#!/usr/bin/env bash# Proves the tests can fail. Each control copies the repository, breaks one guard on# purpose and runs the test that covers it: the run passes only if the test passes on# the untouched copy AND fails on the broken one. Nothing in this checkout is changed.#   scripts/positive-controls.sh             JS guards (seconds, no network)#   scripts/positive-controls.sh --network   also tamper with the mainnet evidence#   scripts/positive-controls.sh --rust      also break the contract's fingerprint checkset -euo pipefailcd "$(dirname "$0")/.."ROOT=$PWDNETWORK=0; RUST=0for a in "$@"; do  case "$a" in --network) NETWORK=1 ;; --rust) RUST=1 ;; *) echo "unknown option $a"; exit 2 ;; esacdoneWORK=$(mktemp -d "${TMPDIR:-/tmp}/duly-controls.XXXXXX")trap 'rm -rf -- "$WORK"' EXITran=0; bad=0copy() {  rm -rf -- "$WORK/repo"; mkdir -p "$WORK/repo"  (cd "$ROOT" && tar cf - --exclude=./target --exclude=./node_modules --exclude=./.git --exclude=./docs .) | (cd "$WORK/repo" && tar xf -)}# break FILE OLD NEW: replace an exact string once, and refuse if it is not there.break_it() {  python3 -I - "$WORK/repo/$1" "$2" "$3" <<'PY'import syspath, old, new = sys.argv[1:4]s = open(path).read()if s.count(old) != 1:    sys.exit(f"control could not be applied: {old!r} found {s.count(old)} times in {path}")open(path, "w").write(s.replace(old, new))PY}control() { # NAME FILE OLD NEW -- COMMAND...  local name=$1 file=$2 old=$3 new=$4; shift 5  ran=$((ran + 1))  copy  if ! (cd "$WORK/repo" && "$@") >"$WORK/clean.log" 2>&1; then    echo "  FAIL  $name: the test fails even before the guard is broken"; tail -5 "$WORK/clean.log"; bad=$((bad + 1)); return  fi  break_it "$file" "$old" "$new"  if (cd "$WORK/repo" && "$@") >"$WORK/broken.log" 2>&1; then    echo "  FAIL  $name: the test still passes with the guard broken"; bad=$((bad + 1))  else    echo "  PASS  $name: passes intact, fails when broken"  fi}echo "Positive controls: each guard is broken on purpose in a copy, and its test must catch it"control "relayer allowlist: sponsoring ft_transfer on top of the list" \  worker/src/policy.js "export const METHODS = {" "export const METHODS = {  ft_transfer: { gas: 30n * TGAS, deposit: 1n, exact: true, perDay: 20 }," -- \  node --test test/policy.test.mjscontrol "relayer allowlist: sponsoring calls to any contract" \  worker/src/policy.js "if (delegate.receiverId !== contract)" "if (false && delegate.receiverId !== contract)" -- \  node --test test/policy.test.mjscontrol "relayer deposit pin: letting a call attach more NEAR than its method needs" \  worker/src/policy.js "if (rule.exact ? action.deposit !== rule.deposit : action.deposit > rule.deposit) {" "if (false) {" -- \  node --test test/policy.test.mjscontrol "line-item fingerprint: opening a document without comparing it to the chain" \  web/lib/doc.js "if (expectedHash && hex(await sha256(sealed)) !== expectedHash) {" "if (false) {" -- \  node --test test/doc.test.mjscontrol "first paint: a page that says Loading instead of the evidence" \  worker/src/pages.js "<h2>Proof on NEAR mainnet</h2>" "<h2>Loading</h2>" -- \  node --test test/pages.test.mjsif [ "$NETWORK" = 1 ]; then  control "mainnet evidence: claiming 0.30 USDC was set aside on invoice 1-3 instead of 0.20" \    evidence/mainnet.js "{ id: '1-3', amount: '1000000', paid: '1000000', setAside: '200000'" "{ id: '1-3', amount: '1000000', paid: '1000000', setAside: '300000'" -- \    node scripts/verify-mainnet.mjs  control "mainnet evidence: a Base payment of 2.00 USDC instead of 1.00221" \    evidence/mainnet.js "amount: '1002210'" "amount: '2000000'" -- \    node scripts/verify-mainnet.mjsfiif [ "$RUST" = 1 ]; then  # Its own build directory: cargo records paths relative to the workspace, so a shared  # one would hand the broken build to the next `cargo test` in the real checkout.  export CARGO_TARGET_DIR="$WORK/target"  control "contract fingerprint: accepting a document hash that is not 64 lowercase hex" \    contract/src/lib.rs "b'a'..=b'f' => Some(c - b'a' + 10)," "b'a'..=b'f' => Some(c - b'a' + 10),        b'A'..=b'F' => Some(c - b'A' + 10)," -- \    cargo test -p duly-contract --locked document_fingerprintfiif [ "$ran" = 0 ]; then echo "No controls ran. That is a failure."; exit 1; fiif [ "$bad" -gt 0 ]; then echo "$bad of $ran controls FAILED."; exit 1; fiecho "All $ran controls passed: every guard above is covered by a test that fails without it."