Add XLS-70 Credentials models and credential-based DepositPreauth support (with protocol-compatibility and no_std follow-up fixes) by Copilot · Pull Request #154 · XRPLF/xrpl-rust

Copilot · 2026-03-30T22:44:09Z

High Level Overview of Change

This PR adds initial XLS-70 Credentials support to the model layer and includes follow-up fixes from review to ensure protocol compatibility, validation correctness, and no_std build compatibility.

Credential transaction models
- Added CredentialCreate, CredentialAccept, and CredentialDelete.
- Added model validation for:
  - credential_type (non-empty, max 128 hex chars) in all three credential transactions.
  - uri max length in CredentialCreate.
- Added CredentialDelete validation requiring the submitter Account to match either subject or issuer.
- Updated CredentialDelete tests to align with the new submitter validation logic (account == subject || account == issuer).
Credential ledger object
- Added Credential ledger object model.
- Added typed CredentialFlag enum with LsfAccepted = 0x00010000.
- Updated object to use typed flags instead of NoFlags.
DepositPreauth XLS-70 extensions
- Transaction model supports:
  - AuthorizeCredentials
  - UnauthorizeCredentials
- Ledger object supports credential-based authorization shape.
- Enforced XOR-style validation for authorization selectors.
- Added validation that credential authorization arrays contain 1..=8 entries.
- Added no_std test-module imports for vec! macro usage.
Shared credential authorization types
- Deduplicated CredentialAuthorizationFields / CredentialAuthorization into a shared model:
  - src/models/credential_authorization.rs
- Reused from both transaction and ledger DepositPreauth models.
Related request/model surface
- account_objects request supports type=credential.
- ledger_entry request supports credential selector fields.
- deposit_authorized request supports credentials.
- Added credential_ids on affected tx models: Payment, EscrowFinish, PaymentChannelClaim, AccountDelete.
- Added explicit #[serde(rename = "CredentialIDs")] on all four to match rippled casing.
Clippy / formatting / compatibility fixes
- Boxed XRPLRequest::LedgerEntry to resolve large_enum_variant.
- Added use alloc::boxed::Box; in request models for no_std compatibility.
- Ran cargo fmt fixes, including import ordering.
- Added targeted serde tests to verify CredentialIDs field naming.
Compatibility + docs
- Kept account-based DepositPreauth::new(...) constructor semantics and added credential-based constructor path for ledger objects.
- Updated changelog entry for XLS-70 support.

Context of Change

XLS-70 requires first-class support for Credential objects and credential-aware authorization flows. The initial pass added missing model coverage, but review identified protocol-facing gaps (notably CredentialIDs casing, missing lsfAccepted, and missing validations) that could cause silent incompatibility with rippled or allow invalid model states. A later review also identified no_std regressions introduced during follow-up fixes (missing Box/vec! imports and a mismatched test fixture). This update closes those gaps while preserving the original architecture and scope.

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Refactor (non-breaking change that only restructures code)
Tests (You added tests for code that already exists, or your new feature included in this PR)
Documentation Updates
Release

Before / After

Before:

SDK lacked XLS-70 credential transaction/object coverage.
credential_ids serialized incorrectly as CredentialIds instead of CredentialIDs.
Credential object had no typed lsfAccepted flag support.
DepositPreauth credential arrays were not size-validated.
Credential authorization types were duplicated in two modules.
Clippy failed on XRPLRequest large enum variant.
Follow-up changes introduced no_std build regressions from missing imports and one invalid test fixture.

After:

Credential primitives are modeled end-to-end with protocol-correct field naming and stronger validation.
CredentialIDs serializes correctly on all four affected transaction types.
Credential object exposes typed CredentialFlag::LsfAccepted.
DepositPreauth credential arrays are validated at 1..=8.
Shared credential authorization types are centralized and reused.
XRPLRequest::LedgerEntry is boxed and no_std-compatible (alloc::boxed::Box in scope).
no_std test modules compile with explicit alloc::vec import for vec!.
CredentialDelete test fixtures now match the enforced submitter relationship rules.

