[Stellar] security contact as contract metadata

.changeset/silent-bags-repair.md

@@ -0,0 +1,5 @@
+---
+'@openzeppelin/wizard-stellar': patch
+---
+
+Add contract metadata on contract model

packages/core/stellar/src/contract.test.ts

@@ -89,15 +89,27 @@ test('contract with documentation', t => {
   t.snapshot(printContract(Foo));
 });
 
-test('contract with security info', t => {
+test('contract with security contact metadata', t => {
   const Foo = new ContractBuilder('Foo');
-  Foo.addSecurityTag('[email protected]');
+  Foo.addContractMetadata({ key: 'contact', value: '[email protected]' });
   t.snapshot(printContract(Foo));
 });
 
-test('contract with security info and documentation', t => {
+test('contract with multiple metadata', t => {
   const Foo = new ContractBuilder('Foo');
-  Foo.addSecurityTag('[email protected]');
+  Foo.addContractMetadata([
+    { key: 'contact', value: '[email protected]' },
+    { key: 'meta', value: 'data' },
+  ]);
+  t.snapshot(printContract(Foo));
+});
+
+test('contract with multiple metadata and documentation', t => {
+  const Foo = new ContractBuilder('Foo');
+  Foo.addContractMetadata([
+    { key: 'contact', value: '[email protected]' },
+    { key: 'meta', value: 'data' },
+  ]);
   Foo.addDocumentation('Some documentation');
   t.snapshot(printContract(Foo));
 });

packages/core/stellar/src/contract.test.ts.md

@@ -155,36 +155,54 @@ Generated by [AVA](https://avajs.dev).
     pub struct Foo;␊
     `
 
-## contract with security info
+## contract with security contact metadata
 
 > Snapshot 1
 
     `// SPDX-License-Identifier: MIT␊
     // Compatible with OpenZeppelin Stellar Soroban Contracts ^0.4.1␊
+    #![no_std]␊
+    ␊
+    use soroban_sdk::contractmeta;␊
+    ␊
+    contractmeta!(key="contact", val="[email protected]");␊
     ␊
-    //! # Security␊
-    //!␊
-    //! For security issues, please contact: [email protected]␊
+    #[contract]␊
+    pub struct Foo;␊
+    `
+
+## contract with multiple metadata
+
+> Snapshot 1
+
+    `// SPDX-License-Identifier: MIT␊
+    // Compatible with OpenZeppelin Stellar Soroban Contracts ^0.4.1␊
     #![no_std]␊
     ␊
+    use soroban_sdk::contractmeta;␊
+    ␊
+    contractmeta!(key="contact", val="[email protected]");␊
+    contractmeta!(key="meta", val="data");␊
+    ␊
     #[contract]␊
     pub struct Foo;␊
     `
 
-## contract with security info and documentation
+## contract with multiple metadata and documentation
 
 > Snapshot 1
 
     `// SPDX-License-Identifier: MIT␊
     // Compatible with OpenZeppelin Stellar Soroban Contracts ^0.4.1␊
     ␊
     //! Some documentation␊
-    ␊
-    //! # Security␊
-    //!␊
-    //! For security issues, please contact: [email protected]␊
     #![no_std]␊
     ␊
+    use soroban_sdk::contractmeta;␊
+    ␊
+    contractmeta!(key="contact", val="[email protected]");␊
+    contractmeta!(key="meta", val="data");␊
+    ␊
     #[contract]␊
     pub struct Foo;␊
     `

packages/core/stellar/src/contract.ts

@@ -1,8 +1,8 @@
 import { toIdentifier } from './utils/convert-strings';
 
 export interface Contract {
+  metadata: Map<string, string>;
   license: string;
-  securityContact: string;
   documentations: string[];
   name: string;
   useClauses: UseClause[];
@@ -74,7 +74,7 @@ export interface Argument {
 export class ContractBuilder implements Contract {
   readonly name: string;
   license = 'MIT';
-  securityContact = '';
+  metadata = new Map<string, string>();
   ownable = false;
 
   readonly documentations: string[] = [];
@@ -267,7 +267,9 @@ export class ContractBuilder implements Contract {
     this.documentations.push(description);
   }
 
