test(contract): store the Verified attestation cross-contract in sandbox

Un-ignores the store-path tests now that the fixture keypair is complete: a
Verified quote stores through the real deployed verifier, and the
TlsKeyOwnedByOtherAccount guard is exercised across the promise chain by two
accounts sharing the fixture key. They deploy the wasm built with
sandbox-test-attestation, since the fixture's app-compose carries a pre-launch
script.

Drops the planned out-of-gas test for resolve_verification: near-sdk forwards
unused prepaid gas to the callback, so the callback cannot be starved by
lowering resolve_verification_tera_gas while the caller attaches max gas. The
config is a floor, not a cap.

Author: pbeza

crates/contract/tests/sandbox/common.rs

@@ -182,6 +182,7 @@ impl SandboxTestSetup {
             number_of_participants: PARTICIPANT_LEN,
             init_config: None,
             with_sandbox_test_methods: false,
+            with_sandbox_test_attestation: false,
         }
     }
 
@@ -200,6 +201,7 @@ pub struct SandboxTestSetupBuilder {
     number_of_participants: usize,
     init_config: Option<dtos::InitConfig>,
     with_sandbox_test_methods: bool,
+    with_sandbox_test_attestation: bool,
 }
 
 impl SandboxTestSetupBuilder {
@@ -231,9 +233,23 @@ impl SandboxTestSetupBuilder {
         self
     }
 
+    /// Deploys the wasm built with `--features sandbox-test-attestation`, which accepts the
+    /// attestation fixture's app-compose. Required by tests that submit the Dstack fixture
+    /// and expect it to verify.
+    pub fn with_sandbox_test_attestation(mut self) -> Self {
+        self.with_sandbox_test_attestation = true;
+        self
+    }
+
     pub async fn build(self) -> SandboxTestSetup {
+        assert!(
+            !(self.with_sandbox_test_methods && self.with_sandbox_test_attestation),
+            "no wasm is built with both test feature sets; add one if a test needs it"
+        );
         let (worker, contract) = if self.with_sandbox_test_methods {
             init_with_wasm(contract_build::current_contract_with_sandbox_test_methods()).await
+        } else if self.with_sandbox_test_attestation {
+            init_with_wasm(contract_build::current_contract_with_sandbox_test_attestation()).await
         } else {
             init().await
         };

crates/contract/tests/sandbox/tee_verifier.rs

@@ -8,10 +8,9 @@
 //!   time is wall-clock and forward-only, and the fixture collateral has
 //!   expired against it.
 //!
-//! Verified-path tests that store an attestation must sign as the fixture
-//! account (the quote's report_data binds the fixture account key, and the
-//! contract reads that key from the transaction signer). They are ignored
-//! until the fixture secret key asset lands; see TODO(#3787).
+//! Verified-path tests that store an attestation sign as the fixture account:
+//! the quote's report_data binds the fixture account key, and the contract
+//! reads that key from the transaction signer.
 #![allow(non_snake_case)]
 
 use crate::sandbox::{
@@ -53,6 +52,16 @@ async fn setup() -> SandboxTestSetup {
         .await
 }
 
+/// Setup for tests that expect the fixture to pass the post-DCAP checks, which needs the
+/// wasm that accepts its app-compose.
+async fn setup_accepting_fixture_attestation() -> SandboxTestSetup {
+    SandboxTestSetup::builder()
+        .with_protocols(ALL_PROTOCOLS)
+        .with_sandbox_test_attestation()
+        .build()
+        .await
+}
+
 /// Votes `verifier` in as `mpc-contract`'s trusted verifier (all participants vote
 /// so the change crosses threshold).
 async fn trust_verifier(contract: &Contract, participants: &[Account], verifier: &AccountId) {
@@ -418,15 +427,14 @@ async fn submit_participant_info__should_fail_cleanly_when_verifier_gas_budget_t
 }
 
 #[tokio::test]
-#[ignore = "TODO(#3787): requires the near_account_secret_key asset"]
 async fn submit_participant_info__should_store_attestation_on_verified_quote() {
     // Given
     let SandboxTestSetup {
         worker,
         mpc_signer_accounts,
         contract,
         ..
-    } = setup().await;
+    } = setup_accepting_fixture_attestation().await;
     deploy_and_trust_pinned_verifier(&worker, &contract, &mpc_signer_accounts).await;
     whitelist_fixture_dstack_measurements(&contract, &mpc_signer_accounts).await;
     let submitter = create_fixture_account(&worker, "fixture-node-a").await;
@@ -461,46 +469,6 @@ async fn submit_participant_info__should_store_attestation_on_verified_quote() {
 }
 
