serviceability: make CreateUser naked and idempotent (#4116)

Resolves #4110. Part 2 of #4108.

## Summary

The #4111 connect flow needs `CreateUser` to mean "make sure my user
exists": create it bare, poll to `Activated`, then join feeds with one
`SubscribeFeed`. Today it can't: under an EdgeSeat pass a multicast
create fails with `FeedAccountRequired` unless it names a feed and
group, and a re-run fails with `AccountAlreadyInitialized`, so `connect`
can neither create a user that holds nothing nor call create
unconditionally and retry.

- The feed gate moved out of `create_user_core` into
`CreateSubscribeUser`, its only real caller. A new user starts with no
groups, no feeds, and no seat charged; seats are charged by
`SubscribeFeed`. Bare multicast users at zero seat cost (bounded by
`device.max_users`) are deliberate: they receive nothing.
- Re-running `CreateUser` for an existing user matching the requested
owner, device, user type, and tenant succeeds without changing state. A
mismatch still fails with `AccountAlreadyInitialized`; a banned user
fails with `InvalidStatus` so connect fails fast instead of polling
forever. Owner is checked because the user PDA carries no owner in its
seeds; without it a second buyer with a pass at the same client IP would
get success for an account they do not own.
- The exists check sits after the pass identity checks and before every
counter bump; the tenant, epoch, device-status, and capacity gates stay
below it so a retry survives an epoch rollover or a device that filled
up.
- `CreateSubscribeUser` is unchanged: a duplicate still errors and the
gate still applies.

## Testing Verification

- Re-run asserts full-struct equality on User, Device, and AccessPass,
so any counter bump fails it; a re-run against a device shrunk to
`max_users = 1` still succeeds.
- Rejections: different device, different tenant, different owner
(second buyer, same client IP), and banned user all fail and leave the
user untouched; a duplicate `CreateSubscribeUser` errors and ticks no
seat.
- `test_naked_create_then_subscribe_feed`: a bare user is admitted on an
EdgeSeat pass with no seat, then one `SubscribeFeed` joins the feed and
charges it.
- `feed_metro_gate_test` and `create_subscribe_user_test` cover the gate
on the `CreateSubscribeUser` path after the move.

Author: martinsander00

CHANGELOG.md

@@ -8,8 +8,11 @@ All notable changes to this project will be documented in this file.
 
 ### Changes
 
+- Controller
+  - A multicast user with no publisher role now gets the subscriber ingress ACL and a deny-all announce prefix-list; a user with no roles at all previously fell through to the publisher versions of both. (#4110)
 - Serviceability
   - New `SubscribeFeed` and `UnsubscribeFeed` instructions join or leave whole feeds on an EdgeSeat access pass in a single atomic transaction, charging one seat per feed rather than per group. A feed is all-or-nothing: the caller names feeds, the processor derives which groups change and rejects a group list that does not match, so two feeds carrying the same group stay unambiguous. `UpdateMulticastGroupRoles` now enforces the multicast-group allowlists for every access-pass type, EdgeSeat included, so purchased groups go through the feed instructions and individually comped groups through the allowlist. `CreateSubscribeUser` skips the allowlist only for the case its feed gate actually covers, closing two paths that could join a group with no check. `MAX_FEED_GROUPS` drops from 64 to 20, bounded by what one transaction can carry: because joining passes every group a feed holds, a larger feed could never be joined. No feed onchain is affected. For the same reason a user may hold at most 6 feeds, and a held feed the pass no longer carries is pruned on leave instead of blocking it. New errors: `EdgeSeatRequired` (101), `UserDeviceMismatch` (102), `UserFeedLimitExceeded` (103), `EdgeSeatIsMulticastOnly` (104). (#4109)
+  - `CreateUser` can now create a bare multicast user (no group, no feed) under an EdgeSeat pass: the feed gate moved to `CreateSubscribeUser`, its only caller, and feed seats are otherwise charged by `SubscribeFeed`. The pass-level `max_multicast_users` cap is enforced again (it had been vestigial under the feed-seat model) so bare users stay bounded; the oracle already provisions it as the total purchased seats. `CreateUser` is also idempotent: re-running it for an existing user matching the requested owner, device, user type, and tenant succeeds without changing state, so a client can retry safely; a mismatch still fails with `AccountAlreadyInitialized`, and a banned user with `InvalidStatus`. This applies to the current client_ip-keyed user PDA; the legacy index-keyed PDA cannot be re-run, since its index has moved on. Deploy note: `max_multicast_users` becomes load-bearing on existing EdgeSeat passes; before deploying to a cluster, confirm each pass's value covers its feed seats and backfill via `SetAccessPass` where short. Checked 2026-07-30: mainnet-beta and devnet hold no EdgeSeat pass; testnet's single one (`5x9DTsWC…`) has `max_multicast_users` 1, zero users, zero connections. (#4110)
 
