Skip to content
This repository was archived by the owner on May 11, 2026. It is now read-only.

fix: restrict delete-proposal alias to Starknet authors#636

Merged
bonustrack merged 4 commits into
masterfrom
less/alias-reduce-perms
May 7, 2026
Merged

fix: restrict delete-proposal alias to Starknet authors#636
bonustrack merged 4 commits into
masterfrom
less/alias-reduce-perms

Conversation

@bonustrack

@bonustrack bonustrack commented Apr 28, 2026

Copy link
Copy Markdown
Member

Summary

  • Drop delete-proposal from TYPES_EXECUTABLE_BY_ALIAS.
  • Gate it behind a Starknet author check via a small TYPES_EXECUTABLE_BY_STARKNET_ALIAS = ['delete-proposal'] list and reintroduce isStarknetAddress.
  • EVM aliases can still vote / propose / update-proposal / flag-proposal — only deletion is restricted.

Follows up on #634, which inadvertently promoted delete-proposal to EVM aliases when collapsing the type buckets. Deletion is destructive and irrecoverable, so the pre-refactor Starknet-only behavior is the safer default until alias-typed signers (user vs. agent, per snapshot-labs/workflow#793) land.

Test plan

  • yarn lint
  • Added unit case: delete-proposal from an EVM alias rejects with alias not allowed for the type: delete-proposal.
  • yarn test (CI)
  • Manual: EVM alias signing delete-proposal for an EVM author → rejected.
  • Manual: Starknet alias signing delete-proposal for a Starknet author with a valid alias row → accepted.
  • Manual: EVM alias signing vote / proposal / update-proposal / flag-proposal → still accepted (regression).

🤖 Generated with Claude Code

Deletion is destructive; gate delete-proposal via alias behind a
Starknet author check (matching the pre-refactor behavior). EVM
aliases can still vote/propose/update/flag but cannot delete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@bonustrack
bonustrack requested a review from ChaituVR April 28, 2026 20:37
@ChaituVR

Copy link
Copy Markdown
Member

@copilot Add these tests:

  • resolves for delete-proposal when the author is a Starknet address with a valid alias
  • rejects with 'wrong alias' when the type is allowed but no alias row exists

Copilot AI commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

@copilot Add these tests:

  • resolves for delete-proposal when the author is a Starknet address with a valid alias
  • rejects with 'wrong alias' when the type is allowed but no alias ...

Added both cases in cb14db7resolves delete-proposal when the author is a Starknet address with a valid alias and rejects with 'wrong alias' when the type is allowed but no alias row exists. All 5 cases pass (100% coverage on alias.ts).

@codecov

codecov Bot commented Apr 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ChaituVR ChaituVR left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

utAck

@wa0x6e wa0x6e left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

utAck

@bonustrack
bonustrack merged commit d4fa144 into master May 7, 2026
2 checks passed
@bonustrack
bonustrack deleted the less/alias-reduce-perms branch May 7, 2026 13:28
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants