cardano-foundation / cardano-foundation/cardano-rosetta-java
Enforce and cross-verify `account_identifier.address` in all stake-related operations
- Dominant language
- Java
- Stars
- 26
- Forks
- 15
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 2
Description
### Why
Our current approach is inconsistent in requiring and verifying `account_identifier.address` across stake-based operations. This can introduce ambiguity, reduce transparency for integrators, and complicate downstream processing (e.g., signers extraction, auditing, and validation). By strictly enforcing the presence of `account_identifier.address` and cross-verifying it against the required stake credential, we align with both the spec’s intent and best practices for robust integrations. For more context, check [this old PR](https://github.com/cardano-foundation/cardano-rosetta-java/pull/479#issuecomment-2981566695).
### What
- Update the construction and validation logic to always require `account_identifier.address` for any operation that affects a stake account or its state (including but not limited to registration, deregistration, delegation, and governance).
- Implement explicit cross-verification between the provided address and the associated stake credential in operation metadata. Raise an error if there is a mismatch.
- Update API and developer documentation to clearly state this enforcement and the rationale.
- Add relevant tests to guarantee consistent enforcement.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.