Test Plan

Ran targeted unit tests for updated behavior:
- models::transactions::payment::tests::test_credential_ids_serde_name
- models::transactions::account_delete::tests::test_credential_ids_serde_name
- models::transactions::escrow_finish::tests::test_credential_ids_serde_name
- models::transactions::payment_channel_claim::tests::test_credential_ids_serde_name
- models::transactions::credential_create::tests::test_credential_type_length_validation
- models::transactions::credential_accept::tests::test_credential_type_length_validation
- models::transactions::credential_delete::tests::test_account_must_match_subject_or_issuer
- models::transactions::credential_delete::tests::test_valid_with_subject
- models::transactions::deposit_preauth::tests::test_authorize_credentials_array_size_validation
- models::transactions::deposit_preauth::tests::test_valid_with_authorize_credentials
- models::ledger::objects::deposit_preauth::tests::test_serde_with_authorize_credentials
Ran no_std reproduction command from review:
- cargo test --release --no-default-features --features embassy-rt,core,utils,wallet,models,helpers,websocket,json-rpc
Ran formatting:
- cargo fmt --all
Ran linting:
- cargo clippy --lib -- -D warnings

…pport Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/c0d6be9f-180b-4624-980e-b46586bace75 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/c0d6be9f-180b-4624-980e-b46586bace75 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

e-desouza

Took a close look at this. The structure follows existing patterns well and the scope is right for an initial XLS-70 pass, but there are a couple of data-breaking issues that need fixing before merge.

Blockers:

credential_ids serializes as CredentialIds instead of CredentialIDs. The struct-level rename_all = "PascalCase" gets the casing wrong. Needs explicit #[serde(rename = "CredentialIDs")] on all four transaction types that gained this field. This would silently break serialization against rippled.
The Credential ledger object is missing the lsfAccepted flag (0x00010000). Without it the SDK can't tell whether a credential has been accepted by the subject, which is the whole point of the accept/unaccept lifecycle in XLS-70. Should use a CredentialFlag enum instead of NoFlags.
Clippy fails with large_enum_variant on XRPLRequest after the LedgerEntry struct grew. Needs boxing.
cargo fmt fails on two files.

Should fix:

No credential_type length validation (spec: non-empty, max 64 bytes / 128 hex chars). The codebase already does this for domain and uri.
No uri length validation in CredentialCreate (spec: max 256 bytes).
CredentialAuthorizationFields / CredentialAuthorization are duplicated identically in both transactions/deposit_preauth.rs and ledger/objects/deposit_preauth.rs. Define once, re-export.
No validation on AuthorizeCredentials array size (spec: 1-8 items).
No tests exercise credential_ids on the four modified transactions. A serde roundtrip would have caught the rename bug.

Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/0c37ac69-35f5-480b-9131-4bf0c0c5d042 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

Copilot · 2026-03-30T23:42:40Z

Took a close look at this. The structure follows existing patterns well and the scope is right for an initial XLS-70 pass, but there are a couple of data-breaking issues that need fixing before merge....

Implemented all blocker items and the listed should-fix items in commit 85430fe (with main fixes in dede078). This includes CredentialIDs serde casing fixes + tests, CredentialFlag::LsfAccepted, boxed XRPLRequest::LedgerEntry for clippy, credential_type/uri validations, shared credential authorization types, and DepositPreauth credential list size validation.

e-desouza

Good progress. 9 of 10 original issues are fixed. But the fix commits introduced three new problems.

1. Test failure: credential_delete::test_valid_with_subject

The test sets account = "rSubmitter..." and subject = "rSubject..." (different addresses). The new validation correctly enforces account == subject || account == issuer, but this test wasn't updated to match. Fix: use the same address for both account and subject.

2. no_std build is broken

Three missing imports:

vec! macro not in scope in transactions/deposit_preauth.rs (lines 378, 400) and ledger/objects/deposit_preauth.rs (line 177). Needs use alloc::vec; in the test modules.
Box not in scope in requests/mod.rs (lines 150, 325). The Box<LedgerEntry> fix for large_enum_variant needs use alloc::boxed::Box; for no_std builds.

Reproduce with: cargo test --release --no-default-features --features embassy-rt,core,utils,wallet,models,helpers,websocket,json-rpc

3. cargo fmt still fails

Import ordering in src/models/ledger/objects/deposit_preauth.rs. Just needs a cargo fmt --all pass.