 ## [v0.32.0](https://github.com/malbeclabs/doublezero/compare/client/v0.31.0...client/v0.32.0) - 2026-07-29
 

controlplane/controller/internal/controller/fixtures/multicast.tunnel.tmpl

@@ -79,6 +79,7 @@ mpls icmp ip source-interface Loopback255
 default interface Tunnel500
 default interface Tunnel501
 default interface Tunnel502
+default interface Tunnel503
 interface Tunnel500
    description USER-MCAST-500
    ip access-group SEC-USER-SUB-MCAST-IN in
@@ -126,6 +127,21 @@ interface Tunnel502
    tunnel ttl 32
    no shutdown
 !
+interface Tunnel503
+   description USER-MCAST-503
+   ip access-group SEC-USER-SUB-MCAST-IN in
+   multicast ipv4 boundary SEC-USER-MCAST-BOUNDARY-503-OUT out
+   pim ipv4 sparse-mode
+   pim ipv4 dr-priority 4294967295
+   mtu 9216
+   ip address 169.254.0.6/31
+   tunnel mode gre
+   tunnel source 8.8.8.8
+   tunnel destination 9.9.9.9
+   tunnel path-mtu-discovery
+   tunnel ttl 32
+   no shutdown
+!
 router bgp 65342
    router-id 14.14.14.14
    timers bgp 1 3
@@ -157,10 +173,20 @@ router bgp 65342
    neighbor 169.254.0.5 route-map RM-USER-502-OUT out
    neighbor 169.254.0.5 maximum-routes 1
    neighbor 169.254.0.5 maximum-accepted-routes 1
+   no neighbor 169.254.0.7
+   neighbor 169.254.0.7 remote-as 65000
+   neighbor 169.254.0.7 local-as 65342 no-prepend replace-as
+   neighbor 169.254.0.7 passive
+   neighbor 169.254.0.7 description USER-503
+   neighbor 169.254.0.7 route-map RM-USER-503-IN in
+   neighbor 169.254.0.7 route-map RM-USER-503-OUT out
+   neighbor 169.254.0.7 maximum-routes 1
+   neighbor 169.254.0.7 maximum-accepted-routes 1
    address-family ipv4
       neighbor 169.254.0.1 activate
       neighbor 169.254.0.3 activate
       neighbor 169.254.0.5 activate
+      neighbor 169.254.0.7 activate
    !
    address-family vpn-ipv4
    !
@@ -203,6 +229,12 @@ route-map RM-USER-502-OUT deny 10
 route-map RM-USER-502-OUT permit 20
    match community COMM-ALL_MCAST_USERS
 !
+no route-map RM-USER-503-OUT
+route-map RM-USER-503-OUT deny 10
+   match community COMM-TST_USERS
+route-map RM-USER-503-OUT permit 20
+   match community COMM-ALL_MCAST_USERS
+!
 no route-map RM-USER-500-IN
 route-map RM-USER-500-IN permit 10
    match ip address prefix-list PL-USER-500
@@ -221,6 +253,12 @@ route-map RM-USER-502-IN permit 10
    match as-path length = 1
    set community 21682:1300 21682:10050
 !
+no route-map RM-USER-503-IN
+route-map RM-USER-503-IN permit 10
+   match ip address prefix-list PL-USER-503
+   match as-path length = 1
+   set community 21682:1300 21682:10050
+!
 no ip prefix-list PL-USER-500
 ip prefix-list PL-USER-500 seq 10 deny 0.0.0.0/0 le 32
 !
@@ -230,9 +268,13 @@ ip prefix-list PL-USER-501 seq 10 permit 100.0.0.1/32
 no ip prefix-list PL-USER-502
 ip prefix-list PL-USER-502 seq 10 permit 100.0.0.2/32
 !
+no ip prefix-list PL-USER-503
+ip prefix-list PL-USER-503 seq 10 deny 0.0.0.0/0 le 32
+!
 no ip access-list SEC-USER-500-IN
 no ip access-list SEC-USER-501-IN
 no ip access-list SEC-USER-502-IN
+no ip access-list SEC-USER-503-IN
 no ip access-list standard SEC-USER-MCAST-BOUNDARY-500-OUT
 ip access-list standard SEC-USER-MCAST-BOUNDARY-500-OUT
    counters per-entry
@@ -254,6 +296,11 @@ ip access-list standard SEC-USER-MCAST-BOUNDARY-502-OUT
    permit host 239.0.0.6
    deny 224.0.0.0/4
 !
+no ip access-list standard SEC-USER-MCAST-BOUNDARY-503-OUT
+ip access-list standard SEC-USER-MCAST-BOUNDARY-503-OUT
+   counters per-entry
+   deny 224.0.0.0/4
+!
 no ip access-list SEC-USER-PUB-MCAST-IN
 ip access-list SEC-USER-PUB-MCAST-IN
    counters per-entry