 #[tokio::test]
-#[ignore = "TODO(#3787): requires the near_account_secret_key asset"]
-async fn submit_participant_info__should_fail_and_store_nothing_when_resolve_verification_runs_out_of_gas()
- {
-    // Given: a callback budget far below the ~20 Tgas the post-DCAP work needs,
-    // but enough to schedule the callback receipt. Reaching that gas-heavy path
-    // requires a Verified verdict and a submitter holding the fixture key.
-    let SandboxTestSetup {
-        worker,
-        mpc_signer_accounts,
-        contract,
-        ..
-    } = SandboxTestSetup::builder()
-        .with_protocols(ALL_PROTOCOLS)
-        .with_init_config(dtos::InitConfig {
-            resolve_verification_tera_gas: Some(3),
-            ..Default::default()
-        })
-        .build()
-        .await;
-    deploy_and_trust_pinned_verifier(&worker, &contract, &mpc_signer_accounts).await;
-    whitelist_fixture_dstack_measurements(&contract, &mpc_signer_accounts).await;
-    let submitter = create_fixture_account(&worker, "fixture-node-a").await;
-    let balance_before = submitter.view_account().await.unwrap().balance;
-
-    // When
-    let result = submit_dstack(&submitter, &contract).await;
-
-    // Then: the callback receipt rolls back, so nothing may be stored.
-    assert_submission_failed_cleanly(
-        &result,
-        &contract,
-        &submitter,
-        balance_before,
-        "Exceeded the prepaid gas",
-    )
-    .await;
-}
-
-#[tokio::test]
-#[ignore = "TODO(#3787): requires the near_account_secret_key asset"]
 async fn submit_participant_info__should_reject_verified_quote_when_tls_key_owned_by_other_account()
 {
     // Given: an owner stored a Verified attestation for the fixture TLS key.
@@ -513,7 +481,7 @@ async fn submit_participant_info__should_reject_verified_quote_when_tls_key_owne
         mpc_signer_accounts,
         contract,
         ..
-    } = setup().await;
+    } = setup_accepting_fixture_attestation().await;
     deploy_and_trust_pinned_verifier(&worker, &contract, &mpc_signer_accounts).await;
     whitelist_fixture_dstack_measurements(&contract, &mpc_signer_accounts).await;
     let owner = create_fixture_account(&worker, "fixture-node-a").await;

crates/contract/tests/sandbox/utils/contract_build.rs

@@ -8,11 +8,13 @@ const TEE_VERIFIER_MANIFEST: &str = "crates/tee-verifier/Cargo.toml";
 const MPC_CONTRACT_OUT_DIR: &str = "target/near/contract-noabi";
 const MPC_CONTRACT_BENCH_OUT_DIR: &str = "target/near/contract-noabi-bench";
 const MPC_CONTRACT_SANDBOX_OUT_DIR: &str = "target/near/contract-noabi-sandbox";
+const MPC_CONTRACT_ATTESTATION_OUT_DIR: &str = "target/near/contract-noabi-attestation";
 const TEE_VERIFIER_SANDBOX_OUT_DIR: &str = "target/near/tee-verifier-sandbox";
 
 static CONTRACT: OnceLock<Vec<u8>> = OnceLock::new();
 static CONTRACT_WITH_BENCH_METHODS: OnceLock<Vec<u8>> = OnceLock::new();
 static CONTRACT_WITH_SANDBOX_TEST_METHODS: OnceLock<Vec<u8>> = OnceLock::new();
+static CONTRACT_WITH_SANDBOX_TEST_ATTESTATION: OnceLock<Vec<u8>> = OnceLock::new();
 static MIGRATION_CONTRACT: OnceLock<Vec<u8>> = OnceLock::new();
 static PARALLEL_CONTRACT: OnceLock<Vec<u8>> = OnceLock::new();
 static TEE_VERIFIER_CONTRACT: OnceLock<Vec<u8>> = OnceLock::new();
@@ -51,6 +53,19 @@ pub fn current_contract_with_sandbox_test_methods() -> &'static [u8] {
     })
 }
 
+/// Returns the current contract WASM that accepts the attestation fixture's app-compose.
+/// Use this only for tests that submit the Dstack fixture and need it to verify: the
+/// fixture carries the `pre_launch_script` that exported its signer key, which the
+/// production policy rejects.
+pub fn current_contract_with_sandbox_test_attestation() -> &'static [u8] {
+    CONTRACT_WITH_SANDBOX_TEST_ATTESTATION.get_or_init(|| {
+        ContractBuilder::new(MPC_CONTRACT_MANIFEST)
+            .out_dir(MPC_CONTRACT_ATTESTATION_OUT_DIR)
+            .features(&["sandbox-test-attestation"])
+            .build()
+    })
+}
+
 pub fn migration_contract() -> &'static [u8] {
     MIGRATION_CONTRACT.get_or_init(|| ContractBuilder::new(MIGRATION_CONTRACT_MANIFEST).build())
 }