Merge branch 'feat/frontend/track-cfs-sign-event' into fix/frontend/signer-unavailable-toast

Author: sbpublic

e2e/snapshots/about-why-oisy-modal.spec.ts-snapshots/should-display-about-why-oisy-modal-1-Google-Chrome-darwin.png

@@ -12,3 +12,17 @@
 	backdrop-filter: none !important;
 	-webkit-backdrop-filter: none !important;
 }
+
+/* A native scrollbar only reserves layout width when content overflows, which
+   varies between runs (font/image load timing). For element screenshots like
+   the about-why-oisy modal this narrows the captured width by the scrollbar
+   size (~11px) and reflows the centred content, producing a visually-identical
+   but pixel-different snapshot that the bot keeps regenerating. Hide scrollbars
+   so they never reserve space and the captured width stays deterministic. */
+* {
+	scrollbar-width: none !important;
+}
+
+*::-webkit-scrollbar {
+	display: none !important;
+}

e2e/snapshots/about-why-oisy-modal.spec.ts-snapshots/should-display-about-why-oisy-modal-2-Google-Chrome-linux.png

@@ -334,6 +334,197 @@ fn test_housekeeping_resumes_after_cycles_ledger_becomes_available() {
     );
 }
 
+/// Regression test for the **automatic** (timer-driven) cycles-ledger top-up.
+///
+/// The hourly housekeeping timer must actually *deposit* cycles into the
+/// backend's cycles-ledger account when the balance is below threshold — not
+/// merely leave the canister responsive (which is all
+/// `test_housekeeping_resumes_after_cycles_ledger_becomes_available` checks).
+/// If the timer or its spawned task silently stops refilling the patron
+/// account, it drains until threshold signing (BTC / EVM / SOL sends) fails
+/// wallet-wide via `PatronPaysIcrc2Cycles`. This asserts the deposit happens.
+#[test]
+fn test_housekeeping_timer_deposits_into_cycles_ledger() {
+    use candid::{decode_one, encode_one};
+    use ic_cycles_ledger_client::Account;
+
+    let pic_setup = BackendBuilder::default().with_cycles_ledger(true).deploy();
+    let backend_id = pic_setup.canister_id;
+    // The cycles ledger is installed at its mainnet id in the test harness.
+    let cycles_ledger_id =
+        Principal::from_text("um5iw-rqaaa-aaaaq-qaaba-cai").expect("cycles ledger id");
+
+    let balance_of = || -> Nat {
+        let arg = encode_one(Account {
+            owner: backend_id,
+            subaccount: None,
+        })
+        .unwrap();
+        let reply = pic_setup
+            .pic
+            .query_call(cycles_ledger_id, controller(), "icrc1_balance_of", arg)
+            .expect("icrc1_balance_of query should succeed");
+        decode_one(&reply).expect("decode cycles-ledger balance")
+    };
+
+    // Let the immediate (init) housekeeping top-up settle first, so `before`
+    // already reflects it. The assertion then isolates the *hourly* interval,
+    // rather than passing on the immediate run even if the interval is broken.
+    for _ in 0..20 {
+        pic_setup.pic.tick();
+    }
+    let before = balance_of();
+
+    // Advancing past the hourly interval must trigger a further deposit.
+    pic_setup.pic.advance_time(Duration::from_hours(1));
+    for _ in 0..20 {
+        pic_setup.pic.tick();
+    }
+    let after = balance_of();
+
+    assert!(
+        after > before,
+        "hourly housekeeping timer must top up the cycles-ledger account \
+         (before={before}, after={after})"
+    );
+}
+
+/// Faithfully reproduces the production send outage.
+///
+/// BTC / EVM / SOL sends are signed by the chain-fusion signer, which charges
+/// its fee by pulling cycles from the backend's **shared** cycles-ledger
+/// account (the "patron") via `icrc2_transfer_from`, using the allowance
+/// `allow_signing` grants it. When that shared pool is drained, every signing
+/// operation fails with `InsufficientFunds` — the exact error users saw for
+/// BTC and EVM sends. This test drives the real drain path (acting as the
+/// signer) to reproduce the failure, then verifies the housekeeping top-up
+/// refills the pool and signing recovers without manual intervention.
+#[test]
+fn test_signer_fee_pull_fails_when_patron_drained_and_recovers_after_topup() {
+    use candid::{decode_one, encode_one, Nat};
+    use ic_cycles_ledger_client::{Account as ClAccount, TransferFromArgs, TransferFromError};
+    use serde_bytes::ByteBuf;
+
+    /// Mirrors `signer::service::principal2account`: the signer's allowance is
+    /// keyed by the user's principal encoded as a ledger subaccount.
+    fn principal_to_subaccount(principal: &Principal) -> ByteBuf {
+        let hex_str = ic_ledger_types::AccountIdentifier::new(
+            principal,
+            &ic_ledger_types::Subaccount([0u8; 32]),
+        )
+        .to_hex();
