safe-global / safe-client-gateway / 38579474780

91%

Build Type

push

github

Committed by web-flow

Commit Message

feat(policies): Guard based policies in active policies api (#3449)

* feat(policies): report guard policies alongside allowance state

Adds the SafePolicy field to the indexer read and the mapper that turns it
into payloads, so /policies/active reports both mechanisms in one list. This is
where removing event aggregation pays off: `SafePolicy.state` is the recipient
list already folded from every `configure` delta, so this maps one row to one
payload - no replay, no per-access grouping, no delta folding.

Five kinds are rendered: the token allowlist, the cosigner, and the three
stateless fallbacks. ERC20_APPROVE, ALLOWED_MODULE, MULTISEND and the
NONE/UNKNOWN the indexer reports for an unbound or unregistered policy are
skipped and logged - rendering an unknown restriction is worse than omitting it.

Two details the tests pin because they are silently wrong otherwise:

- the allowlist's token is the access target, not something inside the state.
  The policy keys its recipients by token, so the binding names the token its
  list applies to.
- a binding whose state is not the shape its kind implies is skipped, not
  coerced. That combination means the indexer's registry and CGW disagree about
  a policy address, which deserves a log line rather than a guess.

One item per binding: rows sharing a storage key already carry the same folded
state, so `transfer` and `transferFrom` on one token report the same list -
which is what the guard enforces.

An allowlist entry is an address plus a permission: the policy holds `ONCE` or
`ALWAYS` per entry, so one list can carry a single-use grant beside an
open-ended one. The value lives inside the indexer's jsonb rather than in a
column, so CGW validates the pair itself and skips a binding whose permission
it cannot read - guessing between a single-use and an open-ended grant would
misreport what the Safe permits.

`enabled` compares the binding's guard against the guard the Safe has set, so a
policy configured th... (continued)

Coverage Stats

4657 of 5416 branches covered (85.99%)

Branch coverage included in aggregate %.

55 of 55 new or added lines in 10 files covered. (100.0%)

3 existing lines in 3 files now uncovered.

11844 of 12924 relevant lines covered (91.64%)

369.17 hits per line