controlplane/controller/internal/controller/render_test.go

@@ -378,6 +378,21 @@ func TestRenderConfig(t *testing.T) {
 								{239, 0, 0, 6},
 							},
 						},
+						// A bare multicast user (no roles yet) must get the subscriber ACL and
+						// announce nothing, not fall through to the publisher config.
+						{
+							Id:                    503,
+							UnderlaySrcIP:         net.IP{8, 8, 8, 8},
+							UnderlayDstIP:         net.IP{9, 9, 9, 9},
+							OverlaySrcIP:          net.IP{169, 254, 0, 6},
+							OverlayDstIP:          net.IP{169, 254, 0, 7},
+							DzIp:                  net.IP{100, 0, 0, 3},
+							Allocated:             true,
+							IsMulticast:           true,
+							MulticastBoundaryList: []net.IP{},
+							MulticastSubscribers:  []net.IP{},
+							MulticastPublishers:   []net.IP{},
+						},
 					},
 				},
 				UnknownBgpPeers: []net.IP{},

controlplane/controller/internal/controller/server_test.go

@@ -219,6 +219,21 @@ func TestGetConfig(t *testing.T) {
 									{239, 0, 0, 6},
 								},
 							},
+							// A bare multicast user (no roles yet) must get the subscriber ACL and
+							// announce nothing, not fall through to the publisher config.
+							{
+								Id:                    503,
+								UnderlaySrcIP:         net.IP{8, 8, 8, 8},
+								UnderlayDstIP:         net.IP{9, 9, 9, 9},
+								OverlaySrcIP:          net.IP{169, 254, 0, 6},
+								OverlayDstIP:          net.IP{169, 254, 0, 7},
+								DzIp:                  net.IP{100, 0, 0, 3},
+								Allocated:             true,
+								IsMulticast:           true,
+								MulticastBoundaryList: []net.IP{},
+								MulticastSubscribers:  []net.IP{},
+								MulticastPublishers:   []net.IP{},
+							},
 						},
 						PublicIP:              net.IP{7, 7, 7, 7},
 						Vpn4vLoopbackIP:       net.IP{14, 14, 14, 14},

