Add Passkey Delegation Scope Restriction Enforcement

[maugauwi-hash]

Labels: bug, ttl-vault, security
Priority: High
Estimated Time: 1.5 hours

Description:
passkey_delegation_tests.rs covers delegation, but it should be confirmed a delegated passkey is restricted to only the scopes it was granted (e.g., read-only vs. withdrawal) rather than inheriting the full permission set of the original owner.

Tasks:

• Audit delegated-passkey authorization checks against the granted scope, not the owner's full permission set
• Add tests for a read-only delegated passkey attempting a withdrawal (must fail)
• Add tests for scope escalation attempts via delegation chaining
• Document scope enforcement in docs/passkeys.md

[bobo-24]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. I’ll prioritize this immediately and ensure a reliable solution is delivered as soon as possible. Thank you!

[guptakumarranjeet150]

Hi everyone,

I can tackle Add Passkey Delegation Scope Restriction Enforcement. Proposed implementation roadmap:

• Analysis: Inspect current behavior and edge cases in ethos-protocol/ethos-contracts-backend
• Implementation: Implement Add Passkey Delegation Scope Restriction Enforcement with explicit require_auth checks, clean storage layouts, and robust Soroban contract logic.
• Testing: Add comprehensive unit tests verifying both happy-path invocations and unauthorized revert scenarios.
• PR: Atomic commit with clean git hygiene and passing CI

Ready to deliver a clean, tested PR within 12–24 hours. Please assign!