feat: allow service owner to settle their own service#76
Merged
mikewheeleer merged 1 commit intoJun 24, 2026
Merged
Conversation
Closes Agentpay-Org#13. settle required the global admin's auth, so the owner stored in ServiceMetadata.owner could not settle their own service. Add a caller argument and authorize settlement for either the admin OR that service's registered owner. A non-admin caller with no service metadata is rejected with ServiceMetadataNotFound (Agentpay-Org#13); a non-owner non-admin caller with NotPendingAdmin (Agentpay-Org#6, reused as unauthorized). The owner of service A cannot settle service B. Pause gate, counter-drain, and the settled event are unchanged. Existing settle call sites updated to pass the admin. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #13.
Problem
settlerequired the global admin'srequire_auth(), so the owner stored inServiceMetadata.ownercould not trigger settlement for their own service — every settlement funnelled through the central admin key.Change
settle(caller, agent, service_id)now authorizes either the admin or the registered owner of that specific service.callercaller == ServiceMetadata(service_id).ownerServiceMetadataNotFound(#13)NotPendingAdmin(#6, reused as unauthorized — matchestransfer_service_ownership)Pause gate, counter-drain semantics, and the
settledevent are unchanged. No new error codes. Existingsettlecall sites updated to pass the admin ascaller(ABI adds a leadingcallerargument — intentional).Tests
test_owner_can_settle_own_service,test_admin_can_settle_owned_servicetest_owner_cannot_settle_other_service→#6test_nonadmin_settle_without_metadata_rejected→#13test_owner_settle_rejected_while_paused→#4cargo fmt --all -- --check,cargo build,cargo testall green — 56 passed; 0 failed.Security notes
Owner of service A cannot settle service B; a service with no metadata is admin-only. The owner authorization is strictly scoped to the matching
service_id.