fix(auditor): attribute empty-EID inputs to their own token owner

completeInputsWithEmptyEID booked every input with an unresolved
enrollment ID under the first output's enrollment ID -- for a payment
that is the recipient, so the payer's whole input was recorded as spent
by the counterparty and both parties' eid-keyed audit balances corrupt
silently.

Resolve the enrollment ID (and revocation handle) from the input token's
owner instead, preferring the audit info already carried by the record
over the local identity store: WalletManager gains GetEIDAndRH taking
explicit audit info, falling back to the stored one when empty. An owner
that maps to no single enrollment ID -- a composite owner such as a
multisig, or one whose audit info this auditor does not hold -- leaves
its input unattributed. Amount aggregations skip an empty enrollment ID,
so an unattributed input is counted for nobody, whereas a guessed one is
charged to the wrong party.

A token upgrade is the exception: across the built-in drivers its issue
metadata describes no sender for the inputs, and the pre-upgrade owner
predates the current driver, so it resolves to nothing here. The upgrade re-issues the spent tokens to
the same party, so such an input takes the enrollment ID of the outputs
issued by its own action, when every one of them resolves to the same
party; the revocation handle comes from the same output. Leaving it
unattributed would credit the upgraded amount without ever debiting it
and double the owner's holding.

Run the gap filling in Audit, before the enrollment IDs are collected,
so the locks cover the enrollment ID each input is finally booked under,
and return a cached record from Append as it stands. Re-filling there
could attribute an input Audit deliberately left empty, storing it under
an enrollment ID that was never locked; Append still attributes the
record when called without a preceding Audit.

Guard the vault result the way Request.AuditRecord does, with a length
check and a nil check per token: the gap filling now runs on the audit
approval path, where indexing past a short answer would panic.

Fixes #2198

Signed-off-by: Evan <evanyan@sign.global>

Author: EvanYan1024

docs/services/auditor.md

@@ -52,6 +52,21 @@ Auditors use specialized wallets (Auditor Wallets) managed by the **Identity Ser
 
 The service provides the `AuditApproveView`, which auditors use to respond to incoming audit requests. This view automates the verification and signing process, ensuring that the auditor only approves transactions that are fully compliant with the system's public parameters.
 
+## Input Attribution
+
+An audit record pairs every input and output with an enrollment ID. Inputs do not always carry one, so those left empty are resolved before the record is stored; the rest are untouched.
+
+Each such input is resolved from its own spent token:
+
+1. The spent token is read from the vault, yielding its owner, type, and quantity.
+2. The owner is resolved to an enrollment ID and revocation handle through `WalletManager.GetEIDAndRH`, preferring the audit info carried by the record over the locally stored one — a counterparty's audit info is not necessarily present locally.
+
+Across the built-in drivers, a **token upgrade** is the action whose metadata describes no sender for its inputs, and whose pre-upgrade owner often resolves to nothing: that identity predates the current driver and the request carries no audit info for it. Since an upgrade re-issues the spent tokens to the same party under a fresh identity, such an input takes the enrollment ID of the outputs issued by **its own action**, when every one of them resolves to the same party. The revocation handle comes from the same output, and is dropped when the outputs carry more than one. Without this the upgraded amount would be credited to the owner without ever being debited, doubling the holding.
+
+An owner that maps to no single enrollment ID — a composite owner such as a multisig, or one whose audit info is not available to this auditor — leaves its input **unattributed**, with an empty enrollment ID. Amount aggregations skip empty enrollment IDs, so an unattributed input is counted for nobody. Guessing instead, for instance from the first output, would in a payment attribute the payer's spending to the recipient and silently corrupt both balances.
+
+Attribution runs in `Audit`, before the enrollment IDs are collected, so the EID locking described below covers the enrollment ID each input is finally booked under. `Append` reuses the record `Audit` attributed and stores it as it stands; it attributes the record itself only when called without a preceding `Audit`. An input left unattributed by `Audit` therefore stays unattributed, and no enrollment ID outside the locked set can reach the store.
+
 ## Distributed EID Locking
 
 When multiple auditor replicas share the same AuditDB (PostgreSQL), concurrent processing of the same enrollment IDs (EIDs) must be serialized. The **auditor locker** (`token/services/storage/auditdb/locker`) coordinates exclusive access to EIDs during audit record writes.

token/services/auditor/auditor.go

@@ -159,7 +159,9 @@ func (a *Service) Audit(ctx context.Context, tx Transaction) (*token.InputStream
 	start := time.Now()
 	logger.DebugfContext(ctx, "audit transaction [%s]....", tx.ID())
 	request := tx.Request()
-	record, err := request.AuditRecord(ctx)
+	// the record is completed before the enrollment IDs are collected, so that
+	// the locks cover the enrollment ID every input is finally booked under
+	record, err := newRequestWrapper(request, request.TokenService).AuditRecord(ctx)
 	if err != nil {
 		return nil, nil, errors.WithMessagef(err, "failed getting transaction audit record")
 	}
@@ -395,16 +397,19 @@ func (r *requestWrapper) PublicParamsHash() token.PPHash { return r.r.PublicPara
 
