trac-msb 0.2.4 → 0.2.6

package/tests/unit/state/apply/addIndexer/state.apply.addIndexer.test.js

@@ -0,0 +1,297 @@
+import b4a from 'b4a';
+import addIndexerHappyPathScenario from './addIndexerHappyPathScenario.js';
+import addIndexerMultipleIndexersInTheNetworkScenario from './addIndexerMultipleIndexersInTheNetworkScenario.js';
+import addIndexerRemoveAndReAddScenario from './addIndexerRemoveAndReAddScenario.js';
+import addIndexerWriterKeyAlreadyRegisteredScenario from './addIndexerWriterKeyAlreadyRegisteredScenario.js';
+import AdminControlOperationValidationScenario from '../common/adminControlOperationValidationScenario.js';
+import RequesterAddressValidationScenario from '../common/requesterAddressValidationScenario.js';
+import createRequesterPublicKeyValidationScenario from '../common/requesterPublicKeyValidationScenario.js';
+import InvalidAddressValidationScenario from '../common/payload-structure/invalidAddressValidationScenario.js';
+import createAddressWithInvalidPublicKeyScenario from '../common/payload-structure/addressWithInvalidPublicKeyScenario.js';
+import AdminEntryMissingScenario from '../common/access-control/adminEntryMissingScenario.js';
+import AdminEntryDecodeFailureScenario from '../common/access-control/adminEntryDecodeFailureScenario.js';
+import AdminOnlyGuardScenario from '../common/access-control/adminOnlyGuardScenario.js';
+import AdminPublicKeyDecodeFailureScenario from '../common/access-control/adminPublicKeyDecodeFailureScenario.js';
+import AdminConsistencyMismatchScenario from '../common/access-control/adminConsistencyMismatchScenario.js';
+import InvalidHashValidationScenario from '../common/payload-structure/invalidHashValidationScenario.js';
+import InvalidSignatureValidationScenario, {
+	SignatureMutationStrategy
+} from '../common/payload-structure/invalidSignatureValidationScenario.js';
+import IndexerSequenceStateInvalidScenario from '../common/indexer/indexerSequenceStateInvalidScenario.js';
+import TransactionValidityMismatchScenario from '../common/transactionValidityMismatchScenario.js';
+import OperationAlreadyAppliedScenario from '../common/operationAlreadyAppliedScenario.js';
+import RequesterBalanceScenarioBase from '../common/balances/base/requesterBalanceScenarioBase.js';
+import RequesterBalanceInsufficientScenario from '../common/balances/requesterBalanceInsufficientScenario.js';
+import RequesterBalanceFeeApplicationFailureScenario from '../common/balances/requesterBalanceFeeApplicationFailureScenario.js';
+import addIndexerPretenderNotWriterScenario from './addIndexerPretenderNotWriterScenario.js';
+import addIndexerPretenderAlreadyIndexerScenario from './addIndexerPretenderAlreadyIndexerScenario.js';
+import IndexerNodeEntryMissingScenario from '../common/indexer/indexerNodeEntryMissingScenario.js';
+import IndexerNodeEntryDecodeFailureScenario from '../common/indexer/indexerNodeEntryDecodeFailureScenario.js';
+import IndexerRoleUpdateFailureScenario from '../common/indexer/indexerRoleUpdateFailureScenario.js';
+import FeeDecodeFailureScenario from '../common/balances/feeDecodeFailureScenario.js';
+import RequesterNodeEntryMissingScenario from '../common/requester/requesterNodeEntryMissingScenario.js';
+import OperationValidationScenarioBase from '../common/base/OperationValidationScenarioBase.js';
+import { applyWithRequesterEntryCorruption } from '../addWriter/addWriterScenarioHelpers.js';
+import {
+	setupAddIndexerScenario,
+	buildAddIndexerPayload,
+	buildAddIndexerPayloadWithTxValidity,
+	assertAddIndexerFailureState,
+	assertAddIndexerSuccessState,
+	selectIndexerCandidatePeer,
+	applyWithIndexerRoleUpdateFailure
+} from './addIndexerScenarioHelpers.js';
+
+addIndexerHappyPathScenario();
+addIndexerMultipleIndexersInTheNetworkScenario();
+addIndexerRemoveAndReAddScenario();
+
+// Handler validation order
+new AdminControlOperationValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when contract schema validation fails',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	expectedLogs: ['Contract schema validation failed.']
+}).performScenario();
+
+new RequesterAddressValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when requester address is invalid',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	expectedLogs: ['Requester address is invalid.']