+        ByteBuf::from(hex::decode(hex_str).expect("valid account hex"))
+    }
+
+    let pic_setup = setup_with_cycles_ledger();
+    let backend_id = pic_setup.canister_id;
+    let signer = Principal::from_text(crate::utils::mock::SIGNER_CANISTER_ID).expect("signer id");
+    let user = Principal::from_text(USER_1).expect("user id");
+    let cycles_ledger_id =
+        Principal::from_text("um5iw-rqaaa-aaaaq-qaaba-cai").expect("cycles ledger id");
+
+    // Logging in makes the backend grant the signer an allowance to spend from
+    // its shared cycles-ledger account on this user's behalf, and the
+    // housekeeping top-up funds that shared account.
+    call_create_user_profile(&pic_setup, user).expect("create user profile");
+    pic_setup.pic.advance_time(Duration::from_hours(1));
+    for _ in 0..20 {
+        pic_setup.pic.tick();
+    }
+
+    let spender_subaccount = principal_to_subaccount(&user);
+    let patron = ClAccount {
+        owner: backend_id,
+        subaccount: None,
+    };
+    let signer_account = ClAccount {
+        owner: signer,
+        subaccount: None,
+    };
+
+    let balance_of = |account: &ClAccount| -> Nat {
+        let reply = pic_setup
+            .pic
+            .query_call(
+                cycles_ledger_id,
+                signer,
+                "icrc1_balance_of",
+                encode_one(account).unwrap(),
+            )
+            .expect("icrc1_balance_of query");
+        decode_one(&reply).expect("decode balance")
+    };
+
+    // The signer pulls `amount` from the shared patron account — the exact path
+    // the chain-fusion signer takes to charge a signing fee.
+    let signer_pull = |amount: Nat| -> std::result::Result<Nat, TransferFromError> {
+        let args = TransferFromArgs {
+            to: signer_account.clone(),
+            fee: None,
+            spender_subaccount: Some(spender_subaccount.clone()),
+            from: patron.clone(),
+            memo: None,
+            created_at_time: None,
+            amount,
+        };
+        let reply = pic_setup
+            .pic
+            .update_call(
+                cycles_ledger_id,
+                signer,
+                "icrc2_transfer_from",
+                encode_one(args).unwrap(),
+            )
+            .expect("icrc2_transfer_from ingress");
+        decode_one(&reply).expect("decode transfer_from result")
+    };
+
+    // One signing operation's worth of cycles (LEDGER_FEE + SIGNER_FEE), and the
+    // ledger transfer fee.
+    let op_fee = Nat::from(81_000_000_000u64);
+    let ledger_fee = Nat::from(1_000_000_000u64);
+
+    // The top-up funded the shared pool, so a signing-fee pull succeeds.
+    let funded = balance_of(&patron);
+    assert!(
+        funded > op_fee,
+        "patron pool should be funded by the housekeeping top-up (got {funded})"
+    );
+    signer_pull(op_fee.clone()).expect("signing-fee pull should succeed while funded");
+
+    // Drain the shared pool to (near) zero, simulating heavy signing load.
+    let remaining = balance_of(&patron);
+    signer_pull(remaining - ledger_fee.clone()).expect("drain pull should succeed");
+
+    // Now the pool is empty: the next signing-fee pull fails with the exact
+    // error users saw in production.
+    let drained = balance_of(&patron);
+    assert!(drained < op_fee, "pool should be drained (got {drained})");
+    match signer_pull(op_fee.clone()) {
+        Err(TransferFromError::InsufficientFunds { balance }) => {
+            assert_eq!(balance, drained, "error should report the drained balance");
+        }
+        other => panic!("expected InsufficientFunds, got {other:?}"),
+    }
+
+    // Recovery: the hourly housekeeping top-up refills the shared pool and
+    // signing works again — no manual intervention. In production the backend
+    // canister holds ample raw cycles (tens of T); mirror that so the top-up
+    // has cycles to forward (the tiny default test budget is otherwise spent by
+    // repeated top-ups and time-advance burn).
+    pic_setup.pic.add_cycles(backend_id, 100_000_000_000_000);
+    pic_setup.pic.advance_time(Duration::from_hours(1));
+    for _ in 0..20 {
+        pic_setup.pic.tick();
+    }
+    let refilled = balance_of(&patron);
+    assert!(
+        refilled > op_fee,
+        "housekeeping top-up should refill the pool (got {refilled})"
+    );
+    signer_pull(op_fee).expect("signing-fee pull should succeed after top-up");
+}
+
 // -------------------------------------------------------------------------------------------------
 // - Rate-limit integration tests for allow_signing
 // -------------------------------------------------------------------------------------------------