fix(token): keep request-carried audit info when the local lookup is empty

Request.AuditRecord overwrote the owner audit info of every input with the
result of a local wallet service lookup. The wallet service only knows the
identities registered on this node and returns nil for the others, so an
auditor that never registered the owner lost the audit info the request
metadata already carried.

x509 owners never surfaced this: their enrollment ID is resolved from the
metadata audit info earlier, in extractTransferInputs, and kept in a separate
field. Owners whose audit info cannot be recomputed from the identity itself,
such as boolpolicy identities with idemix members, have no such fallback and
fail the audit with an empty audit info.

Keep the local result when it is non-empty and fall back to what the request
carries otherwise.

Signed-off-by: Evan <evanyan@sign.global>

Author: EvanYan1024

token/request.go

@@ -1470,7 +1470,12 @@ func (r *Request) AuditRecord(ctx context.Context) (*AuditRecord, error) {
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed getting audit info for owner [%s]", toks[i].Owner)
 		}
-		in.OwnerAuditInfo = ownerAuditInfo
+		// The wallet service only knows the identities registered on this node
+		// and returns nil for the others, so keep the audit info the request
+		// metadata already carries when the local lookup finds nothing.
+		if len(ownerAuditInfo) != 0 {
+			in.OwnerAuditInfo = ownerAuditInfo
+		}
 	}
 
 	return &AuditRecord{

token/request_test.go

@@ -1105,3 +1105,89 @@ func TestRequest_PublicParamsHash(t *testing.T) {
 	hash := r.PublicParamsHash()
 	assert.Equal(t, expectedHash, hash)
 }
+
+// TestRequest_AuditRecord_OwnerAuditInfo checks how AuditRecord fills the audit
+// info of an input: the local wallet service wins when it knows the owner, and
+// the audit info carried by the request metadata survives when it does not.
+func TestRequest_AuditRecord_OwnerAuditInfo(t *testing.T) {
+	ctx := t.Context()
+	owner := Identity("owner1")
+	metadataAuditInfo := []byte("audit-info-from-metadata")
+
+	newRequest := func(localAuditInfo []byte) *Request {
+		// A transfer with one input and no output: AuditRecord only reads back
+		// the inputs, and no output keeps the action deobfuscation out of play.
+		transferAction := &driver2.TransferAction{}
+		transferAction.NumInputsReturns(1)
+		transferAction.NumOutputsReturns(0)
+
+		transferService := &driver2.TransferService{}
+		transferService.DeserializeTransferActionReturns(transferAction, nil)
+
+		walletService := &driver2.WalletService{}
+		walletService.GetAuditInfoReturns(localAuditInfo, nil)
+
+		pp := &driver2.PublicParameters{}
+		pp.PrecisionReturns(64)
+		ppm := &driver2.PublicParamsManager{}
+		ppm.PublicParametersReturns(pp)
+
+		tms := &driver2.TokenManagerService{}
+		tms.TransferServiceReturns(transferService)
+		tms.WalletServiceReturns(walletService)
+		tms.PublicParamsManagerReturns(ppm)
+
+		qe := &driver2.QueryEngine{}
+		qe.ListAuditTokensReturns([]*token.Token{{Owner: owner, Type: "USD", Quantity: "0x64"}}, nil)
+		vault := &driver2.Vault{}
+		vault.QueryEngineReturns(qe)
+
+		logger := logging.MustGetLogger()
+
+		return &Request{
+			Anchor: "test-anchor",
+			Actions: &driver.TokenRequest{
+				Actions: []*driver.TypedAction{
+					{Type: request.ActionType_ACTION_TYPE_TRANSFER, Raw: []byte("transfer1")},
+				},
+			},
+			Metadata: &driver.TokenRequestMetadata{
+				Actions: []*driver.ActionMetadataEntry{
+					{
+						ActionID: 0,
+						TransferMetadata: &driver.TransferMetadata{
+							Inputs: []*driver.TransferInputMetadata{
+								{
+									TokenID: &token.ID{TxId: "tx1", Index: 0},
+									Senders: []*driver.AuditableIdentity{
+										{Identity: owner, AuditInfo: metadataAuditInfo},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			TokenService: &ManagementService{
+				tms:    tms,
+				logger: logger,
+				vault:  &Vault{v: vault, logger: logger},
+			},
+		}
+	}
+
+	t.Run("local wallet service knows the owner", func(t *testing.T) {
+		localAuditInfo := []byte("audit-info-from-wallet-service")
+		record, err := newRequest(localAuditInfo).AuditRecord(ctx)
+		require.NoError(t, err)
+		require.Equal(t, 1, record.Inputs.Count())
+		assert.Equal(t, localAuditInfo, record.Inputs.At(0).OwnerAuditInfo)
+	})
+
+	t.Run("local wallet service does not know the owner", func(t *testing.T) {
+		record, err := newRequest(nil).AuditRecord(ctx)
+		require.NoError(t, err)
+		require.Equal(t, 1, record.Inputs.Count())
+		assert.Equal(t, metadataAuditInfo, record.Inputs.At(0).OwnerAuditInfo)
+	})
+}