+}).performScenario();
+
+createRequesterPublicKeyValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when requester public key is invalid',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	expectedLogs: ['Error while decoding requester public key.']
+}).performScenario();
+
+new InvalidAddressValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when pretending indexer address is invalid',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	addressPath: ['aco', 'ia'],
+	expectedLogs: ['Pretending indexer address is invalid.']
+}).performScenario();
+
+createAddressWithInvalidPublicKeyScenario({
+	title: 'State.apply addIndexer rejects payloads when pretending indexer public key is invalid',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	addressPath: ['aco', 'ia'],
+	expectedLogs: ['Failed to decode pretending indexer public key.']
+}).performScenario();
+
+new AdminEntryMissingScenario({
+	title: 'State.apply addIndexer rejects payloads when admin entry is missing',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['Invalid admin entry.']
+}).performScenario();
+
+new AdminEntryDecodeFailureScenario({
+	title: 'State.apply addIndexer rejects payloads when admin entry cannot be decoded',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['Failed to decode admin entry.']
+}).performScenario();
+
+new AdminOnlyGuardScenario({
+	title: 'State.apply addIndexer rejects non-admin nodes',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['Node is not allowed to perform this operation. (ADMIN ONLY)']
+}).performScenario();
+
+new AdminPublicKeyDecodeFailureScenario({
+	title: 'State.apply addIndexer rejects payloads when admin public key cannot be decoded',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['Failed to decode admin public key.']
+}).performScenario();
+
+new AdminConsistencyMismatchScenario({
+	title: 'State.apply addIndexer rejects payloads when admin public key mismatches requester',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['System admin and node public keys do not match.']
+}).performScenario();
+
+new InvalidHashValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when message hash mismatches tx hash',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	expectedLogs: ['Message hash does not match the tx_hash.']
+}).performScenario();
+
+new InvalidSignatureValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when admin signature is invalid (foreign signature)',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	expectedLogs: ['Failed to verify message signature.']
+}).performScenario();
+
+new InvalidSignatureValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when admin signature is invalid (zero fill)',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	strategy: SignatureMutationStrategy.ZERO_FILL,
+	expectedLogs: ['Failed to verify message signature.']
+}).performScenario();
+
+new InvalidSignatureValidationScenario({
+	title: 'State.apply addIndexer rejects payloads when admin signature is invalid (type mismatch)',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	strategy: SignatureMutationStrategy.TYPE_MISMATCH,
+	expectedLogs: ['Failed to verify message signature.']
+}).performScenario();
+
+new IndexerSequenceStateInvalidScenario({
+	title: 'State.apply addIndexer rejects payloads when indexer sequence state is invalid',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['Indexer sequence state is invalid.']
+}).performScenario();
+
+new TransactionValidityMismatchScenario({
+	title: 'State.apply addIndexer rejects payloads when transaction validity mismatches indexer state',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: assertAddIndexerFailureState,
+	txValidityPath: ['aco', 'txv'],
+	rebuildPayloadWithTxValidity: ({ context, mutatedTxValidity }) =>
+		buildAddIndexerPayloadWithTxValidity(context, mutatedTxValidity),
+	expectedLogs: ['Transaction was not executed.']
+}).performScenario();
+
+new OperationAlreadyAppliedScenario({
+	title: 'State.apply addIndexer rejects payloads when operation was already applied',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context, validPayload) =>
