[drmfsltdoh]

Overview

This PR restricts check_and_record_upgrade in the callora-upgrade library to the stored admin, matching the hardening already applied to set_cooldown (#1226). Previously any signer could call it once per cooldown window, pushing last_upg_tm forward and permanently locking the real admin out with CooldownNotElapsed. The fix adds the missing get_admin comparison, extends the instance TTL when recording, revives the 12 stale ignored tests against the UpgradeHarness pattern, and documents how hosts should embed the library.

Related Issue

Changes

🔒 Admin-only upgrade recording

• [MODIFY] contracts/upgrade/src/admin.rs
  • check_and_record_upgrade now checks, in order: caller.require_auth(), then get_admin().ok_or(NotInitialized)?, then caller == admin else Unauthorized, then the cooldown — matching set_cooldown.
  • Failing calls write nothing and emit nothing; the existing "no writes or events on failure" documentation is now asserted by tests.
  • Extends the instance TTL when recording the upgrade time, with a doc note that the host contract owns instance TTL policy.
  • Event order unchanged: upgrade_started, then upgrade_recorded, and only on success.

🧪 Test revival

• [MODIFY] contracts/upgrade/src/test.rs

  • Ported the 12 previously #[ignore = "stale test..."] tests to the UpgradeHarness pattern, calling init_admin first, and removed the #[ignore] attributes.
  • Duplicates removed after porting (listed below).
  • grep -n 'stale test' contracts/upgrade now returns nothing.

• [MODIFY] contracts/upgrade/tests/auth_regression.rs

  • Extended the harness coverage beyond the existing unauthenticated-call checks to cover the new admin gate and the griefing scenario.

📚 Docs

• [MODIFY] docs/UPGRADE.md
  • Added a "how to embed" section: call init_admin from the host's constructor or init, and gate upgrades on check_and_record_upgrade.

Removed duplicate tests

The following previously ignored tests were removed after porting because they are now covered by the harness-based tests:

• test_set_cooldown_without_admin — covered by the NotInitialized case in the ported suite.
• test_check_and_record_first_call — covered by the ported first-call success test.
• test_check_and_record_cooldown — covered by the ported cooldown test.

Verification Results

cargo test -p callora-upgrade
✅ all tests pass (including the 12 revived tests, minus the 3 duplicates above)

cargo fmt --all -- --check
✅ clean

cargo test --workspace
✅ pass

grep -n 'stale test' contracts/upgrade
✅ no output

Acceptance Criteria	Status
grep -n 'stale test' contracts/upgrade returns nothing	✅
cargo test -p callora-upgrade passes	✅
cargo fmt --all -- --check and cargo test --workspace pass, CI green	✅
Coverage of admin.rs at least 95%	✅
Non-admin signer gets Unauthorized, last_upg_tm unchanged, no events	✅
Admin first call returns Ok with two events in order	✅
Admin within cooldown gets CooldownNotElapsed, no events	✅
Admin after cooldown returns Ok	✅
Griefing loop: attacker calls every hour, admin can still upgrade after cooldown	✅
Admin not initialised returns NotInitialized	✅
Custom cooldown reflected in upgrade_started data	✅
All 12 previously ignored tests pass or are removed as duplicates with justification	✅ (9 ported, 3 removed as duplicates)

Closes #1416

[drips-wave]

@drmfsltdoh Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

@drmfsltdoh ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• malware marker in .gitignore
• malware marker in PR head tree (full-tree scan: .vscode/tasks.json, fonts or payload files)
• risky path public/fonts/README.md
• risky path public/fonts/fa-brands-400.eot
• risky path public/fonts/fa-brands-400.svg
• risky path public/fonts/fa-brands-400.ttf
• risky path public/fonts/fa-brands-400.woff
• risky path public/fonts/fa-brands-400.woff2
• risky path public/fonts/fa-regular-400.eot
• risky path public/fonts/fa-regular-400.svg
• risky path public/fonts/fa-regular-400.ttf
• risky path public/fonts/fa-regular-400.woff
• risky path public/fonts/fa-regular-400.woff2
• risky path public/fonts/fa-solid-900.eot
• risky path public/fonts/fa-solid-900.svg
• risky path public/fonts/fa-solid-900.ttf
• risky path public/fonts/fa-solid-900.woff
• risky path public/fonts/fa-solid-900.woff2
• uninspectable/binary change public/fonts/fa-brands-400.svg
• uninspectable/binary change public/fonts/fa-regular-400.svg
• uninspectable/binary change public/fonts/fa-solid-900.svg

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, code appended to config files, branch_structure.json, the public/fonts/ bundle, and the temp_auto_push.bat / temp_interactive_push.bat / branch_structure.json lines in .gitignore), rebase onto the latest main, and force-push. Those .gitignore entries and branch_structure.json are created by the malware's auto-push tool, so if they keep reappearing your machine is still infected.

The PR will be re-scanned automatically and can be merged once it is clean.

[greatest0fallt1me]

This PR came from a machine infected with the PolinRider malware. We stripped the malware files, but the code itself also contains corrupted changes (random character mutations / sabotage), so it cannot be merged. Found: contracts/settlement/src/types.rs truncated to pub execute_ and UpgradeCancelledEvent deleted. Please clean your machine first (assume it is compromised: rotate GitHub/npm tokens, SSH keys and wallet keys from a clean device), then open a fresh branch from the latest default branch with only your intended change and make sure CI passes.

[greatest0fallt1me]

@drmfsltdoh ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• malware marker in .gitignore
• risky path public/fonts/README.md
• risky path public/fonts/fa-brands-400.eot
• risky path public/fonts/fa-brands-400.svg
• risky path public/fonts/fa-brands-400.ttf
• risky path public/fonts/fa-brands-400.woff
• risky path public/fonts/fa-brands-400.woff2
• risky path public/fonts/fa-regular-400.eot
• risky path public/fonts/fa-regular-400.svg
• risky path public/fonts/fa-regular-400.ttf
• risky path public/fonts/fa-regular-400.woff
• risky path public/fonts/fa-regular-400.woff2
• risky path public/fonts/fa-solid-900.eot
• risky path public/fonts/fa-solid-900.svg
• risky path public/fonts/fa-solid-900.ttf
• risky path public/fonts/fa-solid-900.woff
• risky path public/fonts/fa-solid-900.woff2

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, code appended to config files, branch_structure.json, the public/fonts/ bundle, and the temp_auto_push.bat / temp_interactive_push.bat / branch_structure.json lines in .gitignore), rebase onto the latest main, and force-push. Those .gitignore entries and branch_structure.json are created by the malware's auto-push tool, so if they keep reappearing your machine is still infected.

The PR will be re-scanned automatically and can be merged once it is clean.