create-dubhe 1.2.0-pre.124 → 1.2.0-pre.125

package/templates/101/sui-template/packages/contracts/src/dubhe/sources/tests/typed_scene_test.move

@@ -310,13 +310,15 @@ fun test_accept_invitation_moves_invitee_to_participants() {
     assert!(!dapp_service::is_participant_in_scene_permit(&permit, alice), 0);
     assert!(dapp_service::is_scene_invitee(dapp_service::scene_permit_meta(&permit), alice), 1);
 
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx);
+    let us_alice = make_us(alice, ctx);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_alice, ctx);
 
     assert!(dapp_service::is_participant_in_scene_permit(&permit, alice), 2);
     assert!(!dapp_service::is_scene_invitee(dapp_service::scene_permit_meta(&permit), alice), 3);
     assert!(dapp_service::is_scene_invitee(dapp_service::scene_permit_meta(&permit), bob), 4);
     assert!(!dapp_service::is_participant_in_scene_permit(&permit, bob), 5);
 
+    dapp_service::destroy_user_storage(us_alice);
     dapp_service::destroy_scene_permit_for_testing(permit);
 }
 
@@ -332,9 +334,11 @@ fun test_accept_invitation_with_expiry_in_window() {
         ctx,
     );
 
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx);
+    let us_alice = make_us(alice, ctx);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_alice, ctx);
     assert!(dapp_service::is_participant_in_scene_permit(&permit, alice), 0);
 
+    dapp_service::destroy_user_storage(us_alice);
     dapp_service::destroy_scene_permit_for_testing(permit);
 }
 
@@ -351,7 +355,9 @@ fun test_accept_invitation_expired_aborts() {
         ctx,
     );
 
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx);
+    let us_alice = make_us(alice, ctx);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_alice, ctx);
+    dapp_service::destroy_user_storage(us_alice);
     dapp_service::destroy_scene_permit_for_testing(permit);
 }
 
@@ -368,7 +374,9 @@ fun test_accept_invitation_not_invited_aborts() {
         ctx,
     );
 
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx);
+    let us_charlie = make_us(charlie, ctx);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_charlie, ctx);
+    dapp_service::destroy_user_storage(us_charlie);
     dapp_service::destroy_scene_permit_for_testing(permit);
 }
 
@@ -385,16 +393,20 @@ fun test_all_invitees_accept_flow() {
         ctx_a,
     );
 
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx_a);
+    let us_alice = make_us(alice, ctx_a);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_alice, ctx_a);
 
     let ctx_b = &mut tx_context::new_from_hint(bob, 0, 0, 0, 0);
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx_b);
+    let us_bob = make_us(bob, ctx_b);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_bob, ctx_b);
 
     assert!(dapp_service::is_participant_in_scene_permit(&permit, alice), 0);
     assert!(dapp_service::is_participant_in_scene_permit(&permit, bob), 1);
     assert!(dapp_service::scene_invitees(dapp_service::scene_permit_meta(&permit)).is_empty(), 2);
     assert!(dapp_service::scene_participant_count(dapp_service::scene_permit_meta(&permit)) == 2, 3);
 
+    dapp_service::destroy_user_storage(us_alice);
+    dapp_service::destroy_user_storage(us_bob);
     dapp_service::destroy_scene_permit_for_testing(permit);
 }
 
@@ -411,8 +423,10 @@ fun test_accept_invitation_twice_aborts() {
         ctx,
     );
 
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx);
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx);
+    let us_alice = make_us(alice, ctx);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_alice, ctx);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_alice, ctx);
+    dapp_service::destroy_user_storage(us_alice);
     dapp_service::destroy_scene_permit_for_testing(permit);
 }
 
@@ -430,7 +444,9 @@ fun test_accept_invitation_on_expired_scene_aborts() {
         ctx,
     );
 