+		assertAddIndexerSuccessState(t, context, {
+			writerPeer: context.addIndexerScenario?.writerPeer ?? selectIndexerCandidatePeer(context),
+			adminPeer: context.adminBootstrap,
+			writerEntryBefore: context.addIndexerScenario?.writerEntryBefore,
+			adminEntryBefore: context.addIndexerScenario?.adminEntryBefore,
+			payload: validPayload
+		}),
+	expectedLogs: ['Operation has already been applied.']
+}).performScenario();
+
+new IndexerNodeEntryMissingScenario({
+	title: 'State.apply addIndexer rejects payloads when target indexer entry is missing',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	selectPeer: context => context.addIndexerScenario?.writerPeer ?? selectIndexerCandidatePeer(context),
+	expectedLogs: ['Failed to verify target indexer entry.']
+}).performScenario();
+
+new IndexerNodeEntryDecodeFailureScenario({
+	title: 'State.apply addIndexer rejects payloads when target indexer entry cannot be decoded',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	selectPeer: context => context.addIndexerScenario?.writerPeer ?? selectIndexerCandidatePeer(context),
+	expectedLogs: ['Failed to decode pretender indexer node entry.']
+}).performScenario();
+
+addIndexerPretenderNotWriterScenario();
+addIndexerPretenderAlreadyIndexerScenario();
+
+new IndexerRoleUpdateFailureScenario({
+	title: 'State.apply addIndexer rejects payloads when node role update fails',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	applyRoleMutationFailure: applyWithIndexerRoleUpdateFailure,
+	expectedLogs: ['Failed to update node role.']
+}).performScenario();
+
+addIndexerWriterKeyAlreadyRegisteredScenario();
+
+new FeeDecodeFailureScenario({
+	title: 'State.apply addIndexer rejects payloads when fee cannot be decoded',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	selectNode: context => context.adminBootstrap,
+	expectedLogs: ['Invalid fee amount.']
+}).performScenario();
+
+new RequesterNodeEntryMissingScenario({
+	title: 'State.apply addIndexer rejects payloads when requester node entry is missing',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	selectPeer: context => context.adminBootstrap,
+	expectedLogs: ['Invalid requester node entry buffer.']
+}).performScenario();
+
+new OperationValidationScenarioBase({
+	title: 'State.apply addIndexer rejects payloads when requester node entry cannot be decoded',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	mutatePayload: (_t, payload) => payload,
+	applyInvalidPayload: (context, invalidPayload) =>
+		applyWithRequesterEntryCorruption(context, invalidPayload, { peer: context.adminBootstrap }),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['Failed to decode requester node entry.']
+}).performScenario();
+
+new RequesterBalanceScenarioBase({
+	title: 'State.apply addIndexer rejects payloads when admin balance cannot be decoded',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	mutateDecodedEntry: decoded => ({ ...decoded, balance: b4a.alloc(1) }),
+	selectPeer: context => context.adminBootstrap,
+	expectedLogs: ['Invalid admin balance.']
+}).performScenario();
+
+new RequesterBalanceInsufficientScenario({
+	title: 'State.apply addIndexer rejects payloads when requester balance is insufficient',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	selectPeer: context => context.adminBootstrap,
+	expectedLogs: ['Insufficient requester balance.']
+}).performScenario();
+
+new RequesterBalanceFeeApplicationFailureScenario({
+	title: 'State.apply addIndexer rejects payloads when requester fee cannot be applied',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	selectPeer: context => context.adminBootstrap,
+	expectedLogs: ['Failed to apply fee to requester balance.']
+}).performScenario();
+
+new RequesterBalanceScenarioBase({
+	title: 'State.apply addIndexer rejects payloads when requester balance update fails',
+	setupScenario: setupAddIndexerScenario,
+	buildValidPayload: context => buildAddIndexerPayload(context),
+	assertStateUnchanged: (t, context) => assertAddIndexerFailureState(t, context, { skipSync: true }),
+	selectPeer: context => context.adminBootstrap,
+	failNextBalanceUpdate: true,
+	expectedLogs: ['Failed to update requester node.']
+}).performScenario();