…match Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/f09d98f0-ce65-4d76-9108-92fd0a65502d Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

Copilot · 2026-03-30T23:58:26Z

Good progress. 9 of 10 original issues are fixed. But the fix commits introduced three new problems.

1. Test failure: credential_delete::test_valid_with_subject...

Fixed in ba48c88. I updated the failing credential_delete::test_valid_with_subject fixture, added missing no_std imports (alloc::boxed::Box in requests/mod.rs, alloc::vec in both DepositPreauth test modules), and reran cargo fmt --all plus the no-default-features test command.

e-desouza

Reviewed across three rounds. All issues from both review passes are fixed: serde CredentialIDs rename, typed lsfAccepted flag, credential_type validation, shared authorization types, CredentialDelete submitter checks, array bounds, no_std imports, and test fixture alignment. Ran the full test suite locally -- fmt, clippy, 614 default tests, 485 no_std tests, and 41 integration tests against a standalone rippled node. All green.

One thing for next time: the agent's sandbox needs firewall rules allowing outbound access to testnet.xrpl-labs.com, faucet.altnet.rippletest.net, and xrpl.org so it can run integration tests against the testnet faucet directly.

pdp2121 · 2026-04-01T21:09:21Z

/ai-review

xrplf-ai-reviewer

Several correctness issues flagged inline: a logic bug in CredentialDelete authorization that incorrectly rejects valid implicit-issuer cases (line 120), an unreachable else branch (line 140), doc/code contradiction on both-None (line 118), missing length validation for authorize_credentials in the ledger object, unvalidated credential_ids on Payment/AccountDelete/EscrowFinish/PaymentChannelClaim, and Cow<[T]> serde reliability concerns across multiple types. The authorize field change in DepositPreauth is also a semver-breaking API change that needs changelog/version attention.

Review by Claude Opus 4.6 · Prompt: V12

When only subject or only issuer is provided, account implicitly fills the missing role. The previous logic incorrectly required account to match the provided field even when the other was omitted, causing false rejections (e.g. subject=X, issuer=None rejected unless account==X). Simplify to: only validate account matches subject or issuer when both are explicitly provided. Remove unreachable else branch.

- Replace Cow<'a, [Cow<'a, str>]> with Vec<Cow<'a, str>> for credential_ids across AccountDelete, Payment, EscrowFinish, PaymentChannelClaim, and DepositAuthorized request. The Cow-of-slice type has unreliable serde round-trip behavior. - Add 1..=8 length validation for authorize_credentials on the DepositPreauth ledger object (matching transaction-level validation). - Upgrade credential_ids serde tests to full round-trip deserialization.

Add shared validate_credential_ids() that enforces the XLS-70 spec requirement of 1..=8 entries when credential_ids is present. Applied to AccountDelete, Payment, EscrowFinish, and PaymentChannelClaim. Document breaking changes in CHANGELOG.md: DepositPreauth.authorize becoming Optional, and credential_ids type change from Cow<[Cow<str>]> to Vec<Cow<str>>.

Spec compliance fixes: - Reject empty URI in CredentialCreate (spec section 3.2) - Add duplicate detection in AuthorizeCredentials/UnauthorizeCredentials arrays on DepositPreauth transaction and ledger object (spec 7.2) - Add duplicate detection in CredentialIDs on Payment, AccountDelete, EscrowFinish, PaymentChannelClaim (spec section 8.2) Testing improvements: - 38 new negative/boundary tests covering credential_type length bounds, URI validation, authorization field combinations, credential array size limits, self-issued credentials, and serde round-trips - Add proptest dev-dependency and .local/.gitignore entry

20 proptest-based tests covering: - CredentialType length invariants (1..=128 valid, 0 or >128 invalid) - CredentialDelete subject/issuer combination properties - CredentialIDs array length invariants (1..=8 valid) - DepositPreauth exactly-one-field property - Serde round-trip properties for credential transactions

deposit_authorize.rs used Vec without importing it from alloc, which broke the no_std (embassy-rt) build in CI.

ckeshava · 2026-04-22T21:16:04Z

+            ..Default::default()
+        };
+        let serialized = serde_json::to_string(&payment).unwrap();
+        assert!(serialized.contains("\"CredentialIDs\""));