-    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, ctx);
+    let us_alice = make_us(alice, ctx);
+    dapp_system::accept_scene_permit_invitation<SceneKey, SceneKey>(SceneKey {}, &mut permit, &us_alice, ctx);
+    dapp_service::destroy_user_storage(us_alice);
     dapp_service::destroy_scene_permit_for_testing(permit);
 }
 

package/templates/contract/sui-template/src/dubhe/Move.lock

@@ -39,9 +39,3 @@ source = { git = "https://github.com/MystenLabs/sui.git", subdir = "crates/sui-f
 use_environment = "testnet"
 manifest_digest = "7AFB66695545775FBFBB2D3078ADFD084244D5002392E837FDE21D9EA1C6D01C"
 deps = { MoveStdlib = "MoveStdlib" }
-
-[env.mainnet]
-chain-id = "35834a8a"
-original-published-id = "0x6cb54e8bbcf59cc976584330689073500af755b12d85bf4f56d7eea9f232b8aa"
-latest-published-id = "0x6cb54e8bbcf59cc976584330689073500af755b12d85bf4f56d7eea9f232b8aa"
-published-version = "1"

package/templates/contract/sui-template/src/dubhe/sources/systems/dapp_system.move

@@ -278,9 +278,10 @@ public fun delete_field<DappKey: copy + drop>(
 //
 // Reactive writes allow one participant to modify another participant's UserStorage
 // within a shared scene context.  Four-layer security:
-//   1. ctx.sender() must be from.canonical_owner  (only owner can initiate)
-//   2. from must be a registered scene participant
-//   3. target must be a registered scene participant
+//   1. ctx.sender() must be authorized to write `from` (canonical owner or its
+//      active session key — sessions are delegated proxies for in-scene actions)
+//   2. from's canonical owner must be a registered scene participant
+//   3. target's canonical owner must be a registered scene participant
 //   4. scene must be active (not expired)
 //
 // Write fees are charged to the initiator (`from`) under the initiator-pays model.
@@ -304,8 +305,8 @@ public fun set_record_reactive<DappKey: copy + drop, PermType>(
     let scene_id = dapp_service::scene_permit_id(permit);
     let meta     = dapp_service::scene_permit_meta(permit);
 
-    // 1. Sender must be the initiator's canonical owner.
-    error::not_canonical_owner(ctx.sender() == dapp_service::canonical_owner(from));
+    // 1. Sender must be authorized to write `from` (canonical owner or active session key).
+    error::no_permission(dapp_service::is_write_authorized(from, ctx.sender(), ctx.epoch_timestamp_ms()));
     // 2. Initiator must be a scene participant (O(1) DF lookup).
     error::not_scene_participant(dapp_service::is_scene_participant(scene_id, dapp_service::canonical_owner(from)));
     // 3. Target must be a scene participant (O(1) DF lookup).
@@ -343,7 +344,7 @@ public fun set_field_reactive<DappKey: copy + drop, PermType>(
     let scene_id = dapp_service::scene_permit_id(permit);
     let meta     = dapp_service::scene_permit_meta(permit);
 
-    error::not_canonical_owner(ctx.sender() == dapp_service::canonical_owner(from));
+    error::no_permission(dapp_service::is_write_authorized(from, ctx.sender(), ctx.epoch_timestamp_ms()));
     error::not_scene_participant(dapp_service::is_scene_participant(scene_id, dapp_service::canonical_owner(from)));
     error::not_scene_participant(dapp_service::is_scene_participant(scene_id, dapp_service::canonical_owner(target)));
     error::scene_expired(dapp_service::is_scene_active(meta, ctx.epoch_timestamp_ms()));
@@ -504,19 +505,27 @@ public fun remove_object_field<DappKey: copy + drop, ObjType, T: store + copy +
 