-  addSecurityTag(securityContact: string) {
-    this.securityContact = securityContact;
+  addContractMetadata(metadata: { key: string; value: string }[] | { key: string; value: string }) {
+    (Array.isArray(metadata) ? metadata : [metadata]).forEach(({ key, value }) => this.metadata.set(key, value));
+
+    if (this.metadata.size > 0) this.addUseClause('soroban_sdk', 'contractmeta');
   }
 }

packages/core/stellar/src/fungible.compile.test.ts

@@ -290,3 +290,24 @@ test.serial(
     { snapshotResult: false },
   ),
 );
+
+test.serial(
+  'compilation fungible upgradable mintable pausable with security contact metadata',
+  runRustCompilationTest(
+    buildFungible,
+    {
+      kind: 'Fungible',
+      name: 'MyToken',
+      symbol: 'MTK',
+      premint: '2000',
+      burnable: false,
+      mintable: true,
+      pausable: true,
+      upgradeable: true,
+      info: {
+        securityContact: '[email protected]',
+      },
+    },
+    { snapshotResult: false },
+  ),
+);

packages/core/stellar/src/print.ts

@@ -24,11 +24,11 @@ export function printContract(contract: Contract): string {
         `// SPDX-License-Identifier: ${contract.license}`,
         `// Compatible with OpenZeppelin Stellar Soroban Contracts ${compatibleContractsSemver}`,
         ...(contract.documentations.length ? ['', ...printDocumentations(contract.documentations)] : []),
-        ...(contract.securityContact ? ['', ...printSecurityTag(contract.securityContact)] : []),
         ...createLevelAttributes,
       ],
       spaceBetween(
         printUseClauses(contract),
+        printMetadata(contract),
         printVariables(contract),
         printContractStruct(contract),
         printContractErrors(contract),
@@ -367,6 +367,6 @@ function printDocumentations(documentations: string[]): string[] {
   return documentations.map(documentation => `//! ${documentation}`);
 }
 
-function printSecurityTag(securityContact: string) {
-  return ['//! # Security', '//!', `//! For security issues, please contact: ${securityContact}`];
+function printMetadata(contract: Contract) {
+  return Array.from(contract.metadata.entries()).map(([key, value]) => `contractmeta!(key="${key}", val="${value}");`);
 }

packages/core/stellar/src/set-info.ts

@@ -1,7 +1,5 @@
 import type { ContractBuilder } from './contract';
 
-export const TAG_SECURITY_CONTACT = `@custom:security-contact`;
-
 export const infoOptions = [{}, { license: 'WTFPL' }] as const;
 
 export const defaults: Info = { license: 'MIT' };
@@ -11,14 +9,8 @@ export type Info = {
   securityContact?: string;
 };
 
-export function setInfo(c: ContractBuilder, info: Info): void {
-  const { securityContact, license } = info;
-
-  if (securityContact) {
-    c.addSecurityTag(securityContact);
-  }
+export function setInfo(c: ContractBuilder, { securityContact, license }: Info): void {
+  if (securityContact) c.addContractMetadata({ key: 'contact', value: securityContact });
 
-  if (license) {
-    c.license = license;
-  }
+  if (license) c.license = license;
 }

packages/ui/src/stellar/InfoSection.svelte

@@ -18,7 +18,7 @@
     <span class="flex justify-between pr-2">
       Security Contact
       <HelpTooltip>
-        Where people can contact you to report security issues. Will only be visible if contract metadata is verified.
+        A contact point (email or URL) for reporting security issues. This will be added to the generated contract as documentation comments.
       </HelpTooltip>
     </span>
     <input bind:value={info.securityContact} placeholder="[email protected]" />