Suggested change

assert!(serialized.contains("\"CredentialIDs\""));

assert!(serialized.contains("\"CredentialIDs\": \"DD40031C6C21164E7673A47C35513D52A6B0F1349A873EE0D188D8994CD4D001\""));

Update the test to validate the contents of the CredentialIDs array

ckeshava · 2026-04-22T21:23:47Z

+    pub previous_txn_id: Cow<'a, str>,
+    /// The index of the ledger containing the transaction that most recently modified this object.
+    pub previous_txn_lgr_seq: u32,


Given that the rust library is yet to be equipped with many ledger-objects in the future, this is a good time to refactor common fields such as these to prevent code duplication.

previous_txn_lgr_seq and previous_txn_id is found in a huge majority of the ledger objects. These fields should be refactored.

ckeshava · 2026-04-23T01:03:48Z

+            ),
+            previous_txn_lgr_seq: 8,
+        };
+        assert!(deposit_preauth.get_errors().is_err());


Extend this test to assert the specifics of the error message. We don't want to get lucky in this test by relying on a different error.

ckeshava · 2026-04-23T01:05:44Z

+    pub credentials: Option<Vec<Cow<'a, str>>>,
    /// The unique identifier of a ledger.
    #[serde(flatten)]
    pub ledger_lookup: Option<LookupByLedgerRequest<'a>>,


This model can be further simplified by refactoring LookupByLedgerRequest inside CommonFields.

ckeshava · 2026-04-23T01:12:59Z

            None,
            None,
            None,
+            None,


There are too many unnamed parameters in this function call. We should come up with a way to default initialize all LedgerEntry parameters to None, except for the explicitly specified parameters.

ckeshava · 2026-04-23T01:40:13Z

+    PartialEq,
+    Eq,
+    Clone,
+    xrpl_rust_macros::ValidateCurrencies,


Why do we need the ValidateCurrencies here? I do not see any Currency / Amount related fields in CredentialAccept struct below.

ckeshava · 2026-04-23T01:42:09Z

+    #[test]
+    fn test_credential_type_length_validation() {
+        let tx = CredentialAccept {
+            common_fields: CommonFields {
+                account: "rSubject11111111111111111111111111".into(),
+                transaction_type: TransactionType::CredentialAccept,
+                ..Default::default()
+            },
+            issuer: "rIssuer111111111111111111111111111".into(),
+            credential_type: "".into(),
+        };
+        assert!(tx.get_errors().is_err());
+    }
+
+    #[test]
+    fn test_credential_type_empty_error() {
+        let tx = CredentialAccept {
+            common_fields: CommonFields {
+                account: "rSubject11111111111111111111111111".into(),
+                transaction_type: TransactionType::CredentialAccept,
+                ..Default::default()
+            },
+            issuer: "rIssuer111111111111111111111111111".into(),
+            credential_type: Cow::from(""),
+        };
+        assert!(tx.get_errors().is_err());
+    }


aren't these two tests identical? are they testing different properties?

ckeshava · 2026-04-23T01:44:31Z

+        };
+        assert!(tx.get_errors().is_ok());
+    }
+}


This test suite will benefit from a non-hexadecimal-input test (non hex inputs should fail). I do not see the non-hex condition enforced in the validation either.

ckeshava · 2026-04-23T01:55:02Z

+        let json = serde_json::to_string(&tx).unwrap();
+        let roundtripped: CredentialAccept = serde_json::from_str(&json).unwrap();
+        prop_assert_eq!(&tx, &roundtripped);
+    }


Where can I find integration tests that send Credential[Create|Accept|Delete] transactions to a rippled server and get them validated for correctness? Have I missed them?