 /// Remove and return a native-typed field from a permit-bound SceneStorage Bag.
 /// Emits a Dubhe_Scene_DeleteField event so off-chain indexers stay in sync.
+/// The caller identifies as `user_storage`'s canonical owner; the transaction may be
+/// signed by the canonical owner or its active session key (is_write_authorized).
 public fun remove_scene_field<DappKey: copy + drop, PermType, SceneType, T: store + copy + drop>(
-    _auth:      DappKey,
-    permit:     &ScenePermit<PermType>,
-    storage:    &mut SceneStorage<SceneType>,
-    field_name: vector<u8>,
-    ctx:        &TxContext,
+    _auth:        DappKey,
+    permit:       &ScenePermit<PermType>,
+    storage:      &mut SceneStorage<SceneType>,
+    user_storage: &UserStorage,
+    field_name:   vector<u8>,
+    ctx:          &TxContext,
 ): T {
     let dapp_key_str = type_info::get_type_name_string<DappKey>();
     error::dapp_key_mismatch(dapp_service::scene_storage_dapp_key(storage) == dapp_key_str);
     error::dapp_key_mismatch(dapp_service::scene_permit_dapp_key(permit) == dapp_key_str);
+    error::dapp_key_mismatch(dapp_service::user_storage_dapp_key(user_storage) == dapp_key_str);
     assert_scene_storage_bound_to_permit(permit, storage);
-    error::scene_expired(dapp_service::is_scene_active(dapp_service::scene_permit_meta(permit), ctx.epoch_timestamp_ms()));
-    error::not_scene_participant(dapp_service::is_participant_in_scene_permit(permit, ctx.sender()));
+    let now_ms = ctx.epoch_timestamp_ms();
+    error::scene_expired(dapp_service::is_scene_active(dapp_service::scene_permit_meta(permit), now_ms));
+    error::no_permission(dapp_service::is_write_authorized(user_storage, ctx.sender(), now_ms));
+    error::not_scene_participant(dapp_service::is_participant_in_scene_permit(
+        permit, dapp_service::canonical_owner(user_storage)
+    ));
 
     let scene_type = *dapp_service::scene_storage_type(storage);
     let scene_id   = sui::object::uid_to_address(dapp_service::scene_storage_id(storage));
@@ -729,20 +738,28 @@ public fun share_scene_storage<DappKey: copy + drop, SceneType>(
 }
 
 /// Write a native-typed field into a permit-bound SceneStorage Bag and emit an event.
+/// The caller identifies as `user_storage`'s canonical owner; the transaction may be
+/// signed by the canonical owner or its active session key (is_write_authorized).
 public fun set_scene_field<DappKey: copy + drop, PermType, SceneType, T: store + copy + drop>(
-    _auth:      DappKey,
-    permit:     &ScenePermit<PermType>,
-    storage:    &mut SceneStorage<SceneType>,
-    field_name: vector<u8>,
-    value:      T,
-    ctx:        &TxContext,
+    _auth:        DappKey,
+    permit:       &ScenePermit<PermType>,
+    storage:      &mut SceneStorage<SceneType>,
+    user_storage: &UserStorage,
+    field_name:   vector<u8>,
+    value:        T,
+    ctx:          &TxContext,
 ) {
     let dapp_key_str = type_info::get_type_name_string<DappKey>();
     error::dapp_key_mismatch(dapp_service::scene_storage_dapp_key(storage) == dapp_key_str);
     error::dapp_key_mismatch(dapp_service::scene_permit_dapp_key(permit) == dapp_key_str);
+    error::dapp_key_mismatch(dapp_service::user_storage_dapp_key(user_storage) == dapp_key_str);
     assert_scene_storage_bound_to_permit(permit, storage);
-    error::scene_expired(dapp_service::is_scene_active(dapp_service::scene_permit_meta(permit), ctx.epoch_timestamp_ms()));
-    error::not_scene_participant(dapp_service::is_participant_in_scene_permit(permit, ctx.sender()));
+    let now_ms = ctx.epoch_timestamp_ms();
+    error::scene_expired(dapp_service::is_scene_active(dapp_service::scene_permit_meta(permit), now_ms));
+    error::no_permission(dapp_service::is_write_authorized(user_storage, ctx.sender(), now_ms));
+    error::not_scene_participant(dapp_service::is_participant_in_scene_permit(
+        permit, dapp_service::canonical_owner(user_storage)
+    ));
 
     let event_bytes = sui::bcs::to_bytes(&value);
     dapp_service::set_scene_field(storage, field_name, value);
@@ -829,19 +846,25 @@ public fun destroy_scene_permit<DappKey: copy + drop, PermType>(
 }
 
