test(7.15): assert fail-closed signing contracts

Author: BitHighlander

tests/test_msg_ethereum_clear_signing.py

@@ -1012,15 +1012,26 @@ def test_binding_happy_path_signs_and_recovers(self):
     def _clearsign_flow(self, flow, chain_id=1):
         """Run one catalog flow END-TO-END with AdvancedMode ON: real tx,
         per-tx-bound metadata, who/what/why annotation plus the ordinary raw
-        review (auto-acked), sign, and assert the signature recovers to the
-        device signer over this exact digest."""
+        review (auto-acked), then either sign and recover the exact digest or
+        assert the release policy's explicit fail-closed rejection."""
         n = parse_path(DEVICE_PATH)
         tx_hash = flow_tx_hash(flow, chain_id)
         resp = self.client.ethereum_send_tx_metadata(
             signed_payload=flow_blob(flow, chain_id),
             metadata_version=1, key_id=TEST_KEY_ID)
         self.assertEqual(resp.classification, CLASSIFICATION_VERIFIED)
 
+        if flow['key'] == 'erc20-approve-unlimited':
+            with self.assertRaises(CallException) as ctx:
+                self.client.ethereum_sign_tx(
+                    n=n, nonce=FLOW_NONCE, gas_price=FLOW_GAS_PRICE,
+                    gas_limit=FLOW_GAS_LIMIT, to=flow['to'],
+                    value=flow['value'], data=flow['data'],
+                    chain_id=chain_id)
+            self.assertIn('Unlimited ERC20 approval is disabled',
+                          str(ctx.exception))
+            return
+
         sig_v, sig_r, sig_s = self.client.ethereum_sign_tx(
             n=n, nonce=FLOW_NONCE, gas_price=FLOW_GAS_PRICE,
             gas_limit=FLOW_GAS_LIMIT, to=flow['to'], value=flow['value'],

tests/test_msg_osmosis_validation.py

@@ -31,16 +31,19 @@ def _assert_missing_parameter_failure(self, ack):
         self.assertEqual(ret.code, proto_types.Failure_FirmwareError)
         self.assertEndsWith(ret.message, "missing required parameters")
 
-    def test_present_but_empty_amount_is_rejected_before_review(self):
+    def test_present_but_empty_amount_is_rejected_as_invalid(self):
         self._start_signing()
         send = osmosis_proto.OsmosisMsgSend(
             to_address="osmo1g9el7lzjwh9yun2c4jjzhy09j98vkhfx8tzcpt",
             amount="",
             denom="uosmo",
         )
         self.assertTrue(send.HasField("amount"))
-        self._assert_missing_parameter_failure(
-            osmosis_proto.OsmosisMsgAck(send=send))
+        ret = self.client.call_raw(osmosis_proto.OsmosisMsgAck(send=send))
+        self.assertIsInstance(ret, proto.Failure)
+        self.assertEqual(ret.code, proto_types.Failure_SyntaxError)
+        self.assertEndsWith(ret.message,
+                            "Invalid Osmosis amount or denomination")
 
     def test_ibc_omitted_amount_and_receiver_are_rejected_before_review(self):
         self._start_signing()