Person's usernames: read from Asset Hub dotNS instead of the People Chain (rebase of #349) - #426
Open
filip-parity wants to merge 17 commits into
Open
Person's usernames: read from Asset Hub dotNS instead of the People Chain (rebase of #349)#426filip-parity wants to merge 17 commits into
filip-parity wants to merge 17 commits into
Conversation
…eo-assethub address The documented 0x1c858C… value predates the Paseo Asset Hub Next V2 reset; the live DotnsPopController is 0xCC9323… (paritytech/dotns DEPLOYMENTS.md, same drift as paritytech/dotns#221). Discovery is on-chain, so this only touches the env-override docs.
…inst the live gateway Review findings on #349 after the rebase, verified against the live paseo-next-v2 and previewnet Asset Hubs (spec 2000036, identical) and the dotNS contracts on master. In-core identity lookup - Open the identity follow withRuntime=true. chainHead_v1_call is refused on a follow opened without runtime, so every ReviveApi_call view failed and no in-core session ever resolved a username; only the CLI's plain-RPC path worked. Adds a scripted chainHead test that fails on the old value. - LabelStore labels carry the network TLD (DotnsPopController._writeRecord appends protocolRegistry.tld(); ".paseo" on paseo-next-v2), and the classifier only stripped ".dot", so a settled "alice01.paseo" became the full username "alice01.paseo". resolve_labels now reads tld(), strips it, and drops subnames; classify_labels takes bare labels. - Always merge pendingClaims with the store: a public registration or an incoming transfer deploys the store while gateway names stay pending, so the store alone hid them. Page the store (append-only ledger shared with public names) instead of reading only the first 16 labels. - Probe TARGET() and pendingClaims first; target()/pendingClaim are the legacy fallbacks (the deployed dispatcher and controller only have the former). checked_add on chain-supplied ABI lengths. - Lite stems follow StringUtils.isSingleDotLiteLabel (DNS label + two digits), not alphabetic-only. register-name - AsDotnsGatewayInfo::RegisterFullName is {proof, ring_index, revision, signature} on the live runtime (individuality#1013); the shape assertion and the extra encoding lacked revision, so the command failed at the metadata check. Read the People-collection root revision at the pinned block, wait for Asset Hub's members-subscriber to import it, and encode it. Ring/root/roots helpers take the collection identifier; the LitePeople wrappers keep their behaviour. - Refresh the Asset Hub metadata fixture to the live V16 (spec 2000036). - Fail early when the member key is onboarded but not yet built into a root (the sliced members read cannot prove it), and validate the label and --link-lite shape before signing.
…sets - Previewnet has a live Bulletin chain (wss://previewnet.substrate.dev/bulletin, genesis 0x2778b1c9…, "Bulletin Local"), which dotli and dotns-sdk already use; the preset borrowed paseo's, so the host advertised and routed a Bulletin genesis that disagreed with the app's config. - The live drift test accepts "Individuality" for the People role (previewnet's People chain calls itself "Individuality Local"); it now passes for all six roles. - SPEC.md: previewnet endpoint table (pinned by the genesis-table test for every preset), register-name section, env/override wording; README: register-name, previewnet, HOST_CLI_* env vars. - Doc comments still describing usernames as People-chain Resources.Consumers reads now name the dotNS contracts on Asset Hub (regenerated Swift bindings and codegen golden follow).
…warm-path reads Ignored network tests against paseo-next-v2 Asset Hub: the live AsDotnsGatewayInfo::RegisterFullName shape (4 fields) the host asserts before signing, and the full dotNS resolution chain (pallet storage → dispatcher TARGET() → controller → registry → store factory → LabelStore) for an account with a settled store, proving the TLD is stripped and paging covers the store. Same rationale as the PGAS live tests: a fixture is a snapshot.
is_person_label in paritytech/individuality (support/src/labels.rs) accepts lowercase ASCII letters only, no digits or hyphens; the register-name pre-check now enforces the same instead of a looser DNS-label rule.