package/tests/unit/state/apply/addWriter/addWriterHappyPathScenario.js

@@ -0,0 +1,41 @@
+import { test } from 'brittle';
+import b4a from 'b4a';
+import { eventFlush } from '../../../../helpers/autobaseTestHelpers.js';
+import nodeEntryUtils from '../../../../../src/core/state/utils/nodeEntry.js';
+import {
+	setupAddWriterScenario,
+	selectWriterPeer,
+	buildAddWriterPayload,
+	assertAddWriterSuccessState
+} from './addWriterScenarioHelpers.js';
+
+export default function addWriterHappyPathScenario() {
+	test('State.apply addWriter promotes whitelisted nodes via validator cosignature - happy path', async t => {
+		const context = await setupAddWriterScenario(t);
+		const validatorPeer = context.adminBootstrap;
+		const writerPeer = selectWriterPeer(context);
+
+		const adminEntryBefore = await validatorPeer.base.view.get(validatorPeer.wallet.address);
+		t.ok(adminEntryBefore, 'admin entry exists before addWriter');
+		const decodedAdminBefore = nodeEntryUtils.decode(adminEntryBefore.value);
+		t.ok(decodedAdminBefore, 'admin entry decodes before addWriter');
+		const adminBalanceBefore = b4a.from(decodedAdminBefore.balance);
+
+		const payload = await buildAddWriterPayload(context, {
+			readerPeer: writerPeer,
+			validatorPeer
+		});
+
+		await validatorPeer.base.append(payload);
+		await validatorPeer.base.update();
+		await eventFlush();
+
+		await assertAddWriterSuccessState(t, context, {
+			readerPeer: writerPeer,
+			validatorPeer,
+			writerInitialBalance: context.addWriterScenario?.writerInitialBalance,
+			validatorBalanceBefore: adminBalanceBefore,
+			payload
+		});
+	});
+}

package/tests/unit/state/apply/addWriter/addWriterInvalidValidatorSignatureScenario.js

@@ -0,0 +1,32 @@
+import b4a from 'b4a';
+import OperationValidationScenarioBase from '../common/base/OperationValidationScenarioBase.js';
+import { safeDecodeApplyOperation, safeEncodeApplyOperation } from '../../../../../src/utils/protobuf/operationHelpers.js';
+import {
+	setupAddWriterScenario,
+	buildAddWriterPayload,
+	assertAddWriterFailureState,
+	applyWithRoleAccessBypass
+} from './addWriterScenarioHelpers.js';
+
+function mutateValidatorSignature(t, validPayload) {
+	const decoded = safeDecodeApplyOperation(validPayload);
+	t.ok(decoded, 'fixtures decode');
+	const parent = decoded.rao;
+	if (!parent?.vs) return validPayload;
+	const mutated = b4a.from(parent.vs);
+	mutated[mutated.length - 1] ^= 0xff;
+	parent.vs = mutated;
+	return safeEncodeApplyOperation(decoded);
+}
+
+export default function addWriterInvalidValidatorSignatureScenario() {
+	new OperationValidationScenarioBase({
+		title: 'State.apply addWriter validator signature is invalid',
+		setupScenario: setupAddWriterScenario,
+		buildValidPayload: buildAddWriterPayload,
+		mutatePayload: mutateValidatorSignature,
+		applyInvalidPayload: applyWithRoleAccessBypass,
+		assertStateUnchanged: assertAddWriterFailureState,
+		expectedLogs: ['Failed to verify validator message signature.']
+	}).performScenario();
+}

