.scriptHash, validatorToScriptHash(validator));
     const outs = outputsOf(r.txCbor);
     const toScript = outs.find((o) => o.address === SCRIPT_ADDRESS);
     assert.ok(toScript, 'no output to script address');
@@ -71,6 +79,26 @@ describe('buildInteractContract', () => {
     assert.ok(toScript && toScript.lovelace === 2_000_000n);
   });
 
+  test('lock: rejects an empty-string datum instead of silently treating it as void', async () => {
+    // '' is falsy but caller-supplied; ?? must let it flow through and fail
+    // loudly downstream rather than defaulting to Data.void() (locking funds
+    // under a datum the caller never asked for).
+    await assert.rejects(() => buildInteractContract(lucid, {
+      scriptCbor: ALWAYS_SUCCEEDS_V2, scriptType: 'PlutusV2', action: 'lock',
+      changeAddress: OWN_ADDRESS, lovelaceAmount: 2_000_000, datum: '',
+    }));
+  });
+
+  test('rejects an invalid action', async () => {
+    await assert.rejects(
+      () => buildInteractContract(lucid, {
+        scriptCbor: ALWAYS_SUCCEEDS_V2, scriptType: 'PlutusV2', action: 'steal' as any,
+        changeAddress: OWN_ADDRESS, lovelaceAmount: 2_000_000,
+      }),
+      /Invalid action/,
+    );
+  });
+
   test('spend: collects a script UTxO back to the wallet (offline, native eval)', async () => {
     const scriptUtxo: UTxO = {
       txHash: FIXTURE_TXHASH, outputIndex: 7, address: SCRIPT_ADDRESS,
@@ -92,6 +120,36 @@ describe('buildInteractContract', () => {
       if (inp.transaction_id().to_hex() === FIXTURE_TXHASH && Number(inp.index()) === 7) consumedScriptInput = true;
     }
     assert.ok(consumedScriptInput, 'script UTxO was not consumed');
+    // addSigner(changeAddress) must land in the tx body as a required signer,
+    // keyed by the wallet's payment key hash (not the script, not some other key).
+    const requiredSigners = tx.body().required_signers();
+    assert.ok(requiredSigners && requiredSigners.len() > 0, 'no required_signers on the built tx');
+    const signerHashes: string[] = [];
+    for (let i = 0; i < requiredSigners!.len(); i++) signerHashes.push(requiredSigners!.get(i).to_hex());
+    const expectedHash = getAddressDetails(OWN_ADDRESS).paymentCredential?.hash;
+    assert.ok(expectedHash, 'OWN_ADDRESS has no payment credential to compare against');
+    assert.deepEqual(signerHashes, [expectedHash]);
+  });
+
+  test('spend: succeeds via native UPLC eval without ever calling the provider fallback', async () => {
+    const scriptUtxo: UTxO = {
+      txHash: FIXTURE_TXHASH, outputIndex: 7, address: SCRIPT_ADDRESS,
+      assets: { lovelace: 2_000_000n }, datum: 'd87980',
+    };
+    const withScript = new FixtureProvider([...FIXTURE_UTXOS, scriptUtxo]);
+    let evalCalls = 0;
+    (withScript as any).evaluateTx = async () => {
+      evalCalls++;
+      throw new Error('provider evaluateTx should not be reached for a natively-evaluable script');
+    };
+    const l = await lucidForAddress(withScript, OWN_ADDRESS);
+    await buildInteractContract(l, {
+      scriptCbor: ALWAYS_SUCCEEDS_V2, scriptType: 'PlutusV2', action: 'spend',
+      changeAddress: OWN_ADDRESS, redeemer: 'd87980',
+    });
+    // pins the ordering: native eval must succeed on its own; the catch-block
+    // fallback to the provider's evaluateTx must stay unreached here.
+    assert.equal(evalCalls, 0, 'native UPLC evaluator should have succeeded without a provider fallback');
   });
 
   test('spend: refuses when the script address holds nothing', async () => {
@@ -103,4 +161,15 @@ describe('buildInteractContract', () => {
       /No UTxOs found at script address/,
     );
   });
+
+  test('spend: refuses a utxoRef that does not point at the script address', async () => {
+    await assert.rejects(
+      () => buildInteractContract(lucid, {
+        scriptCbor: ALWAYS_SUCCEEDS_V2, scriptType: 'PlutusV2', action: 'spend',
+        changeAddress: OWN_ADDRESS, redeemer: 'd87980',
+        utxoRef: { txHash: FIXTURE_TXHASH, outputIndex: 0 }, // a real wallet UTxO, not at SCRIPT_ADDRESS
+      }),
+      /not at script address/,
+    );
+  });
 });