The paseo-next-v2 identity backend answers POST /usernames with "dotNS gateway is not enabled in this environment" (verified live), and since usernames are now read only from dotNS on Asset Hub, accounts registered through such a backend can never resolve one. Say so, and point at the previewnet preset / HOST_CLI_IDENTITY_BACKEND_BASE.
This was referenced Aug 17, 2026
…already minted Review on #349 (re-gius) and paritytech/dotns#235: the gateway enqueues a reservation for a reserved_base_label without asking the registrar, so a reservation over a registered name can never be claimed and holds the whole stem's reservation queue for the reservation window. The contract-side guard lands in dotns; the client asks first so an attestation cannot fail as a whole (and lose the lite name) once that guard exists. label_available reads DotnsRegistrar.available(uint256(node)) for the label's node under the network tldNode(), through the same transport as the username reads. attest() checks the reserved base name (shape per the pallet's is_valid_person, then availability); register-name checks its label. Live test on paseo: a minted name reports unavailable, an unminted one available.
…tNS registries
Previewnet's DotnsProtocolRegistry predates the configurable TLD (dotns
b4096968) and has no tld()/tldNode(); its TLD is ".dot". Username reads
of a settled LabelStore and the registrar availability check therefore
reverted there. network_tld() reads tld() and falls back to ".dot" when the
view reverts; the TLD node is derived locally (namehash) instead of read.
Live: settled-store labels and available() resolve on both paseo-next-v2
(".paseo") and previewnet (".dot"). The live tests take LIVE_ASSET_HUB_WS,
LIVE_MINTED_LABEL and LIVE_TLD to point at another network.
filip-parity
requested review from
GHkrishna,
Zebedeusz,
re-gius and
sphamjoli
August 17, 2026 11:08
main's #431 introduced PersonhoodCollection and made the ring, root and subscriber-root helpers take it; the branch's identifier-based generalisation of the same helpers folds into that API. read_member_ring_index and read_subscriber_ring_exponent take a PersonhoodCollection; register-name uses PersonhoodCollection::People. ChainState literals carry restrict_origins.
Author
|
Testing — done against the live identity backend and live chains (previewnet and paseo-next-v2), not local nodes.
CI ( |
… the reserved name reachable Repo-conventions review of #426. - discover_pop_controller reads DotnsGateway.DispatcherAddress and the dispatcher's TARGET(); pending claims come from pendingClaims(address). The target(), pendingClaim(address) and PopControllerAddress fallbacks, and the singular pending-claim decoder, are gone: no deployed network answers them (live-probed on paseo-next-v2 and previewnet). The ".dot" fallback stays: previewnet's registry has no tld() view. - is_full_person_label now matches the pallet's is_person_label ([a-z]+, at most 32 bytes); the earlier commit changed only the messages. - signing-host takes --reserved-username for a newly created auto account (same conflict rules as --lite-username-prefix), so the reserved-name pre-flight added for re-gius' review is reachable; live: a minted name and a malformed label are refused before the backend is called. - Comments describe current behaviour only; availability responses are the flat map both identity backends serve; backend token env/mint share one cell; MemberRingPosition projects only the fields it reads (covered by the projection test); read_member_ring_index_at names the pinned read; the scripted identity test asserts the H160 argument.