controlplane/controller/internal/controller/templates/tunnel.tmpl

@@ -171,7 +171,9 @@ interface Tunnel{{ .Id }}
    {{- if eq true .IsMulticast }}
    description USER-MCAST-{{ .Id }}
    {{- if not $.NoHardware }}
-   {{- if and .IsMulticast (gt (len .MulticastSubscribers) 0) (eq (len .MulticastPublishers) 0) }}
+   {{- /* Only a user holding the publisher role gets the ACL that permits sending into the
+        multicast group block; subscriber-only and role-less users get the receive-only ACL. */}}
+   {{- if and .IsMulticast (eq (len .MulticastPublishers) 0) }}
    ip access-group SEC-USER-SUB-MCAST-IN in
    {{- else }}
    ip access-group SEC-USER-PUB-MCAST-IN in
@@ -404,7 +406,9 @@ route-map RM-USER-{{ .Id }}-IN permit 10
 {{- range .Device.Tunnels }}
 no ip prefix-list PL-USER-{{ .Id }}
 {{- if eq true .Allocated }}
-{{- if and .IsMulticast (gt (len .MulticastSubscribers) 0) (eq (len .MulticastPublishers) 0) }}
+{{- /* Only publishers hold an allocated dz_ip to announce; subscriber-only and role-less
+     multicast users get deny-all. */}}
+{{- if and .IsMulticast (eq (len .MulticastPublishers) 0) }}
 ip prefix-list PL-USER-{{ .Id }} seq 10 deny 0.0.0.0/0 le 32
 {{- else }}
 ip prefix-list PL-USER-{{ .Id }} seq 10 permit {{ .DzIp }}/32

smartcontract/programs/doublezero-serviceability/src/processors/user/create.rs

@@ -106,7 +106,7 @@ pub fn process_create_user(
         permission_account: None,
     };
 
-    let mut result = create_user_core(
+    let Some(mut result) = create_user_core(
         program_id,
         accounts,
         &core_accounts,
@@ -116,10 +116,11 @@ pub fn process_create_user(
         value.tunnel_endpoint,
         false,
         None,
-        // Plain CreateUser is unicast; no multicast group and no feed gate.
-        None,
-        None,
-    )?;
+    )?
+    else {
+        msg!("user already exists; nothing to do");
+        return Ok(());
+    };
 
     // Always allocate resources and activate atomically.
     resource_onchain_helpers::validate_and_allocate_user_resources(

smartcontract/programs/doublezero-serviceability/src/processors/user/create_core.rs

@@ -19,10 +19,7 @@ use solana_program::{
 };
 use std::net::Ipv4Addr;
 
-use crate::{
-    processors::{feed::enforce_feed_metro_gate, validation::validate_program_account},
-    serializer::try_acc_write,
-};
+use crate::{processors::validation::validate_program_account, serializer::try_acc_write};
 
 #[derive(PartialEq)]
 pub enum PDAVersion {
@@ -57,15 +54,18 @@ pub struct CreateUserCoreResult {
 
 /// Shared validation and state setup for CreateUser and CreateSubscribeUser.
 ///
-/// Performs all common checks (payer signer, account emptiness, access pass validation,
-/// PDA derivation, device validation, max users checks, epoch check) and sets up the
-/// initial User struct with Pending status.
+/// Performs all common checks (payer signer, access pass validation, PDA derivation,
+/// device validation, max users checks, epoch check) and sets up the initial User struct.
+///
+/// Returns `Ok(None)` when the user already exists and matches the requested owner, device,
+/// user type, and tenant; a mismatch errors with `AccountAlreadyInitialized`, and a banned user
+/// with `InvalidStatus`.
 ///
 /// Callers are responsible for:
 /// - Parsing the required resource extension accounts
 /// - Onchain allocation + try_activate
 /// - Account creation (try_acc_create) and write-back
-/// - Multicast subscription logic (CreateSubscribeUser only)
+/// - Multicast subscription logic and the EdgeSeat feed gate (CreateSubscribeUser only)
 #[allow(clippy::too_many_arguments)]
 pub fn create_user_core(
     program_id: &Pubkey,
@@ -77,17 +77,11 @@ pub fn create_user_core(
     tunnel_endpoint: Ipv4Addr,
     is_publisher: bool,
     owner_override: Option<Pubkey>,
-    // EdgeSeat multicast metro gate: the multicast group being joined (None for non-multicast
-    // connects) and the referenced Feed account covering the device's exchange.
-    target_mgroup: Option<&Pubkey>,
-    feed_account: Option<&AccountInfo>,
-) -> Result<CreateUserCoreResult, ProgramError> {
+) -> Result<Option<CreateUserCoreResult>, ProgramError> {
     // Check if the payer is a signer
     assert!(core.payer_account.is_signer, "Payer must be a signer");
 