 /// Helper: accept a scene invitation for a ScenePermit-backed scene.
-/// Moves ctx.sender() from the invitees list to confirmed participants.
+/// Moves the caller's canonical owner from the invitees list to confirmed
+/// participants. The transaction may be signed by the canonical owner or its
+/// active session key (is_write_authorized) — the registered identity is
+/// always the canonical owner address.
 /// Guards: scene must be active AND the invitation window must not have expired.
 public fun accept_scene_permit_invitation<DappKey: copy + drop, PermType>(
-    _auth:   DappKey,
-    permit:  &mut ScenePermit<PermType>,
-    ctx:     &TxContext,
+    _auth:        DappKey,
+    permit:       &mut ScenePermit<PermType>,
+    user_storage: &UserStorage,
+    ctx:          &TxContext,
 ) {
     let dapp_key_str = type_info::get_type_name_string<DappKey>();
     error::dapp_key_mismatch(dapp_service::scene_permit_dapp_key(permit) == dapp_key_str);
+    error::dapp_key_mismatch(dapp_service::user_storage_dapp_key(user_storage) == dapp_key_str);
 
     // Check both permit activity and invitation window before mutating.
     // The immutable borrow of `meta` is released at the end of this block.
     let now_ms = ctx.epoch_timestamp_ms();
+    error::no_permission(dapp_service::is_write_authorized(user_storage, ctx.sender(), now_ms));
     {
         let meta = dapp_service::scene_permit_meta(permit);
         error::scene_expired(dapp_service::is_scene_active(meta, now_ms));
@@ -851,54 +874,71 @@ public fun accept_scene_permit_invitation<DappKey: copy + drop, PermType>(
         };
     };
 
-    dapp_service::accept_invitation_in_scene_permit(permit, ctx.sender());
+    let owner = dapp_service::canonical_owner(user_storage);
+    dapp_service::accept_invitation_in_scene_permit(permit, owner);
     dubhe_events::emit_scene_permit_accept(
         dapp_key_str,
         *dapp_service::scene_permit_type(permit),
         sui::object::uid_to_address(dapp_service::scene_permit_id(permit)),
-        ctx.sender(),
+        owner,
     );
 }
 
-/// Helper: add the caller as a confirmed participant in a ScenePermit.
+/// Helper: add the caller's canonical owner as a confirmed participant in a
+/// ScenePermit. The transaction may be signed by the canonical owner or its
+/// active session key (is_write_authorized) — the registered identity is
+/// always the canonical owner address.
 /// The permit must still be active — joining an expired permit is meaningless and
 /// wastes gas on a DF write that can never be used for reactive writes.
 public fun join_scene_permit<DappKey: copy + drop, PermType>(
-    _auth:  DappKey,
-    permit: &mut ScenePermit<PermType>,
-    ctx:    &TxContext,
+    _auth:        DappKey,
+    permit:       &mut ScenePermit<PermType>,
+    user_storage: &UserStorage,
+    ctx:          &TxContext,
 ) {
     let dapp_key_str = type_info::get_type_name_string<DappKey>();
     error::dapp_key_mismatch(dapp_service::scene_permit_dapp_key(permit) == dapp_key_str);
-    error::scene_expired(dapp_service::is_scene_active(dapp_service::scene_permit_meta(permit), ctx.epoch_timestamp_ms()));
-    let was_participant = dapp_service::is_participant_in_scene_permit(permit, ctx.sender());
-    dapp_service::add_participant_in_scene_permit(permit, ctx.sender());
+    error::dapp_key_mismatch(dapp_service::user_storage_dapp_key(user_storage) == dapp_key_str);
+    let now_ms = ctx.epoch_timestamp_ms();
+    error::scene_expired(dapp_service::is_scene_active(dapp_service::scene_permit_meta(permit), now_ms));
+    error::no_permission(dapp_service::is_write_authorized(user_storage, ctx.sender(), now_ms));
+    let owner = dapp_service::canonical_owner(user_storage);
+    let was_participant = dapp_service::is_participant_in_scene_permit(permit, owner);
+    dapp_service::add_participant_in_scene_permit(permit, owner);
     if (!was_participant) {
         dubhe_events::emit_scene_permit_join(
             dapp_key_str,
             *dapp_service::scene_permit_type(permit),
             sui::object::uid_to_address(dapp_service::scene_permit_id(permit)),
-            ctx.sender(),
+            owner,
         );
     };
 }
 
