safe-global / safe-client-gateway / 36134770622

89%

push

github

feat(policies): add the shared policy domain model (#3391)

* feat(policies): add the shared policy domain model

A policy reaches a Safe through one of three mechanisms - an enabled module,
the SafePolicyGuard, or an off-chain grant - and the wallet renders all three in
one list. This is what they share, landed first so everything downstream builds
against the shape rather than against an implementation.

`PolicyEnforcement` carries the mechanism on the wire. That matters beyond
typing: a proposer may only propose, so the UI has to render it as access rather
than as an audited on-chain policy - a data distinction if `via` carries it, and
a hardcoded type check in every render path if it does not. `offchain` names the
mechanism rather than the one type using it today, so a second off-chain type
needs no new variant.

`id` is derived per mechanism, because only guard policies have something
on-chain to name them by. Two deviations from WA-3218's table, both because a
Space-level list mixes Safes and chains:

- the Safe and its chain are in the preimage. The ticket's discriminator is zero
  for spending limit and recovery, on the reasoning that one such policy exists
  per Safe - which makes every Safe in a Space derive the same id, and makes a
  Safe held on two chains collide with itself.
- the enforcement kind leads it as a domain separator. Without it a module
  policy and an off-chain grant with the same type, Safe and address hash
  identically; the test asserting they differ is what caught it.

Guard ids are the on-chain access word, asserted against a real binding rather
than a built fixture, so a pending binding and the active policy it becomes
carry the same identifier.

Refs: WA-3218

* removed unused policy types, update doc

* remove id field from ActivePolicy

* Remove `as const`

* feat(policies): refactor SafeRef to use existing schemas for validation

* fix: add missing closing braces to PolicyOperation, PolicyType, and PolicyEnforcemen... (continued)

4367 of 5139 branches covered (84.98%)

Branch coverage included in aggregate %.

0 of 9 new or added lines in 4 files covered. (0.0%)

11123 of 12230 relevant lines covered (90.95%)

514.31 hits per line