 // AuditRecord retrieves the audit record for the wrapped token request and completes any
 // inputs with missing enrollment IDs by querying the token vault.
-// The gap filling always runs, also on a cached record, because it depends on
-// the current vault state.
+// A record cached by Audit is returned as it stands: it was already attributed
+// there, and the locks were taken for the enrollment IDs it carries.
 func (r *requestWrapper) AuditRecord(ctx context.Context) (*token.AuditRecord, error) {
-	record := r.cached
-	if record == nil {
-		var err error
-		record, err = r.r.AuditRecord(ctx)
-		if err != nil {
-			return nil, err
-		}
+	// re-running the gap filling on a cached record could attribute an input
+	// Audit deliberately left empty, booking it under an enrollment ID that
+	// was never locked
+	if r.cached != nil {
+		return r.cached, nil
+	}
+
+	record, err := r.r.AuditRecord(ctx)
+	if err != nil {
+		return nil, err
 	}
 	if err := r.completeInputsWithEmptyEID(ctx, record); err != nil {
 		return nil, errors.WithMessagef(err, "failed filling gaps for request [%s]", r.r.Anchor)
@@ -415,36 +420,102 @@ func (r *requestWrapper) AuditRecord(ctx context.Context) (*token.AuditRecord, e
 
 // completeInputsWithEmptyEID fills in missing enrollment ID information for inputs in the audit record
 // by querying the token vault. This is necessary when inputs don't have enrollment IDs explicitly set.
-// It uses the first output's enrollment ID as the target and retrieves token details from the vault.
+// Each input is attributed to the enrollment ID resolved from its own token
+// owner and the audit info carried by the record (falling back to the locally
+// stored audit info). An input the request describes no sender for is an upgrade
+// input, and falls back to the enrollment ID the request issues to. An owner that
+// maps to no single enrollment ID leaves its input unattributed rather than booked
+// under a guessed enrollment ID, so a record keeping such an input is not fully
+// attributed on return.
 func (r *requestWrapper) completeInputsWithEmptyEID(ctx context.Context, record *token.AuditRecord) error {
 	filter := record.Inputs.ByEnrollmentID("")
 	if filter.Count() == 0 {
 		return nil
 	}
-	// TODO: extract from the audit tokens
-	targetEID := record.Outputs.EnrollmentIDs()[0]
 
 	// fetch all the tokens
 	tokens, err := r.tms.Vault().NewQueryEngine().ListAuditTokens(ctx, filter.IDs()...)
 	if err != nil {
 		return errors.WithMessagef(err, "failed listing tokens for [%s]", filter.IDs())
 	}
+	if filter.Count() != len(tokens) {
+		return errors.Errorf("expected %d audit tokens, got %d", filter.Count(), len(tokens))
+	}
 	precision := r.tms.PublicParametersManager().PublicParameters().Precision()
+	wm := r.tms.WalletManager()
 	for i := range filter.Count() {
 		item := filter.At(i)
-		item.EnrollmentID = targetEID
+		if tokens[i] == nil {
+			return errors.Errorf("failed to audit inputs: nil input at [%d]th input", i)
+		}
+		// an input the request describes no sender for: extractIssueInputs fills
+		// only the token id, so across the built-in drivers this is an upgrade
+		upgraded := len(item.Owner) == 0
+
 		item.Owner = tokens[i].Owner
 		item.Type = tokens[i].Type
 		q, err := token2.ToQuantity(tokens[i].Quantity, precision)
 		if err != nil {
 			return errors.WithMessagef(err, "failed converting token quantity [%s]", tokens[i].Quantity)
 		}
 		item.Quantity = q
+
+		eID, rID, err := wm.GetEIDAndRH(ctx, item.Owner, item.OwnerAuditInfo)
+		if err != nil {
+			return errors.WithMessagef(err, "failed resolving enrollment id for input [%v]", item.Id)
+		}
+		if eID == "" && upgraded {
+			// an upgrade re-issues the spent tokens to their owner under a fresh
+			// identity, so the outputs of the very same action carry the
+			// enrollment ID the input belongs to. The pre-upgrade identity
+			// itself often resolves to nothing here: it predates the current
+			// driver and the request metadata carries no audit info for it.
+			eID, rID = issuedToEIDAndRH(record.Outputs, item.ActionIndex)
+		}
+		if eID == "" {
+			// the owner maps to no single enrollment ID — a composite owner,
+			// or one whose audit info is unavailable. Leave the input
+			// unattributed: amount aggregations skip an empty enrollment ID,
+			// whereas a guessed one would be charged to the wrong party.
+			continue
+		}
+		item.EnrollmentID = eID
+		item.RevocationHandler = rID
 	}
 
 	return nil
 }
 
+// issuedToEIDAndRH returns the enrollment ID and revocation handle the given issue
+// action issues to, and empty values when it does not issue to exactly one party.
+// An issued output carries both an issuer and an owner; a redeem output carries an
+// issuer but no owner. Every issued output of the action must resolve to the same
+// enrollment ID: one resolving to none cannot be shown to belong to the same party
+// as the others. The handle is kept only while it stays paired with that ID.
+func issuedToEIDAndRH(outputs *token.OutputStream, actionIndex int) (string, string) {
+	issued := outputs.Filter(func(o *token.Output) bool {
+		return o.ActionIndex == actionIndex && len(o.Issuer) != 0 && len(o.Owner) != 0
+	}).Outputs()
+	if len(issued) == 0 {
+		return "", ""
+	}
+
+	eID, rH := issued[0].EnrollmentID, issued[0].RevocationHandler
+	if eID == "" {
+		return "", ""
+	}
+	for _, output := range issued[1:] {
+		if output.EnrollmentID != eID {
+			return "", ""
+		}
+		if output.RevocationHandler != rH {
+			rH = ""
+		}
+	}
+
+	return eID, rH
+}
+
 // String returns a string representation of the wrapped token request.
 func (r *requestWrapper) String() string {
 	return r.r.String()