Refuse hardened xpubs before miniscript at_derivation_index

rust-miniscript panics on an xpub hardened step. Detect it first and
return Core's Expand failure. An xprv still expands because parse
applies those steps with the secret.

Co-authored-by: metaphorics <metaphorics@users.noreply.github.com>

Author: cursoragent

crates/rpc/src/handlers/mining.rs

@@ -2282,5 +2282,8 @@ mod tests {
             .unwrap_or_else(|| panic!("hardened xpub must fail Expand"));
         assert_eq!(error.code(), RpcError::CORE_NOT_FOUND);
         assert_eq!(error.to_string(), GENERATEBLOCK_NEEDS_PRIVATE_KEYS);
+        let tprv = "tprv8ZgxMBicQKsPd3EupYiPRhaMooHKUHJxNsTfYuScep13go8QFfHdtkG9nRkFGb7busX4isf6X9dURGCoKgitaApQ6MupRhZMcELAxTBRJgS";
+        generateblock(&ctx, &json!([format!("wpkh({tprv}/0h/0)"), []]))
+            .unwrap_or_else(|err| panic!("hardened tprv must Expand: {err}"));
     }
 }

crates/rpc/src/handlers/util.rs

@@ -1050,6 +1050,7 @@ fn script_from_descriptor(
     }
     ensure_keys_match_network(&descriptor, network)?;
     ensure_secret_keys_match_network(keys, network)?;
+    reject_hardened_xpub(&descriptor)?;
     let derived = descriptor
         .at_derivation_index(0)
         .map_err(|_| DescriptorError::PrivateKeys)?;
@@ -1068,6 +1069,7 @@ fn combo_payout_script(key: &str, network: bitcoin::Network) -> Result<Vec<u8>,
         .paths
         .first()
         .ok_or_else(|| DescriptorError::Parse("Invalid combo descriptor".into()))?;
+    reject_hardened_xpub(path)?;
     let derived = path
         .at_derivation_index(0)
         .map_err(|_| DescriptorError::PrivateKeys)?;
@@ -1084,6 +1086,20 @@ fn ranged_descriptor_rejected() -> DescriptorError {
     DescriptorError::Range(GENERATEBLOCK_RANGED)
 }
 
+/// rust-miniscript panics in `at_derivation_index` on an xpub hardened step.
+/// Core `Expand` returns false, which `getScriptFromDescriptor` maps to
+/// `Cannot derive script without private keys`. An xprv is converted to an
+/// xpub with those steps already applied during parse, so it never hits this.
+fn reject_hardened_xpub(
+    descriptor: &MiniscriptDescriptor<DescriptorPublicKey>,
+) -> Result<(), DescriptorError> {
+    if descriptor.for_any_key(DescriptorPublicKey::has_hardened_step) {
+        Err(DescriptorError::PrivateKeys)
+    } else {
+        Ok(())
+    }
+}
+
 fn descriptor_text_with_optional_checksum(text: &str) -> Result<String, DescriptorError> {
     if text.contains('#') {
         return Ok(text.to_owned());