chore: (PRO-275) Set FeePayerPolicy defaults to false (#217)

* chore: Set FeePayerPolicy defaults to false

Changed all FeePayerPolicy default values from true to false, ensuring explicit policy configuration is required for fee payer actions. Updated related tests and documentation to reflect the new defaults.

* Update coverage badge [skip ci]

---------

Co-authored-by: github-actions <github-actions@github.com>

Author: amilz

.github/badges/coverage.json

@@ -1 +1 @@
-{"schemaVersion": 1, "label": "coverage", "message": "85.8%", "color": "green"}
+{"schemaVersion": 1, "label": "coverage", "message": "85.6%", "color": "green"}

crates/lib/src/config.rs

@@ -134,7 +134,7 @@ impl ValidationConfig {
     }
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema, Default)]
 pub struct FeePayerPolicy {
     pub allow_sol_transfers: bool,
     pub allow_spl_transfers: bool,
@@ -145,20 +145,6 @@ pub struct FeePayerPolicy {
     pub allow_approve: bool,
 }
 
-impl Default for FeePayerPolicy {
-    fn default() -> Self {
-        Self {
-            allow_sol_transfers: true,
-            allow_spl_transfers: true,
-            allow_token2022_transfers: true,
-            allow_assign: true,
-            allow_burn: true,
-            allow_close_account: true,
-            allow_approve: true,
-        }
-    }
-}
-
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct Token2022Config {
     pub blocked_mint_extensions: Vec<String>,

crates/lib/src/rpc_server/method/get_config.rs

@@ -89,13 +89,13 @@ mod tests {
         assert_eq!(response.validation_config.price_source, crate::oracle::PriceSource::Mock);
 
         // Assert FeePayerPolicy defaults
-        assert!(response.validation_config.fee_payer_policy.allow_sol_transfers);
-        assert!(response.validation_config.fee_payer_policy.allow_spl_transfers);
-        assert!(response.validation_config.fee_payer_policy.allow_token2022_transfers);
-        assert!(response.validation_config.fee_payer_policy.allow_assign);
-        assert!(response.validation_config.fee_payer_policy.allow_burn);
-        assert!(response.validation_config.fee_payer_policy.allow_close_account);
-        assert!(response.validation_config.fee_payer_policy.allow_approve);
+        assert!(!response.validation_config.fee_payer_policy.allow_sol_transfers);
+        assert!(!response.validation_config.fee_payer_policy.allow_spl_transfers);
+        assert!(!response.validation_config.fee_payer_policy.allow_token2022_transfers);
+        assert!(!response.validation_config.fee_payer_policy.allow_assign);
+        assert!(!response.validation_config.fee_payer_policy.allow_burn);
+        assert!(!response.validation_config.fee_payer_policy.allow_close_account);
+        assert!(!response.validation_config.fee_payer_policy.allow_approve);
 
         // Assert PriceConfig default (check margin value)
         match response.validation_config.price.model {

crates/lib/src/validator/transaction_validator.rs

@@ -566,8 +566,11 @@ mod tests {
         let fee_payer = Pubkey::new_unique();
         let recipient = Pubkey::new_unique();
 
-        // Test with allow_sol_transfers = true (default)
-        setup_default_config();
+        // Test with allow_sol_transfers = true
+        setup_config_with_policy(FeePayerPolicy {
+            allow_sol_transfers: true,
+            ..Default::default()
+        });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 
@@ -597,8 +600,8 @@ mod tests {
         let fee_payer = Pubkey::new_unique();
         let new_owner = Pubkey::new_unique();
 
-        // Test with allow_assign = true (default)
-        setup_default_config();
+        // Test with allow_assign = true
+        setup_config_with_policy(FeePayerPolicy { allow_assign: true, ..Default::default() });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 
@@ -626,8 +629,11 @@ mod tests {
         let fee_payer_token_account = Pubkey::new_unique();
         let recipient_token_account = Pubkey::new_unique();
 
-        // Test with allow_spl_transfers = true (default)
-        setup_spl_token_config();
+        // Test with allow_spl_transfers = true
+        setup_spl_config_with_policy(FeePayerPolicy {
+            allow_spl_transfers: true,
+            ..Default::default()
+        });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 
@@ -693,8 +699,11 @@ mod tests {
         let recipient_token_account = Pubkey::new_unique();
         let mint = Pubkey::new_unique();
 
-        // Test with allow_token2022_transfers = true (default)
-        setup_token2022_config();
+        // Test with allow_token2022_transfers = true
+        setup_token2022_config_with_policy(FeePayerPolicy {
+            allow_token2022_transfers: true,
+            ..Default::default()
+        });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 
@@ -888,8 +897,8 @@ mod tests {
         let fee_payer_token_account = Pubkey::new_unique();
         let mint = Pubkey::new_unique();
 
-        // Test with allow_burn = true (default)
-        setup_spl_token_config();
+        // Test with allow_burn = true
+        setup_spl_config_with_policy(FeePayerPolicy { allow_burn: true, ..Default::default() });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 
@@ -955,8 +964,11 @@ mod tests {
         let fee_payer_token_account = Pubkey::new_unique();
         let destination = Pubkey::new_unique();
 
-        // Test with allow_close_account = true (default)
-        setup_spl_token_config();
+        // Test with allow_close_account = true
+        setup_spl_config_with_policy(FeePayerPolicy {
+            allow_close_account: true,
+            ..Default::default()
+        });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 
@@ -1005,8 +1017,8 @@ mod tests {
         let fee_payer_token_account = Pubkey::new_unique();
         let delegate = Pubkey::new_unique();
 
-        // Test with allow_approve = true (default)
-        setup_spl_token_config();
+        // Test with allow_approve = true
+        setup_spl_config_with_policy(FeePayerPolicy { allow_approve: true, ..Default::default() });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 
@@ -1136,8 +1148,11 @@ mod tests {
         let fee_payer_token_account = Pubkey::new_unique();
         let delegate = Pubkey::new_unique();
 
-        // Test with allow_approve = true (default)
-        setup_token2022_config();
+        // Test with allow_approve = true
+        setup_token2022_config_with_policy(FeePayerPolicy {
+            allow_approve: true,
+            ..Default::default()
+        });
 
         let validator = TransactionValidator::new(fee_payer).unwrap();
 

docs/operators/deploy/sample/kora.toml

@@ -37,7 +37,7 @@ allowed_spl_paid_tokens = [
 disallowed_accounts = []
 
 # Fee payer policy controls what actions the fee payer can perform
-# All default to true for backward compatibility
+# All default to false for security
 [validation.fee_payer_policy]
 allow_sol_transfers = true      # Allow fee payer to be source in SOL transfers
 allow_spl_transfers = true      # Allow fee payer to be source in SPL token transfers