…at the gateway rejects Findings of the second five-agent verification pass on #426. - DotnsTransport::view returns DotnsViewError: a contract revert is an answer, a transport or decode failure is not. network_tld() falls back to ".dot" only on a revert (a registry without tld(), as on previewnet); any other failure is an error, since guessing the TLD would drop every label carrying the real one and let label_available approve minted names. - label_available asks DotnsRegistrar.ownerOf: a minted name is taken whoever holds it, the escrow included, because the gateway only mints fresh ids. classify_labels skips non-ASCII store labels instead of panicking. A malformed DispatcherAddress is an error, not "not deployed". - register-name refuses up front what the gateway extension rejects: an account that already holds a DotnsGateway.AccountAlias, and a lite link the account does not own per DotnsGateway.LiteLabelOwner. Labels follow the PopRules tiers as well as the pallet rule: registrable full names are six to thirty-two lowercase letters, reservable base names six to eight; --reserved-username is validated before startup. - The Asset Hub metadata fixture is main's paseo-next-asset-hub-metadata.scale (byte-identical). The settled-store live test proves paging. The scripted in-core test asserts the exact view sequence, origin and H160 argument. - Docs: previewnet is the only preset whose identity backend onboards new auto accounts today; register-name output lines; HOST_CLI_SIGNER_MNEMONIC scope; availability response shape; SigningHostConfig's Asset Hub genesis is a parity field.
sphamjoli
reviewed
Aug 18, 2026
SessionUiInfo/SessionInfo carry the identity material from #403 next to the dotNS username fields; the codegen golden and Swift bindings are regenerated.
… harden the CLI reads Review of #426 by sphamjoli. - The in-core dotNS lookup has a 45 s budget for the whole walk (best block, discovery, contract views, label pages) and 10 s per step, instead of 10 s for everything. - resolve_labels warns when the last label page read was still full, so a name past the paged range shows in the logs rather than as "no username". - Backend access tokens are cached per backend base, so two backends in one process never share a token. - AssetHubReader errors on AccountAlias / LiteLabelOwner values of the wrong length instead of treating them as absent, and resolves the controller once per reader.
sphamjoli
approved these changes
Aug 18, 2026
re-gius
reviewed
Aug 18, 2026
| /// characters or fewer as reserved for governance. | ||
| pub const MIN_PERSON_LABEL_LEN: usize = 6; | ||
| /// Lengths `PopRules.reserveBaseName` accepts for a reserved base name. | ||
| pub const RESERVED_LABEL_LEN: core::ops::RangeInclusive<usize> = 6..=8; |
There was a problem hiding this comment.
The doc cites PopRules.reserveBaseName (6-8), but the gateway path goes through reserveBaseNameForPop, which has no upper band, and the pallet only requires letters-only up to 32 bytes; so a 9+ letter --reserved-username is legal and claimable on chain yet rejected here.
|
|
||
| /// Decodes `DotnsPopController.pendingClaims(address)`, an ABI | ||
| /// `(string label, uint64 mintedAt)[]`. Returns the labels. | ||
| pub fn decode_pending_claims_array(data: &[u8]) -> Result<Vec<String>, DotnsContractError> { |
There was a problem hiding this comment.
This drops mintedAt, so an expired pending claim (7 days, _claimLabelStoreFor skips it, expirePendingClaim sweeps it) still resolves as a username until swept, then silently disappears for store-less users who still own the name on the registrar. Since mintedAt is already decoded, could we filter lapsed entries?
re-gius
reviewed
Aug 18, 2026
| identity | ||
| .lite_username | ||
| .get_or_insert_with(|| format!("{stem}.{digits}")); | ||
| } else if !label.is_empty() { |
There was a problem hiding this comment.
identity.full_username is first-wins, but this is not 100% correct. A self-registered or purchased letters-only name that predates the gateway username may be selected instead. chatKey(node) proves gateway provenance but is never cleared on transfer, so filtering on it is not airtight either. We should add a DotnsPopController.usernameNodeOf(address) endpoint and use that here.
