fix(token): restrict positional input dedup to canonically built inputs

Index defaults to 0, so two literal-built inputs with no token ID would
silently collapse on a position nobody set. NewInput becomes the
canonical way to build an input and stamps an unexported position-known
marker; UniquePerInput collapses on position only for marked inputs,
while literal-built inputs keep the previous keep-all behavior, locked
by a regression test.

Signed-off-by: Evan <evanyan@sign.global>

Author: EvanYan1024

token/request.go

@@ -908,11 +908,7 @@ func (r *Request) inputs(ctx context.Context, failOnMissing bool) (*InputStream,
 func (r *Request) extractIssueInputs(actionIndex int, metadata *IssueMetadata) ([]*Input, error) {
 	var inputs []*Input
 	for j, input := range metadata.Inputs {
-		inputs = append(inputs, &Input{
-			ActionIndex: actionIndex,
-			Index:       j,
-			Id:          input.TokenID,
-		})
+		inputs = append(inputs, NewInput(actionIndex, j, input.TokenID))
 	}
 
 	return inputs, nil
@@ -939,15 +935,12 @@ func (r *Request) extractTransferInputs(ctx context.Context, actionIndex int, me
 				return nil, errors.Wrapf(err, "failed getting enrollment id and revocation handle [%d,%d]", actionIndex, j)
 			}
 
-			inputs = append(inputs, &Input{
-				ActionIndex:       actionIndex,
-				Index:             j,
-				Id:                metadata.TokenIDAt(j),
-				Owner:             sender.Identity,
-				OwnerAuditInfo:    sender.AuditInfo,
-				EnrollmentID:      eID,
-				RevocationHandler: rID,
-			})
+			in := NewInput(actionIndex, j, metadata.TokenIDAt(j))
+			in.Owner = sender.Identity
+			in.OwnerAuditInfo = sender.AuditInfo
+			in.EnrollmentID = eID
+			in.RevocationHandler = rID
+			inputs = append(inputs, in)
 		}
 	}
 

token/stream.go

@@ -233,7 +233,8 @@ func (o *OutputStream) String() string {
 // Input models an input of a token action
 type Input struct {
 	ActionIndex int
-	// Index is the position of this input within its action
+	// Index is the position of this input within its action; it takes part in
+	// deduplication only on inputs built through NewInput
 	Index             int
 	Id                *token.ID
 	Owner             Identity
@@ -242,6 +243,19 @@ type Input struct {
 	RevocationHandler string
 	Type              token.Type
 	Quantity          token.Quantity
+
+	// positionKnown records that (ActionIndex, Index) was set deliberately —
+	// NewInput stamps it — so UniquePerInput never collapses literal-built
+	// inputs on their zero-valued position
+	positionKnown bool
+}
+
+// NewInput returns an Input positioned within its action. The position stands
+// in for the token ID during deduplication when the metadata has the token ID
+// filtered out (see UniquePerInput), so inputs are built through here; an
+// input built as a literal keeps no position and never collapses on it.
+func NewInput(actionIndex, index int, id *token.ID) *Input {
+	return &Input{ActionIndex: actionIndex, Index: index, Id: id, positionKnown: true}
 }
 
 // InputStream models a stream over a set of inputs (Input).
@@ -398,7 +412,10 @@ func (is *InputStream) ByType(tokenType token.Type) *InputStream {
 // composite owner's members once. The token is identified by its token ID,
 // or by (ActionIndex, Index) when the token ID has been filtered out of the
 // metadata; the two key spaces never mix, since only transfer inputs lose
-// their token ID. Identity consumers use the full stream instead.
+// their token ID. The position counts only for inputs built through NewInput:
+// a literal-built input without a token ID is kept as it stands, never
+// collapsed on a position nobody set. Identity consumers use the full stream
+// instead.
 func (is *InputStream) UniquePerInput() *InputStream {
 	type idKey struct {
 		id  token.ID
@@ -422,6 +439,9 @@ func (is *InputStream) UniquePerInput() *InputStream {
 
 			return true
 		}
+		if !t.positionKnown {
+			return true
+		}
 		k := posKey{actionIndex: t.ActionIndex, index: t.Index, eID: t.EnrollmentID}
 		if seenByPos[k] {
 			return false

token/stream_test.go

@@ -285,6 +285,16 @@ func TestOutputStream_UniquePerOutput(t *testing.T) {
 	}
 }
 