package/tests/unit/state/apply/addWriter/addWriterNewWkScenario.js

@@ -0,0 +1,149 @@
+import { test } from 'brittle';
+import b4a from 'b4a';
+import { randomBytes } from 'crypto';
+import { eventFlush } from '../../../../helpers/autobaseTestHelpers.js';
+import nodeEntryUtils from '../../../../../src/core/state/utils/nodeEntry.js';
+import {
+	setupAddWriterScenario,
+	selectWriterPeer,
+	buildAddWriterPayload,
+	buildRemoveWriterPayload,
+	assertAddWriterSuccessState,
+	assertWriterRemovalState
+} from './addWriterScenarioHelpers.js';
+import {
+	toBalance,
+	BALANCE_FEE,
+	BALANCE_TO_STAKE,
+	PERCENT_75
+} from '../../../../../src/core/state/utils/balance.js';
+
+export default function addWriterNewWkScenario() {
+	test('State.apply addWriter rotates writing keys after removing/re-adding writer role', async t => {
+		const context = await setupAddWriterScenario(t);
+		const validatorPeer = context.adminBootstrap;
+		const writerPeer = selectWriterPeer(context);
+		const originalWriterKey = b4a.from(writerPeer.base.local.key);
+		const rewardPerOperation = BALANCE_FEE.percentage(PERCENT_75);
+
+		const writerInitialBalance = toBalance(context.addWriterScenario.writerInitialBalance);
+		let validatorBalanceTracker = await readNodeBalanceBuffer(validatorPeer);
+
+		const firstAddPayload = await buildAddWriterPayload(context, {
+			readerPeer: writerPeer,
+			validatorPeer
+		});
+
+		await validatorPeer.base.append(firstAddPayload);
+		await validatorPeer.base.update();
+		await eventFlush();
+
+		await assertAddWriterSuccessState(t, context, {
+			readerPeer: writerPeer,
+			validatorPeer,
+			writerInitialBalance: context.addWriterScenario.writerInitialBalance,
+			validatorBalanceBefore: validatorBalanceTracker,
+			payload: firstAddPayload,
+			writerKeyBuffer: originalWriterKey,
+			expectedWriterIndex: 1
+		});
+
+		validatorBalanceTracker = advanceBalanceTracker(validatorBalanceTracker, rewardPerOperation);
+
+		const balanceAfterInitialAdd = writerInitialBalance
+			.sub(BALANCE_FEE)
+			?.sub(BALANCE_TO_STAKE);
+		if (!balanceAfterInitialAdd) {
+			throw new Error('Failed to derive writer balance after initial add.');
+		}
+
+		const removeWriterPayload = await buildRemoveWriterPayload(context, {
+			readerPeer: writerPeer,
+			validatorPeer,
+			writerKeyBuffer: originalWriterKey
+		});
+
+		await validatorPeer.base.append(removeWriterPayload);
+		await validatorPeer.base.update();
+		await eventFlush();
+
+		const writerBalanceAfterRemoval = balanceAfterInitialAdd
+			.add(BALANCE_TO_STAKE)
+			?.sub(BALANCE_FEE);
+		if (!writerBalanceAfterRemoval) {
+			throw new Error('Failed to derive writer balance after removal.');
+		}
+
+		await assertWriterRemovalState(t, context, {
+			readerPeer: writerPeer,
+			validatorPeer,
+			writerKeyBuffer: originalWriterKey,
+			expectedBalanceBuffer: b4a.from(writerBalanceAfterRemoval.value),
+			payload: removeWriterPayload
+		});
+
+		validatorBalanceTracker = advanceBalanceTracker(validatorBalanceTracker, rewardPerOperation);
+
+		const rotatedWriterKey = randomBytes(32);
+		const writerBalanceBeforeReAdd = b4a.from(writerBalanceAfterRemoval.value);
+
+		const secondAddPayload = await buildAddWriterPayload(context, {
+			readerPeer: writerPeer,
+			validatorPeer,
+			writerKeyBuffer: rotatedWriterKey
+		});
+
+		await validatorPeer.base.append(secondAddPayload);
+		await validatorPeer.base.update();
+		await eventFlush();
+
+		await assertAddWriterSuccessState(t, context, {
+			readerPeer: writerPeer,
+			validatorPeer,
+			writerInitialBalance: writerBalanceBeforeReAdd,
+			validatorBalanceBefore: validatorBalanceTracker,
+			payload: secondAddPayload,
+			expectedWriterIndex: 2,
+			writerKeyBuffer: rotatedWriterKey
+		});
+
+		validatorBalanceTracker = advanceBalanceTracker(validatorBalanceTracker, rewardPerOperation);
+
+		const finalAdminBalance = await readNodeBalanceBuffer(validatorPeer);
+		t.ok(
+			b4a.equals(finalAdminBalance, validatorBalanceTracker),
+			'validator accumulated rewards from two addWriter operations and one removeWriter'
+		);
+
+		const writerBalanceAfterReAdd = writerBalanceAfterRemoval
+			.sub(BALANCE_FEE)
+			?.sub(BALANCE_TO_STAKE);
+		if (!writerBalanceAfterReAdd) {
+			throw new Error('Failed to compute writer balance after re-add.');
+		}
+
+		const writerEntry = await writerPeer.base.view.get(writerPeer.wallet.address);
+		const decodedWriter = nodeEntryUtils.decode(writerEntry.value);
+		const expectedWriterBalance = writerBalanceAfterReAdd.value;
+		t.ok(
+			b4a.equals(decodedWriter.balance, expectedWriterBalance),
+			'writer ends with balance reduced by three fees and new stake'
+		);
+		t.ok(
+			b4a.equals(decodedWriter.wk, rotatedWriterKey),
+			'writer entry reflects the rotated writing key'
+		);
+	});
+}
+
+function advanceBalanceTracker(currentBuffer, incrementBalance) {
+	const current = toBalance(currentBuffer);
+	const next = current.add(incrementBalance);
+	return b4a.from(next.value);
+}
+
+async function readNodeBalanceBuffer(peer) {
+	const entry = await peer.base.view.get(peer.wallet.address);
+	const decoded = nodeEntryUtils.decode(entry.value);
+	return b4a.from(decoded.balance);
+}