-    if !core.user_account.data_is_empty() {
-        return Err(ProgramError::AccountAlreadyInitialized);
-    }
+    let already_exists = !core.user_account.data_is_empty();
     if core.accesspass_account.data_is_empty() {
         return Err(DoubleZeroError::AccessPassNotFound.into());
     }
@@ -204,6 +198,43 @@ pub fn create_user_core(
         return Err(DoubleZeroError::Unauthorized.into());
     }
 
+    // Idempotent create: an existing user matching the request is a no-op, so a caller can retry
+    // safely. Checked after the pass identity checks (PDA, user_payer, client_ip) so a no-op still
+    // needs the caller's own pass, and before the tenant-allowlist, epoch, device-status, and
+    // capacity gates: those apply to adding a user, not to retrying one.
+    if already_exists {
+        if core.user_account.owner != program_id {
+            return Err(ProgramError::IncorrectProgramId);
+        }
+        let existing = User::try_from(core.user_account)?;
+        let requested_tenant = core.tenant_account.map(|a| *a.key).unwrap_or_default();
+        if existing.owner != effective_owner
+            || existing.device_pk != *core.device_account.key
+            || existing.user_type != user_type
+            || existing.tenant_pk != requested_tenant
+        {
+            msg!(
+                "user exists with owner {} device {} type {} tenant {}; requested owner {} device {} type {} tenant {}",
+                existing.owner,
+                existing.device_pk,
+                existing.user_type,
+                existing.tenant_pk,
+                effective_owner,
+                core.device_account.key,
+                user_type,
+                requested_tenant
+            );
+            return Err(ProgramError::AccountAlreadyInitialized);
+        }
+        // A ban is terminal; fail fast instead of leaving the caller polling a user that will
+        // never activate.
+        if existing.status == UserStatus::Banned {
+            msg!("user {} is banned", core.user_account.key);
+            return Err(DoubleZeroError::InvalidStatus.into());
+        }
+        return Ok(None);
+    }
+
     // Enforce tenant_allowlist for unicast users only. Multicast connections are not
     // tenant-scoped, so the access-pass tenant_allowlist does not apply to them.
     if user_type != UserType::Multicast {
@@ -317,25 +348,6 @@ pub fn create_user_core(
     // returns before any account is written, so no state is persisted.
     accesspass.try_add_user(user_type)?;
 
-    // EdgeSeat multicast metro gate: the device's exchange must be covered by a feed on the pass,
-    // the target group must be joinable there, and that feed's seat is ticked. Unicast retains the
-    // per-category cap above and is not feed-gated. The ticked feed is recorded on the User below so
-    // delete releases exactly that seat. A user may accumulate more feeds post-activation (multiple
-    // metros per pass); that re-gating is deferred to doublezero#1699.
-    let feed_pks = if matches!(accesspass.accesspass_type, AccessPassType::EdgeSeat(_))
-        && user_type == UserType::Multicast
-    {
-        vec![enforce_feed_metro_gate(
-            program_id,
-            &mut accesspass,
-            &device.exchange_pk,
-            target_mgroup,
-            feed_account,
-        )?]
-    } else {
-        vec![]
-    };
-
     // All validations passed - now update counters
     accesspass.connection_count += 1;
     accesspass.status = AccessPassStatus::Connected;
@@ -406,16 +418,17 @@ pub fn create_user_core(
         last_bgp_up_at: 0,
         last_bgp_reported_at: 0,
         bgp_rtt_ns: 0,
-        feed_pks,
+        // Feeds are joined post-creation via SubscribeFeed, or by CreateSubscribeUser's gate.
+        feed_pks: vec![],
     };
 
-    Ok(CreateUserCoreResult {
+    Ok(Some(CreateUserCoreResult {
         user,
         device,
         accesspass,
         globalstate,
         pda_ver,
         bump_old_seed,
         bump_seed,
-    })
+    }))
 }