fix(network): narrow distinctness godoc and surface failing MSP in error

selectDistinctForMSPSet now returns ([]view.Identity, string, bool):
the string carries the first MSP ID whose pool was exhausted, so the
caller can include it in the error message. The error now reads:

  MSP [Org1MSP] requires 2 distinct endorser(s) but only 1 configured

making operator configuration errors immediately diagnosable.

The SelectEndorsersForMSPSets godoc now says "distinct by identity
bytes" rather than just "distinct", to match what the code actually
enforces (byte equality) and distinguish it from the key-equality check
in endorserForThresholdRule.

The existing test for the unsatisfiable single-endorser case gains three
new assertions to pin the MSP name and counts in the error text.

All 14 subtests pass; make checks is clean on the affected files.

Signed-off-by: Akram Bitar <akram@il.ibm.com>
Signed-off-by: AkramBitar <akram@il.ibm.com>
Signed-off-by: Hayim.Shaul@ibm.com <hayimsha@fhe03.vpc.cloud9.ibm.com>

Author: AkramBitar

token/services/network/fabric/endorsement/fsc/selection.go

@@ -22,17 +22,17 @@ import (
 // A candidate set may list the same MSP ID more than once: a policy such as
 // AND(Org1MSP.member, Org1MSP.member) requires that many *distinct* signers from that MSP,
 // which is exactly the property protecting against a single misbehaving endorser within the
-// organization. Every returned identity is therefore distinct: a slot is never filled with
-// an identity already selected for an earlier slot of the same set, and duplicate entries in
-// configured collapse to a single candidate endorser. The result always has exactly as many
-// elements as the chosen candidate set.
+// organization. Every returned identity is therefore distinct by identity bytes: a slot is
+// never filled with an identity already selected for an earlier slot of the same set, and
+// duplicate entries in configured collapse to a single candidate endorser. The result always
+// has exactly as many elements as the chosen candidate set.
 //
 // A candidate set requiring more distinct signers from an MSP than there are distinct
 // configured endorsers in it cannot be satisfied and is skipped, like one naming an MSP with
 // no configured endorser at all.
 //
 // It returns an error if none of the candidate sets can be fully covered by distinct
-// configured endorsers.
+// configured endorsers. The error names the first MSP that blocked each candidate set.
 func SelectEndorsersForMSPSets(configured []view.Identity, mspOf func(view.Identity) (string, error), candidates [][]string) ([]view.Identity, error) {
 	if len(candidates) == 0 {
 		return nil, errors.Errorf("no candidate MSP set to satisfy the namespace endorsement policy")
@@ -58,27 +58,41 @@ func SelectEndorsersForMSPSets(configured []view.Identity, mspOf func(view.Ident
 		byMSP[mspID] = append(byMSP[mspID], id)
 	}
 
+	var setFailures []error
 	for _, idx := range rand.Perm(len(candidates)) {
-		if selected, ok := selectDistinctForMSPSet(byMSP, candidates[idx]); ok {
+		selected, failedMSP, ok := selectDistinctForMSPSet(byMSP, candidates[idx])
+		if ok {
 			return selected, nil
 		}
+		required := 0
+		for _, id := range candidates[idx] {
+			if id == failedMSP {
+				required++
+			}
+		}
+		available := len(byMSP[failedMSP])
+		setFailures = append(setFailures, errors.Errorf("MSP [%s] requires %d distinct endorser(s) but only %d configured", failedMSP, required, available))
 	}
 
-	return nil, errors.Join(errors.Errorf("no configured endorser covers any of the [%d] policy-satisfying MSP set(s) with a distinct endorser per required signer", len(candidates)),
+	return nil, errors.Join(
+		errors.Errorf("no configured endorser covers any of the [%d] policy-satisfying MSP set(s) with a distinct endorser per required signer", len(candidates)),
+		errors.Join(setFailures...),
 		errors.Join(skipped...),
-		errors.Errorf("failed to resolve MSP"))
+		errors.Errorf("failed to resolve MSP"),
+	)
 }
 
 // selectDistinctForMSPSet fills one slot per entry of requiredMSPIDs with a random
 // configured endorser of that MSP, never reusing an identity already selected for an
-// earlier slot of the same set. It returns ok=false if some slot cannot be filled with a
-// still-unused endorser, meaning the set is not coverable by distinct endorsers.
+// earlier slot of the same set. It returns (selected, "", true) on success, or
+// (nil, failedMSP, false) where failedMSP is the first MSP ID whose pool was exhausted,
+// meaning the set is not coverable by distinct endorsers.
 //
 // A greedy per-slot pick is complete here: every slot requiring a given MSP ID draws from
 // the same pool, so the only way this fails is that some MSP ID appears in requiredMSPIDs
-// more times than that MSP has distinct configured endorsers - genuinely unsatisfiable
+// more times than that MSP has distinct configured endorsers — genuinely unsatisfiable
 // whatever the order of the picks. No backtracking is needed.
-func selectDistinctForMSPSet(byMSP map[string][]view.Identity, requiredMSPIDs []string) ([]view.Identity, bool) {
+func selectDistinctForMSPSet(byMSP map[string][]view.Identity, requiredMSPIDs []string) ([]view.Identity, string, bool) {
 	used := make(map[string]struct{}, len(requiredMSPIDs))
 	selected := make([]view.Identity, 0, len(requiredMSPIDs))
 	for _, mspID := range requiredMSPIDs {
@@ -90,12 +104,12 @@ func selectDistinctForMSPSet(byMSP map[string][]view.Identity, requiredMSPIDs []
 			}
 		}
 		if len(available) == 0 {
-			return nil, false
+			return nil, mspID, false
 		}
 		id := available[rand.Intn(len(available))]
 		used[string(id)] = struct{}{}
 		selected = append(selected, id)
 	}
 
-	return selected, true
+	return selected, "", true
 }

token/services/network/fabric/endorsement/fsc/selection_test.go

@@ -152,6 +152,10 @@ func TestSelectEndorsersForMSPSets(t *testing.T) {
 
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "no configured endorser covers")
+		// Error must name the short MSP and its required-vs-available counts.
+		assert.Contains(t, err.Error(), "Org1MSP")
+		assert.Contains(t, err.Error(), "requires 2")
+		assert.Contains(t, err.Error(), "only 1 configured")
 	})
 
 	t.Run("candidate not coverable by distinct endorsers falls through to the next one", func(t *testing.T) {