package/tests/unit/state/apply/addWriter/addWriterRequesterAlreadyWriterScenario.js

@@ -0,0 +1,21 @@
+import OperationValidationScenarioBase from '../common/base/OperationValidationScenarioBase.js';
+import {
+	setupAddWriterScenario,
+	buildAddWriterPayload,
+	assertAddWriterFailureState,
+	applyWithRequesterRoleOverride
+} from './addWriterScenarioHelpers.js';
+import nodeRoleUtils from '../../../../../src/core/state/utils/roles.js';
+
+export default function addWriterRequesterAlreadyWriterScenario() {
+	new OperationValidationScenarioBase({
+		title: 'State.apply addWriter rejects payloads when requester is already a writer',
+		setupScenario: setupAddWriterScenario,
+		buildValidPayload: buildAddWriterPayload,
+		mutatePayload: (_t, payload) => payload,
+		applyInvalidPayload: (context, invalidPayload) =>
+			applyWithRequesterRoleOverride(context, invalidPayload, nodeRoleUtils.NodeRole.WRITER),
+		assertStateUnchanged: (t, context) => assertAddWriterFailureState(t, context, { skipSync: true }),
+		expectedLogs: ['Node must be whitelisted, and cannot be a writer or an indexer.']
+	}).performScenario();
+}

package/tests/unit/state/apply/addWriter/addWriterRequesterBalanceInsufficientScenario.js

@@ -0,0 +1,21 @@
+import b4a from 'b4a';
+import RequesterBalanceScenarioBase from '../common/balances/base/requesterBalanceScenarioBase.js';
+import {
+	setupAddWriterScenario,
+	buildAddWriterPayload,
+	assertAddWriterFailureState,
+	selectWriterPeer
+} from './addWriterScenarioHelpers.js';
+
+export default function addWriterRequesterBalanceInsufficientScenario() {
+	new RequesterBalanceScenarioBase({
+		title: 'State.apply addWriter rejects payloads when requester balance is insufficient',
+		setupScenario: setupAddWriterScenario,
+		buildValidPayload: buildAddWriterPayload,
+		assertStateUnchanged: (t, context) => assertAddWriterFailureState(t, context, { skipSync: true }),
+		selectPeer: selectWriterPeer,
+		mutateDecodedEntry: decoded =>
+			decoded ? { ...decoded, balance: b4a.alloc(decoded.balance.length) } : decoded,
+		expectedLogs: ['Insufficient requester balance.', 'Add writer operation ignored.']
+	}).performScenario();
+}

package/tests/unit/state/apply/addWriter/addWriterRequesterEntryDecodeFailureScenario.js