-/// Helper: remove the caller from participants in a SceneStorage scene.
+/// Helper: remove the caller's canonical owner from participants in a
+/// SceneStorage scene. The transaction may be signed by the canonical owner or
+/// its active session key (is_write_authorized).
 public fun leave_scene_permit<DappKey: copy + drop, PermType>(
-    _auth:  DappKey,
-    permit: &mut ScenePermit<PermType>,
-    ctx:    &TxContext,
+    _auth:        DappKey,
+    permit:       &mut ScenePermit<PermType>,
+    user_storage: &UserStorage,
+    ctx:          &TxContext,
 ) {
     let dapp_key_str = type_info::get_type_name_string<DappKey>();
     error::dapp_key_mismatch(dapp_service::scene_permit_dapp_key(permit) == dapp_key_str);
-    let was_participant = dapp_service::is_participant_in_scene_permit(permit, ctx.sender());
-    dapp_service::remove_participant_in_scene_permit(permit, ctx.sender());
+    error::dapp_key_mismatch(dapp_service::user_storage_dapp_key(user_storage) == dapp_key_str);
+    error::no_permission(dapp_service::is_write_authorized(
+        user_storage, ctx.sender(), ctx.epoch_timestamp_ms()
+    ));
+    let owner = dapp_service::canonical_owner(user_storage);
+    let was_participant = dapp_service::is_participant_in_scene_permit(permit, owner);
+    dapp_service::remove_participant_in_scene_permit(permit, owner);
     if (was_participant) {
         dubhe_events::emit_scene_permit_leave(
             dapp_key_str,
             *dapp_service::scene_permit_type(permit),
             sui::object::uid_to_address(dapp_service::scene_permit_id(permit)),
-            ctx.sender(),
+            owner,
         );
     };
 }

package/templates/contract/sui-template/src/dubhe/sources/tests/scene_session_test.move

