fix(auditor): attribute empty-EID inputs to their token owner, fail closed

completeInputsWithEmptyEID booked every input with an unresolved
enrollment ID under the first output's enrollment ID -- for a payment
that is the recipient, so the payer's whole input was recorded as spent
by the counterparty and both parties' eid-keyed audit balances corrupt
silently.

Resolve the enrollment ID (and revocation handle) from the input token's
owner instead, preferring the audit info already carried by the record
over the local identity store: WalletManager gains GetEIDAndRH taking
explicit audit info, falling back to the stored one when empty. Fail the
audit record when an input cannot be attributed -- a loud gap is
strictly better than silently corrupting the counterparty's balance.

Run the gap filling in Audit, before the enrollment IDs are collected,
so the locks cover the enrollment ID each input is finally booked under.
Append keeps its call as a fallback for callers that skip Audit; on an
already attributed record it returns immediately, leaving the number of
vault reads unchanged.

Fixes #2198

Signed-off-by: Evan <evanyan@sign.global>

Author: EvanYan1024

docs/services/auditor.md

@@ -52,6 +52,19 @@ Auditors use specialized wallets (Auditor Wallets) managed by the **Identity Ser
 
 The service provides the `AuditApproveView`, which auditors use to respond to incoming audit requests. This view automates the verification and signing process, ensuring that the auditor only approves transactions that are fully compliant with the system's public parameters.
 
+## Input Attribution
+
+An audit record pairs every input and output with an enrollment ID. Inputs do not always carry one, so those left empty are resolved before the record is stored; the rest are untouched.
+
+Each such input is resolved from its own spent token:
+
+1. The spent token is read from the vault, yielding its owner, type, and quantity.
+2. The owner is resolved to an enrollment ID and revocation handle through `WalletManager.GetEIDAndRH`, preferring the audit info carried by the record over the locally stored one — a counterparty's audit info is not necessarily present locally.
+
+An input that cannot be attributed **fails the whole audit record**. Guessing, for instance from the first output, would attribute a payer's spending to the recipient and silently corrupt both balances.
+
+Attribution runs in `Audit`, before the enrollment IDs are collected, so the EID locking described below covers the enrollment ID each input is finally booked under. `Append` repeats it for callers that skip `Audit`; on an already attributed record it is a no-op.
+
 ## Distributed EID Locking
 
 When multiple auditor replicas share the same AuditDB (PostgreSQL), concurrent processing of the same enrollment IDs (EIDs) must be serialized. The **auditor locker** (`token/services/storage/auditdb/locker`) coordinates exclusive access to EIDs during audit record writes.

token/services/auditor/auditor.go

@@ -159,7 +159,9 @@ func (a *Service) Audit(ctx context.Context, tx Transaction) (*token.InputStream
 	start := time.Now()
 	logger.DebugfContext(ctx, "audit transaction [%s]....", tx.ID())
 	request := tx.Request()
-	record, err := request.AuditRecord(ctx)
+	// the record is completed before the enrollment IDs are collected, so that
+	// the locks cover the enrollment ID every input is finally booked under
+	record, err := newRequestWrapper(request, request.TokenService).AuditRecord(ctx)
 	if err != nil {
 		return nil, nil, errors.WithMessagef(err, "failed getting transaction audit record")
 	}
@@ -415,31 +417,42 @@ func (r *requestWrapper) AuditRecord(ctx context.Context) (*token.AuditRecord, e
 
 // completeInputsWithEmptyEID fills in missing enrollment ID information for inputs in the audit record
 // by querying the token vault. This is necessary when inputs don't have enrollment IDs explicitly set.
-// It uses the first output's enrollment ID as the target and retrieves token details from the vault.
+// Each input is attributed to the enrollment ID resolved from its own token
+// owner and the audit info carried by the record (falling back to the locally
+// stored audit info); an input that cannot be attributed fails the audit
+// record instead of being booked under a guessed enrollment ID.
 func (r *requestWrapper) completeInputsWithEmptyEID(ctx context.Context, record *token.AuditRecord) error {
 	filter := record.Inputs.ByEnrollmentID("")
 	if filter.Count() == 0 {
 		return nil
 	}
-	// TODO: extract from the audit tokens
-	targetEID := record.Outputs.EnrollmentIDs()[0]
 
 	// fetch all the tokens
 	tokens, err := r.tms.Vault().NewQueryEngine().ListAuditTokens(ctx, filter.IDs()...)
 	if err != nil {
 		return errors.WithMessagef(err, "failed listing tokens for [%s]", filter.IDs())
 	}
 	precision := r.tms.PublicParametersManager().PublicParameters().Precision()
+	wm := r.tms.WalletManager()
 	for i := range filter.Count() {
 		item := filter.At(i)
-		item.EnrollmentID = targetEID
 		item.Owner = tokens[i].Owner
 		item.Type = tokens[i].Type
 		q, err := token2.ToQuantity(tokens[i].Quantity, precision)
 		if err != nil {
 			return errors.WithMessagef(err, "failed converting token quantity [%s]", tokens[i].Quantity)
 		}
 		item.Quantity = q
+
+		eID, rID, err := wm.GetEIDAndRH(ctx, item.Owner, item.OwnerAuditInfo)
+		if err != nil {
+			return errors.WithMessagef(err, "failed resolving enrollment id for input [%v]", item.Id)
+		}
+		if eID == "" {
+			return errors.Errorf("cannot attribute input [%v] to an enrollment ID", item.Id)
+		}
+		item.EnrollmentID = eID
+		item.RevocationHandler = rID
 	}
 
 	return nil