Can you just add a TODO comment?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Rebase of #349 ("Person's usernames - read from AH dotNS instead of PC", by @Zebedeusz — kept as the first commit) onto
main, with the review fixes on top. Tracks #397; the client half of paritytech/individuality#755 and paritytech/dotns#230.What the host does after this PR
Usernames come from the dotNS contracts on Asset Hub.
host_logic::dotns_gatewayholds the resolution steps once, over a two-method transport (storage,view=ReviveApi_calldry-run from the always-mappedVIEW_CALL_ORIGIN); the CLI drives it over plain RPC (dotns_read.rs) and the in-core runtime over onechainHead_v1follow opened with runtime (runtime/identity.rs). Every session-identity site (pairing_host.rs,sso_pairing.rs) resolves against the Asset Hub genesis.Resolution:
DotnsGateway.DispatcherAddress→RootGatewayDispatcher.TARGET()→DotnsPopController→pendingClaims(user)(gateway-minted names not yet settled byclaimLabelStore) merged with the user'sLabelStorelabels viaprotocolRegistry()→get(storeFactory)→getLabelStore(user)→ pagedgetLabels. Store labels carry the network TLD (protocolRegistry.tld(),.paseoon paseo-next-v2;.dotwhere the registry has notld()view, as on previewnet); it is stripped and subnames are dropped.label_availableasksDotnsRegistrar.availablefor a label's node under that TLD.classify_labelsre-dots flat lite labels (alice01→alice.01, perStringUtils.isSingleDotLiteLabel) and treats the rest as full names.HOST_CLI_DOTNS_POP_CONTROLLERoverrides discovery when needed.register-name(CLI) registers a full-person username throughDotnsGateway.register_name: reads the People-collection ring index, members and root revision at one pinned People block, waits for Asset Hub'smembers-subscriberto hold that revision, then submits a General (v5) extrinsic authorized byAsDotnsGateway=RegisterFullName { proof, ring_index, revision, signature }(shape asserted from metadata before signing) withRestrictOrigins(true);Link::LiteUsername(default: the account's own lite name from dotNS) orLink::None(chat_key). Labels are validated with the pallet's rules ([a-z]+, ≤32 bytes; litestem.NN) and checked against the registrar up front.signing-host --reserved-username <label>reserves a full-person name for a newly created auto account, after the same label and registrar checks.Configuration: every host config carries the Asset Hub genesis —
PairingHostConfig/SigningHostConfig,NativeRuntimeConfig/NativeHostRuntimeConfig(uniffi, Swift/Kotlin wrappers), wasmruntimeConfig.assetHub.genesisHash(required), JS types. Presets:paseo-next-v2andpreviewnet(own People/Bulletin/Asset Hub and identity backend), documented in SPEC §14.1 and pinned by the genesis-table test;HOST_CLI_IDENTITY_BACKEND_BASE/_TOKENoverride the backend.statement_allowancering/root helpers take a collection identifier (LitePeople wrappers unchanged; PGAS and allowance paths untouched).Verified
cargo build/test --workspace --all-features(812 tests), wasm32 check,fmt,clippy -D warnings, iOS bindings--check, codegen no drift.202→ name visible through dotNS/Asset Hub → ring onboarding → paired);identity-checkresolves it; pairing-host ⇄ signing-host SSO withgetUserIdresolved in-core from Asset Hub.identity-checkcold path; ignored live tests for theRegisterFullNameshape and for a settled store (TLD stripped, ~90 labels paged); the ignored preset-genesis test passes for all six roles.Link, proof message,DOTNS_GATEWAY_CONTEXT,RegisterFullNameand the label rules matchpallets/dotns-gatewayon paritytech/individualitymain; contract selectors and ABI shapes match paritytech/dotnsmaster.Review pointers
Each commit message carries the rationale for its change; the first commit is #349 as authored.
Known, outside this PR
POST /usernameswith "dotNS gateway is not enabled in this environment", so accounts registered through it cannot get a dotNS-readable username; the CLI says so and points at previewnet.hosts/dotlimust sendruntimeConfig.assetHub.genesisHash(required by the wasm host config) — companion change in dotli-community.claimLabelStoreis user-signed from the user's own funded H160 and stays outside the host; pending claims expire after 7 days (dotns side).