@@ -0,0 +1,269 @@
+/// Unit tests — Session keys acting in scenes
+///
+/// Sessions are delegated proxies: a transaction signed by an active session
+/// key must be able to perform in-scene actions on behalf of its canonical
+/// owner, while the on-chain identity (permit participants, scene events)
+/// always resolves to the canonical owner address.
+///
+/// Covers:
+///   reactive writes:
+///     session key may initiate set_record_reactive / set_field_reactive
+///     expired session is rejected
+///     stranger (neither owner nor session) is rejected
+///   permit participation:
+///     join_scene_permit registers the canonical owner, not the session address
+///     accept_scene_permit_invitation moves the canonical owner to participants
+///     leave_scene_permit removes the canonical owner
+///     unauthorized sender cannot join on someone else's behalf
+///   scene field writes:
+///     session key may set_scene_field / remove_scene_field
+///     non-participant canonical owner is rejected
+#[test_only]
+module dubhe::scene_session_test;
+
+use dubhe::dapp_service::{Self, UserStorage, ScenePermit};
+use dubhe::dapp_system;
+use sui::bcs::to_bytes;
+use sui::tx_context;
+
+public struct SceneSessionKey has copy, drop {}
+
+const OWNER:   address = @0xA1;
+const SESSION: address = @0xA2;
+const PEER:    address = @0xB1;
+const OTHER:   address = @0xC1;
+
+const NOW:             u64 = 1_000;
+const SESSION_EXPIRES: u64 = 10_000;
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+fun make_us(owner: address, ctx: &mut TxContext): UserStorage {
+    dapp_service::create_user_storage_for_testing<SceneSessionKey>(owner, ctx)
+}
+
+/// UserStorage owned by `owner` with an active session key bound to SESSION.
+fun make_us_with_session(owner: address, ctx: &mut TxContext): UserStorage {
+    let mut us = make_us(owner, ctx);
+    dapp_service::set_session_key_for_testing(&mut us, SESSION, SESSION_EXPIRES);
+    us
+}
+
+fun make_permit(
+    participants: vector<address>,
+    ctx:          &mut TxContext,
+): ScenePermit<SceneSessionKey> {
+    dapp_service::create_scene_permit_for_testing<SceneSessionKey, SceneSessionKey>(
+        participants, std::option::none(), std::option::none(), ctx,
+    )
+}
+
+/// Transaction context whose sender is `sender` at epoch time NOW.
+fun ctx_for(sender: address): TxContext {
+    tx_context::new_from_hint(sender, 0, 0, NOW, 0)
+}
+
+fun key_for(name: vector<u8>): vector<vector<u8>> { vector[name] }
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// Reactive writes initiated by a session key
+// ═══════════════════════════════════════════════════════════════════════════════
+
+#[test]
+fun test_session_can_initiate_reactive_write() {
+    let mut ctx = ctx_for(SESSION);
+
+    let permit     = make_permit(vector[OWNER, PEER], &mut ctx);
+    let mut from   = make_us_with_session(OWNER, &mut ctx);
+    let mut target = make_us(PEER, &mut ctx);
+
+    dapp_system::set_record_reactive<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &permit, &mut from, &mut target,
+        key_for(b"hp"), vector[b"v"], vector[to_bytes(&100u64)], &mut ctx,
+    );
+    dapp_system::set_field_reactive<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &permit, &mut from, &mut target,
+        key_for(b"hp"), b"v", to_bytes(&80u64), &mut ctx,
+    );
+
+    assert!(dapp_service::has_user_record<SceneSessionKey>(&target, key_for(b"hp")), 0);
+    // Fees are charged to the initiator's storage, not the target's.
+    assert!(dapp_service::write_count(&from) == 2, 1);
+    assert!(dapp_service::write_count(&target) == 0, 2);
+
+    dapp_service::destroy_user_storage(from);
+    dapp_service::destroy_user_storage(target);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+}
+
+#[test]
+#[expected_failure]
+fun test_expired_session_reactive_aborts() {
+    // Session expires exactly at SESSION_EXPIRES — a transaction at that time is rejected.
+    let mut ctx = tx_context::new_from_hint(SESSION, 0, 0, SESSION_EXPIRES, 0);
+
+    let permit     = make_permit(vector[OWNER, PEER], &mut ctx);
+    let mut from   = make_us_with_session(OWNER, &mut ctx);
+    let mut target = make_us(PEER, &mut ctx);
+
+    dapp_system::set_record_reactive<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &permit, &mut from, &mut target,
+        key_for(b"hp"), vector[b"v"], vector[to_bytes(&100u64)], &mut ctx,
+    );
+
+    dapp_service::destroy_user_storage(from);
+    dapp_service::destroy_user_storage(target);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+}
+
+#[test]
+#[expected_failure]
+fun test_stranger_reactive_aborts() {
+    let mut ctx = ctx_for(OTHER);
+
+    let permit     = make_permit(vector[OWNER, PEER], &mut ctx);
+    let mut from   = make_us_with_session(OWNER, &mut ctx);
+    let mut target = make_us(PEER, &mut ctx);
+
+    dapp_system::set_record_reactive<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &permit, &mut from, &mut target,
+        key_for(b"hp"), vector[b"v"], vector[to_bytes(&100u64)], &mut ctx,
+    );
+
+    dapp_service::destroy_user_storage(from);
