Add uniqueness constraints for methodology identity (name+version+registry combination)

[Oluwaseyi89]

Summary

Add uniqueness constraints for methodology identity (name+version+registry combination) — methodology_library validates individual field formats but never checks whether a (name, version, registry) triple has already been minted, allowing duplicate methodology tokens for the same identity.

Social Media Link

Let's collaborate on Discord. And ensure to star our repo.

Problem Statement

Confirmed in stellar-core/carbon-asset-factory/contracts/methodology_library/src/lib.rs:

1. mint_methodology validates format only, not uniqueness: validate_metadata (lib.rs:94-146) checks that name, version, registry, and registry_link are non-empty, within length limits, not whitespace-only, semver-formatted, and URL-formatted — it never queries existing Methodology(u32) entries to check whether the same identity already exists.

2. DataKey has no secondary index for identity lookup: lib.rs:56-69 defines Methodology(u32) keyed by token_id only — there is no MethodologyIdentity(name, version, registry) -> token_id mapping to check against before minting.

3. Two different authorities can mint the same (name, version, registry) combination as separate tokens: since mint_methodology (lib.rs:205-237) only checks that caller is in authorities and that meta.issuing_authority == caller, nothing prevents Authority A and Authority B from both minting ("Improved Forest Management", "1.0.0", "VERRA") as two distinct token_ids.

4. update_methodology_metadata can also silently collide with an existing identity: lib.rs:239-268 re-validates format via validate_metadata but does not check whether the new (name, version, registry) after the update now matches some other token's identity.

5. is_valid_methodology and downstream consumers (e.g. carbon_asset's cross-contract validation) have no way to detect duplicate identities: a project referencing methodology by (name, version, registry) off-chain could resolve to more than one on-chain token, creating ambiguity for carbon_asset's methodology_id field on CarbonAssetMetadata.

6. No Error variant exists for a duplicate-identity rejection: Error (lib.rs:9-26) has InvalidName, InvalidVersion, InvalidRegistryLink, InvalidRegistry, MetadataTooLong, etc., but nothing like DuplicateMethodologyIdentity.

7. No test in test.rs exercises minting the same identity twice: existing tests (test_lifecycle, test_validation_*) each mint a single unique methodology per test and never assert rejection of a repeat (name, version, registry) triple.

Required Changes

1. Add DataKey::IdentityIndex(String, String, String) (or a single composed String key) to map a (name, version, registry) triple to its token_id once minted.

2. Add Error::DuplicateMethodologyIdentity to the Error enum in lib.rs.

3. In mint_methodology, after validate_metadata passes and before writing storage, check IdentityIndex for an existing entry with the same (name, version, registry) and return Err(Error::DuplicateMethodologyIdentity) if found.

4. On successful mint, write the new IdentityIndex entry alongside the existing Methodology(token_id), Owner(token_id), and NextTokenId writes.

5. In update_methodology_metadata, if name, version, or registry change, check the IdentityIndex for the new triple (excluding the token being updated) and reject with DuplicateMethodologyIdentity on collision; otherwise remove the old IdentityIndex entry and write the new one.

6. Add get_token_by_identity(env, name: String, version: String, registry: String) -> Option<u32> as a public view function.

7. Add unit tests: minting the same (name, version, registry) twice is rejected; minting with the same name but different version succeeds; updating a methodology's identity fields to collide with another token is rejected; updating a methodology's identity fields to a genuinely new triple succeeds and updates IdentityIndex accordingly.

Acceptance Criteria

1. mint_methodology rejects a second mint with an identical (name, version, registry) triple, regardless of which authorized authority calls it.
2. update_methodology_metadata rejects an update that would create a duplicate identity with another existing token.
3. get_token_by_identity resolves a known (name, version, registry) triple to the correct token_id.
4. Distinct versions of the same methodology name (e.g. "1.0.0" vs "1.0.1") are treated as distinct identities and both succeed.
5. IdentityIndex stays consistent after an update that changes identity fields (old entry removed, new entry added).
6. Existing single-mint tests continue to pass unchanged.
7. Test coverage includes duplicate-mint rejection, distinct-version success, and update-collision rejection.

Directory to Work on:

stellar-core/carbon-asset-factory/