identity: areMe converts storage errors into false-negative ownership answers

integration/token/fungible/views/boolpolicy.go

@@ -217,8 +217,12 @@ func (m *PolicyAcceptSpendView) Call(context view.Context) (any, error) {
 
 			continue
 		}
-		if len(in.Owner) != 0 && sigService.IsMe(context.Context(), in.Owner) {
-			assert.Fail("received tx consumes additional token [%s] owned by this responder", in.Id)
+		if len(in.Owner) != 0 {
+			isMe, err := sigService.IsMe(context.Context(), in.Owner)
+			assert.NoError(err, "failed to check ownership of input [%s]", in.Id)
+			if isMe {
+				assert.Fail("received tx consumes additional token [%s] owned by this responder", in.Id)
+			}
 		}
 	}
 	assert.True(matched, "received tx does not consume the token named in SpendRequest")

integration/token/fungible/views/multisig.go

@@ -206,8 +206,12 @@ func (m *MultiSigAcceptSpendView) Call(context view.Context) (any, error) {
 			continue
 		}
 		// Any other input must NOT belong to this responder.
-		if len(in.Owner) != 0 && sigService.IsMe(context.Context(), in.Owner) {
-			assert.Fail("received tx consumes additional token [%s] owned by this responder", in.Id)
+		if len(in.Owner) != 0 {
+			isMe, err := sigService.IsMe(context.Context(), in.Owner)
+			assert.NoError(err, "failed to check ownership of input [%s]", in.Id)
+			if isMe {
+				assert.Fail("received tx consumes additional token [%s] owned by this responder", in.Id)
+			}
 		}
 	}
 	assert.True(matched, "received tx does not consume the token named in SpendRequest")

integration/token/fungible/views/utils.go

@@ -29,7 +29,9 @@ func AssertTokens(sp token.ServiceProvider, tx *ttx.Transaction, outputs *token.
 	assert.NoError(err, "failed to get token db for [%s]", tx.TokenService().ID())
 	for _, output := range outputs.Outputs() {
 		tokenID := output.ID(token.RequestAnchor(tx.ID()))
-		if output.Owner.Equal(id) || tx.TokenService().SigService().IsMe(ctx, output.Owner) {
+		isMe, err := tx.TokenService().SigService().IsMe(ctx, output.Owner)
+		assert.NoError(err, "failed to check ownership of [%s]", output.Owner)
+		if output.Owner.Equal(id) || isMe {
 			// check it exists
 			toks, err := db.GetTokens(ctx, tokenID)
 			assert.NoError(err, "failed to retrieve token [%s]", tokenID)

token/driver/wallet.go

@@ -39,10 +39,14 @@ type IdentityProvider interface {
 	RegisterSigner(ctx context.Context, identity Identity, signer Signer, verifier Verifier, signerInfo []byte, ephemeral bool) error
 
 	// AreMe checks a list of identities and returns those that have signers registered with this provider.
-	AreMe(ctx context.Context, identities ...Identity) []string
+	// A non-nil error means the ownership check could not be completed (for example a storage failure);
+	// in that case the returned slice must not be treated as an authoritative answer.
+	AreMe(ctx context.Context, identities ...Identity) ([]string, error)
 
 	// IsMe returns true if a signer has been registered for the specified identity.
-	IsMe(ctx context.Context, party Identity) bool
+	// A non-nil error means ownership could not be determined and the boolean must be ignored;
+	// callers must not treat a false-with-error as an authoritative "not mine".
+	IsMe(ctx context.Context, party Identity) (bool, error)
 
 	// GetEnrollmentID extracts the enrollment identifier from the provided audit information for a specific identity.
 	GetEnrollmentID(ctx context.Context, identity Identity, auditInfo []byte) (string, error)

token/services/identity/membership/lm.go

@@ -100,7 +100,7 @@ type IdentityStoreService interface {
 //
 //go:generate counterfeiter -o mock/ip.go -fake-name IdentityProvider . IdentityProvider
 type IdentityProvider interface {
-	IsMe(context.Context, idriver.Identity) bool
+	IsMe(context.Context, idriver.Identity) (bool, error)
 	// Bind an ephemeral identity to another identity
 	Bind(ctx context.Context, longTerm idriver.Identity, ephemeralIdentities ...idriver.Identity) error
 	// RegisterIdentityDescriptor register the passed identity descriptor with an alias
@@ -293,7 +293,8 @@ func (l *LocalMembership) Close() {
 
 // IsMe reports whether the given identity belongs to this local membership set.
 // It delegates to the configured IdentityProvider to determine membership.
-func (l *LocalMembership) IsMe(ctx context.Context, id token.Identity) bool {
+// A non-nil error means membership could not be determined (the boolean must be ignored).
+func (l *LocalMembership) IsMe(ctx context.Context, id token.Identity) (bool, error) {
 	return l.IdentityProvider.IsMe(ctx, id)
 }
 

token/services/identity/membership/lm_security_test.go

@@ -188,7 +188,7 @@ func TestGetIdentityInfo_NotFoundDoesNotLeakOtherIdentities(t *testing.T) {
 
 	ip := &mock.IdentityProvider{}
 	ip.BindReturns(nil)
-	ip.IsMeReturns(false)
+	ip.IsMeReturns(false, nil)
 
 	iss := &mock.IdentityStoreService{}
 	iss.ConfigurationExistsReturns(false, nil)

token/services/identity/membership/lm_test.go

@@ -34,7 +34,7 @@ import (
 
 func TestNewLocalMembership_IsMe(t *testing.T) {
 	ip := &mock.IdentityProvider{}
-	ip.IsMeReturns(true)
+	ip.IsMeReturns(true, nil)
 
 	lm := membership.NewLocalMembership(
 		logging.MustGetLogger("test"),
@@ -47,7 +47,9 @@ func TestNewLocalMembership_IsMe(t *testing.T) {
 		ip,
 	)
 
-	assert.True(t, lm.IsMe(t.Context(), []byte("any")))
+	isMe, err := lm.IsMe(t.Context(), []byte("any"))
+	require.NoError(t, err)
+	assert.True(t, isMe)
 	assert.Equal(t, token.Identity("netid"), lm.DefaultNetworkIdentity())
 }