fix(token): preserve auditor signatures in Request.SetSignatures

Since LFDT-Panurus#1717 action and auditor signatures share the unified
Actions.Signatures slice, but SetSignatures still assigned the whole
field, silently dropping auditor signatures attached beforehand via
AddAuditorSignature. Endorsement then fails with 'auditor signatures
missing' when auditing runs before endorsement collection.

Preserve existing auditor entries when assigning action signatures,
restoring the pre-LFDT-Panurus#1717 order-independence of the two calls.

Fixes LFDT-Panurus#1897

Signed-off-by: YanYuan <yan950414@gmail.com>

Author: YanYuanFE

token/request.go

@@ -1170,6 +1170,7 @@ func (r *Request) AddAuditorSignature(identity Identity, sigma []byte) {
 
 // SetSignatures assigns signatures to all signers. Returns true if all signatures are present.
 // This method now correctly preserves the action context by using SignerWithAction information.
+// Auditor signatures already attached to the request are preserved.
 func (r *Request) SetSignatures(sigmas map[string][]byte) bool {
 	issueSignersWithActions := r.IssueSignersWithActions()
 	transferSignersWithActions := r.TransferSignersWithActions()
@@ -1198,6 +1199,13 @@ func (r *Request) SetSignatures(sigmas map[string][]byte) bool {
 		signatures = append(signatures, signature)
 	}
 
+	// preserve auditor signatures attached before this call, e.g., via AddAuditorSignature
+	for _, signature := range r.Actions.Signatures {
+		if signature != nil && signature.Auditor != nil {
+			signatures = append(signatures, signature)
+		}
+	}
+
 	r.Actions.Signatures = signatures
 
 	return all

token/request_test.go

@@ -966,6 +966,57 @@ func TestRequest_SetSignatures(t *testing.T) {
 	assert.Nil(t, r.Actions.Signatures[1].Action.Signature)
 }
 
+// TestRequest_SetSignatures_PreservesAuditorSignatures tests that SetSignatures
+// keeps auditor signatures attached before it is called
+func TestRequest_SetSignatures_PreservesAuditorSignatures(t *testing.T) {
+	r := &Request{
+		Actions: &driver.TokenRequest{
+			Actions: []*driver.TypedAction{
+				{Type: request.ActionType_ACTION_TYPE_ISSUE, Raw: []byte("issue1")},
+			},
+		},
+		Metadata: &driver.TokenRequestMetadata{
+			Actions: []*driver.ActionMetadataEntry{
+				{
+					ActionID: 0,
+					IssueMetadata: &driver.IssueMetadata{
+						Issuer: driver.AuditableIdentity{
+							Identity: Identity("issuer1"),
+						},
+					},
+				},
+			},
+		},
+		TokenService: &ManagementService{
+			logger: logging.MustGetLogger(),
+		},
+	}
+
+	r.AddAuditorSignature(Identity("auditor1"), []byte("auditor-sig"))
+
+	allPresent := r.SetSignatures(map[string][]byte{
+		Identity("issuer1").UniqueID(): []byte("sig1"),
+	})
+	assert.True(t, allPresent)
+	require.Len(t, r.Actions.Signatures, 2)
+	require.NotNil(t, r.Actions.Signatures[0].Action)
+	assert.Equal(t, []byte("sig1"), r.Actions.Signatures[0].Action.Signature)
+	require.NotNil(t, r.Actions.Signatures[1].Auditor)
+	assert.Equal(t, Identity("auditor1"), r.Actions.Signatures[1].Auditor.Identity)
+	assert.Equal(t, []byte("auditor-sig"), r.Actions.Signatures[1].Auditor.Signature)
+
+	// calling SetSignatures again must not duplicate the auditor signature
+	allPresent = r.SetSignatures(map[string][]byte{
+		Identity("issuer1").UniqueID(): []byte("sig2"),
+	})
+	assert.True(t, allPresent)
+	require.Len(t, r.Actions.Signatures, 2)
+	require.NotNil(t, r.Actions.Signatures[0].Action)
+	assert.Equal(t, []byte("sig2"), r.Actions.Signatures[0].Action.Signature)
+	require.NotNil(t, r.Actions.Signatures[1].Auditor)
+	assert.Equal(t, Identity("auditor1"), r.Actions.Signatures[1].Auditor.Identity)
+}
+
 // TestRequest_cleanupInputIDs tests the cleanupInputIDs utility function
 func TestRequest_cleanupInputIDs(t *testing.T) {
 	r := &Request{}