Initial plan

55016d0

Copilot AI assigned Copilot and e-desouza Mar 30, 2026

Copilot started work on behalf of e-desouza March 30, 2026 22:44 View session

Copilot AI linked an issue Mar 30, 2026 that may be closed by this pull request

Support Credentials (XLS-70) #143

Open

Copilot AI and others added 3 commits March 30, 2026 22:55

feat(models): add initial XLS-70 credential transaction and ledger su…

48ad71c

…pport Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/c0d6be9f-180b-4624-980e-b46586bace75 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

fix: address review feedback for deposit preauth credential support

ce56332

Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/c0d6be9f-180b-4624-980e-b46586bace75 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

docs: clarify deposit preauth credential compatibility and changelog

2e27dc3

Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/c0d6be9f-180b-4624-980e-b46586bace75 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add support for Credentials (XLS-70)~~ Add XLS-70 Credentials models and credential-based DepositPreauth support Mar 30, 2026

Copilot finished work on behalf of e-desouza March 30, 2026 23:03

Copilot AI requested a review from e-desouza March 30, 2026 23:03

e-desouza requested changes Mar 30, 2026

View reviewed changes

Copilot started work on behalf of e-desouza March 30, 2026 23:29 View session

Copilot AI and others added 2 commits March 30, 2026 23:38

fix: address credential review blockers and validation gaps

dede078

Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/0c37ac69-35f5-480b-9131-4bf0c0c5d042 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

style: make deposit preauth credentials length check idiomatic

85430fe

Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/0c37ac69-35f5-480b-9131-4bf0c0c5d042 Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

Copilot AI changed the title ~~Add XLS-70 Credentials models and credential-based DepositPreauth support~~ Add XLS-70 Credentials models and credential-based DepositPreauth support (with protocol-compatibility follow-up fixes) Mar 30, 2026

Copilot finished work on behalf of e-desouza March 30, 2026 23:43

Copilot AI requested a review from e-desouza March 30, 2026 23:43

e-desouza requested changes Mar 30, 2026

View reviewed changes

Comment thread src/models/transactions/credential_delete.rs

Comment thread src/models/requests/mod.rs

Comment thread src/models/ledger/objects/deposit_preauth.rs

Copilot started work on behalf of e-desouza March 30, 2026 23:48 View session

fix: resolve no_std import regressions and credential_delete test mis…

ba48c88

…match Agent-Logs-Url: https://github.com/XRPLF/xrpl-rust/sessions/f09d98f0-ce65-4d76-9108-92fd0a65502d Co-authored-by: e-desouza <48670536+e-desouza@users.noreply.github.com>

Copilot AI changed the title ~~Add XLS-70 Credentials models and credential-based DepositPreauth support (with protocol-compatibility follow-up fixes)~~ Add XLS-70 Credentials models and credential-based DepositPreauth support (with protocol-compatibility and no_std follow-up fixes) Mar 30, 2026

Copilot finished work on behalf of e-desouza March 30, 2026 23:59

Copilot AI requested a review from e-desouza March 30, 2026 23:59

e-desouza mentioned this pull request Mar 31, 2026

Support Credentials (XLS-70) #143

Open

e-desouza approved these changes Mar 31, 2026

View reviewed changes

e-desouza marked this pull request as ready for review April 1, 2026 01:42

e-desouza requested a review from kuan121 April 1, 2026 01:42

e-desouza requested review from Patel-Raj11 and pdp2121 April 1, 2026 01:42

xrplf-ai-reviewer Bot reviewed Apr 1, 2026

View reviewed changes

e-desouza and others added 7 commits April 1, 2026 23:09

fix: add missing alloc::vec::Vec import for no_std build

8158e28

deposit_authorize.rs used Vec without importing it from alloc, which broke the no_std (embassy-rt) build in CI.

Merge branch 'main' into copilot/xls-70-support-credentials

8c51e92

This comment was marked as low quality.

Sign in to view

ckeshava reviewed Apr 23, 2026

View reviewed changes

	assert!(serialized.contains("\"CredentialIDs\""));
	assert!(serialized.contains("\"CredentialIDs\": \"DD40031C6C21164E7673A47C35513D52A6B0F1349A873EE0D188D8994CD4D001\""));

Conversation

Copilot AI commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

High Level Overview of Change

Context of Change

Type of Change

Before / After

Test Plan

Uh oh!

e-desouza left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Mar 30, 2026

Uh oh!

e-desouza left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Mar 30, 2026

Uh oh!

e-desouza left a comment

Choose a reason for hiding this comment

Uh oh!

pdp2121 commented Apr 1, 2026

Uh oh!

xrplf-ai-reviewer Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as low quality.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Mar 30, 2026 •

edited

Loading