@@ -0,0 +1,19 @@
+import OperationValidationScenarioBase from '../common/base/OperationValidationScenarioBase.js';
+import {
+	setupAddWriterScenario,
+	buildAddWriterPayload,
+	assertAddWriterFailureState,
+	applyWithRequesterEntryCorruption
+} from './addWriterScenarioHelpers.js';
+
+export default function addWriterRequesterEntryDecodeFailureScenario() {
+	new OperationValidationScenarioBase({
+		title: 'State.apply addWriter rejects payloads when requester entry cannot be decoded',
+		setupScenario: setupAddWriterScenario,
+		buildValidPayload: buildAddWriterPayload,
+		mutatePayload: (_t, payload) => payload,
+		applyInvalidPayload: applyWithRequesterEntryCorruption,
+		assertStateUnchanged: (t, context) => assertAddWriterFailureState(t, context, { skipSync: true }),
+		expectedLogs: ['Failed to decode node entry.']
+	}).performScenario();
+}

package/tests/unit/state/apply/addWriter/addWriterRequesterEntryMissingScenario.js

@@ -0,0 +1,19 @@
+import OperationValidationScenarioBase from '../common/base/OperationValidationScenarioBase.js';
+import {
+	setupAddWriterScenario,
+	buildAddWriterPayload,
+	assertAddWriterFailureState,
+	applyWithRequesterEntryRemoval
+} from './addWriterScenarioHelpers.js';
+
+export default function addWriterRequesterEntryMissingScenario() {
+	new OperationValidationScenarioBase({
+		title: 'State.apply addWriter rejects payloads when requester entry is missing',
+		setupScenario: setupAddWriterScenario,
+	buildValidPayload: buildAddWriterPayload,
+	mutatePayload: (_t, payload) => payload,
+	applyInvalidPayload: applyWithRequesterEntryRemoval,
+	assertStateUnchanged: (t, context) => assertAddWriterFailureState(t, context, { skipSync: true }),
+	expectedLogs: ['Failed to verify requester node address.', 'Failed to add writer.']
+}).performScenario();
+}

package/tests/unit/state/apply/addWriter/addWriterRequesterIndexerScenario.js

@@ -0,0 +1,21 @@
+import OperationValidationScenarioBase from '../common/base/OperationValidationScenarioBase.js';
+import {
+	setupAddWriterScenario,
+	buildAddWriterPayload,
+	assertAddWriterFailureState,
+	applyWithRequesterRoleOverride
+} from './addWriterScenarioHelpers.js';
+import nodeRoleUtils from '../../../../../src/core/state/utils/roles.js';
+
+export default function addWriterRequesterIndexerScenario() {
+	new OperationValidationScenarioBase({
+		title: 'State.apply addWriter rejects payloads when requester is already an indexer',
+		setupScenario: setupAddWriterScenario,
+		buildValidPayload: buildAddWriterPayload,
+		mutatePayload: (_t, payload) => payload,
+		applyInvalidPayload: (context, invalidPayload) =>
+			applyWithRequesterRoleOverride(context, invalidPayload, nodeRoleUtils.NodeRole.INDEXER),
+		assertStateUnchanged: (t, context) => assertAddWriterFailureState(t, context, { skipSync: true }),
+		expectedLogs: ['Node must be whitelisted, and cannot be a writer or an indexer.']
+	}).performScenario();
+}

package/tests/unit/state/apply/addWriter/addWriterRequesterNotWhitelistedScenario.js

@@ -0,0 +1,21 @@
+import OperationValidationScenarioBase from '../common/base/OperationValidationScenarioBase.js';
+import {
+	setupAddWriterScenario,
+	buildAddWriterPayload,
+	assertAddWriterFailureState,
+	applyWithRequesterRoleOverride
+} from './addWriterScenarioHelpers.js';
+import nodeRoleUtils from '../../../../../src/core/state/utils/roles.js';
+
+export default function addWriterRequesterNotWhitelistedScenario() {
+	new OperationValidationScenarioBase({
+		title: 'State.apply addWriter rejects payloads when requester is not whitelisted',
+		setupScenario: setupAddWriterScenario,
+		buildValidPayload: buildAddWriterPayload,
+		mutatePayload: (_t, payload) => payload,
+		applyInvalidPayload: (context, invalidPayload) =>
+			applyWithRequesterRoleOverride(context, invalidPayload, nodeRoleUtils.NodeRole.READER),
+		assertStateUnchanged: (t, context) => assertAddWriterFailureState(t, context, { skipSync: true }),
+		expectedLogs: ['Node must be whitelisted, and cannot be a writer or an indexer.']
+	}).performScenario();
+}