+    dapp_service::destroy_user_storage(target);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// Permit participation through a session key registers the canonical owner
+// ═══════════════════════════════════════════════════════════════════════════════
+
+#[test]
+fun test_session_join_registers_canonical_owner() {
+    let mut ctx = ctx_for(SESSION);
+
+    let mut permit = make_permit(vector[], &mut ctx);
+    let us = make_us_with_session(OWNER, &mut ctx);
+
+    dapp_system::join_scene_permit<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &mut permit, &us, &ctx,
+    );
+
+    assert!(dapp_service::is_participant_in_scene_permit(&permit, OWNER), 0);
+    assert!(!dapp_service::is_participant_in_scene_permit(&permit, SESSION), 1);
+
+    dapp_service::destroy_user_storage(us);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+}
+
+#[test]
+fun test_session_accept_invitation_registers_canonical_owner() {
+    let mut ctx = ctx_for(SESSION);
+
+    let mut permit = dapp_service::create_scene_permit_with_invitations_for_testing<
+        SceneSessionKey, SceneSessionKey
+    >(vector[OWNER], std::option::none(), std::option::none(), &mut ctx);
+    let us = make_us_with_session(OWNER, &mut ctx);
+
+    dapp_system::accept_scene_permit_invitation<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &mut permit, &us, &ctx,
+    );
+
+    assert!(dapp_service::is_participant_in_scene_permit(&permit, OWNER), 0);
+    assert!(!dapp_service::is_participant_in_scene_permit(&permit, SESSION), 1);
+
+    dapp_service::destroy_user_storage(us);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+}
+
+#[test]
+fun test_session_leave_removes_canonical_owner() {
+    let mut ctx = ctx_for(SESSION);
+
+    let mut permit = make_permit(vector[OWNER], &mut ctx);
+    let us = make_us_with_session(OWNER, &mut ctx);
+
+    dapp_system::leave_scene_permit<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &mut permit, &us, &ctx,
+    );
+
+    assert!(!dapp_service::is_participant_in_scene_permit(&permit, OWNER), 0);
+
+    dapp_service::destroy_user_storage(us);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+}
+
+#[test]
+#[expected_failure]
+fun test_join_unauthorized_sender_aborts() {
+    // OTHER is neither the canonical owner nor the session key of `us`.
+    let mut ctx = ctx_for(OTHER);
+
+    let mut permit = make_permit(vector[], &mut ctx);
+    let us = make_us_with_session(OWNER, &mut ctx);
+
+    dapp_system::join_scene_permit<SceneSessionKey, SceneSessionKey>(
+        SceneSessionKey {}, &mut permit, &us, &ctx,
+    );
+
+    dapp_service::destroy_user_storage(us);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// Scene field writes through a session key
+// ═══════════════════════════════════════════════════════════════════════════════
+
+#[test]
+fun test_session_set_and_remove_scene_field() {
+    let mut ctx = ctx_for(SESSION);
+
+    let ds     = dapp_service::create_dapp_storage_for_testing<SceneSessionKey>(&mut ctx);
+    let permit = make_permit(vector[OWNER], &mut ctx);
+    let us     = make_us_with_session(OWNER, &mut ctx);
+
+    let mut scene = dapp_system::new_typed_scene_with_permit<
+        SceneSessionKey, SceneSessionKey, SceneSessionKey
+    >(SceneSessionKey {}, &ds, &permit, b"battle", &mut ctx);
+
+    dapp_system::set_scene_field<SceneSessionKey, SceneSessionKey, SceneSessionKey, u64>(
+        SceneSessionKey {}, &permit, &mut scene, &us, b"hp", 100u64, &ctx,
+    );
+    assert!(dapp_system::get_scene_field<SceneSessionKey, u64>(&scene, b"hp") == 100, 0);
+
+    let removed: u64 = dapp_system::remove_scene_field<
+        SceneSessionKey, SceneSessionKey, SceneSessionKey, u64
+    >(SceneSessionKey {}, &permit, &mut scene, &us, b"hp", &ctx);
+    assert!(removed == 100, 1);
+
+    dapp_system::destroy_typed_scene<SceneSessionKey, SceneSessionKey>(SceneSessionKey {}, scene);
+    dapp_service::destroy_user_storage(us);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+    dapp_system::destroy_dapp_storage(ds);
+}
+
+#[test]
+#[expected_failure]
+fun test_scene_field_non_participant_aborts() {
+    // `us` belongs to OTHER who never joined the permit — write must abort
+    // even though OTHER signed the transaction themselves.
+    let mut ctx = ctx_for(OTHER);
+
+    let ds     = dapp_service::create_dapp_storage_for_testing<SceneSessionKey>(&mut ctx);
+    let permit = make_permit(vector[OWNER], &mut ctx);
+    let us     = make_us(OTHER, &mut ctx);
+
+    let mut scene = dapp_system::new_typed_scene_with_permit<
+        SceneSessionKey, SceneSessionKey, SceneSessionKey
+    >(SceneSessionKey {}, &ds, &permit, b"battle", &mut ctx);
+
+    dapp_system::set_scene_field<SceneSessionKey, SceneSessionKey, SceneSessionKey, u64>(
+        SceneSessionKey {}, &permit, &mut scene, &us, b"hp", 100u64, &ctx,
+    );
+
+    dapp_system::destroy_typed_scene<SceneSessionKey, SceneSessionKey>(SceneSessionKey {}, scene);
+    dapp_service::destroy_user_storage(us);
+    dapp_service::destroy_scene_permit_for_testing(permit);
+    dapp_system::destroy_dapp_storage(ds);
+}