+// extractedInput builds an input the way the request's extraction path does,
+// so its position takes part in deduplication.
+func extractedInput(actionIndex, index int, id *token.ID, eID, rh string) *Input {
+	in := NewInput(actionIndex, index, id)
+	in.EnrollmentID = eID
+	in.RevocationHandler = rh
+
+	return in
+}
+
 func TestInputStream_UniquePerInput(t *testing.T) {
 	cases := []struct {
 		name   string
@@ -324,35 +334,46 @@ func TestInputStream_UniquePerInput(t *testing.T) {
 		{
 			"member rows with a filtered-out token ID collapse on action and input index",
 			[]*Input{
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll1", RevocationHandler: "first"},
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll1", RevocationHandler: "second"},
+				extractedInput(0, 0, nil, "enroll1", "first"),
+				extractedInput(0, 0, nil, "enroll1", "second"),
 			},
-			[]*Input{{ActionIndex: 0, Index: 0, EnrollmentID: "enroll1", RevocationHandler: "first"}},
+			[]*Input{extractedInput(0, 0, nil, "enroll1", "first")},
 		},
 		{
 			"filtered rows with different positions or enrollment IDs all survive",
 			[]*Input{
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll1"},
-				{ActionIndex: 0, Index: 1, EnrollmentID: "enroll1"},
-				{ActionIndex: 1, Index: 0, EnrollmentID: "enroll1"},
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll2"},
+				extractedInput(0, 0, nil, "enroll1", ""),
+				extractedInput(0, 1, nil, "enroll1", ""),
+				extractedInput(1, 0, nil, "enroll1", ""),
+				extractedInput(0, 0, nil, "enroll2", ""),
 			},
 			[]*Input{
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll1"},
-				{ActionIndex: 0, Index: 1, EnrollmentID: "enroll1"},
-				{ActionIndex: 1, Index: 0, EnrollmentID: "enroll1"},
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll2"},
+				extractedInput(0, 0, nil, "enroll1", ""),
+				extractedInput(0, 1, nil, "enroll1", ""),
+				extractedInput(1, 0, nil, "enroll1", ""),
+				extractedInput(0, 0, nil, "enroll2", ""),
 			},
 		},
 		{
 			"a row with a token ID never collides with a positionally identical row without one",
 			[]*Input{
-				{ActionIndex: 0, Index: 0, Id: &token.ID{TxId: "tx0", Index: 0}, EnrollmentID: "enroll1"},
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll1"},
+				extractedInput(0, 0, &token.ID{TxId: "tx0", Index: 0}, "enroll1", ""),
+				extractedInput(0, 0, nil, "enroll1", ""),
+			},
+			[]*Input{
+				extractedInput(0, 0, &token.ID{TxId: "tx0", Index: 0}, "enroll1", ""),
+				extractedInput(0, 0, nil, "enroll1", ""),
+			},
+		},
+		{
+			"literal-built rows with no token ID never collapse on the zero-valued position",
+			[]*Input{
+				{EnrollmentID: "enroll1"},
+				{EnrollmentID: "enroll1"},
 			},
 			[]*Input{
-				{ActionIndex: 0, Index: 0, Id: &token.ID{TxId: "tx0", Index: 0}, EnrollmentID: "enroll1"},
-				{ActionIndex: 0, Index: 0, EnrollmentID: "enroll1"},
+				{EnrollmentID: "enroll1"},
+				{EnrollmentID: "enroll1"},
 			},
 		},
 	}