fix: plug five silent asset-safety bugs across selector, storage, and htlc

token/services/interop/htlc/script_test.go

@@ -210,7 +210,7 @@ func TestScriptAuthAmIAnAuditor(t *testing.T) {
 
 func TestScriptAuthIssued(t *testing.T) {
 	sa := htlc.NewScriptAuth(nil)
-	require.False(t, sa.Issued(context.Background(), nil, &token3.Token{}))
+	require.False(t, sa.Issued(t.Context(), nil, &token3.Token{}))
 }
 
 func TestScriptAuthOwnerType(t *testing.T) {
@@ -287,21 +287,21 @@ func TestScriptAuthIsMine(t *testing.T) {
 
 	t.Run("sender owns token", func(t *testing.T) {
 		sa := htlc.NewScriptAuth(stubWalletService("wallet1", ""))
-		_, ids, mine := sa.IsMine(context.Background(), tok)
+		_, ids, mine := sa.IsMine(t.Context(), tok)
 		require.True(t, mine)
 		require.Contains(t, ids, "htlc.senderwallet1")
 	})
 
 	t.Run("recipient owns token", func(t *testing.T) {
 		sa := htlc.NewScriptAuth(stubWalletService("", "wallet2"))
-		_, ids, mine := sa.IsMine(context.Background(), tok)
+		_, ids, mine := sa.IsMine(t.Context(), tok)
 		require.True(t, mine)
 		require.Contains(t, ids, "htlc.recipientwallet2")
 	})
 
 	t.Run("both own token", func(t *testing.T) {
 		sa := htlc.NewScriptAuth(stubWalletService("wallet1", "wallet2"))
-		_, ids, mine := sa.IsMine(context.Background(), tok)
+		_, ids, mine := sa.IsMine(t.Context(), tok)
 		require.True(t, mine)
 		require.Len(t, ids, 2)
 		require.Contains(t, ids, "htlc.senderwallet1")
@@ -310,7 +310,7 @@ func TestScriptAuthIsMine(t *testing.T) {
 
 	t.Run("neither owns token", func(t *testing.T) {
 		sa := htlc.NewScriptAuth(stubWalletService("", ""))
-		_, ids, mine := sa.IsMine(context.Background(), tok)
+		_, ids, mine := sa.IsMine(t.Context(), tok)
 		require.False(t, mine)
 		require.Empty(t, ids)
 	})
@@ -321,7 +321,7 @@ func TestScriptAuthIsMineEdgeCases(t *testing.T) {
 
 	t.Run("invalid owner bytes", func(t *testing.T) {
 		tok := &token3.Token{Owner: []byte("garbage"), Type: "USD", Quantity: "100"}
-		_, _, mine := sa.IsMine(context.Background(), tok)
+		_, _, mine := sa.IsMine(t.Context(), tok)
 		require.False(t, mine)
 	})
 
@@ -331,7 +331,7 @@ func TestScriptAuthIsMineEdgeCases(t *testing.T) {
 			Type:     "USD",
 			Quantity: "100",
 		}
-		_, _, mine := sa.IsMine(context.Background(), tok)
+		_, _, mine := sa.IsMine(t.Context(), tok)
 		require.False(t, mine)
 	})
 
@@ -341,13 +341,13 @@ func TestScriptAuthIsMineEdgeCases(t *testing.T) {
 			Type:     "USD",
 			Quantity: "100",
 		}
-		_, _, mine := sa.IsMine(context.Background(), tok)
+		_, _, mine := sa.IsMine(t.Context(), tok)
 		require.False(t, mine)
 	})
 
 	t.Run("nil sender and recipient", func(t *testing.T) {
 		tok := makeHTLCToken(t, nil, nil)
-		_, _, mine := sa.IsMine(context.Background(), tok)
+		_, _, mine := sa.IsMine(t.Context(), tok)
 		require.False(t, mine)
 	})
 }

token/services/interop/htlc/signer.go

@@ -93,12 +93,25 @@ type Verifier struct {
 	Sender    driver.Verifier
 	Deadline  time.Time
 	HashInfo  HashInfo
+	// ClockFunc returns the current time used to evaluate the deadline.
+	// It defaults to time.Now when nil.
+	// Callers that have access to the Fabric block timestamp should inject it
+	// here to ensure deterministic, clock-skew-safe deadline enforcement.
+	ClockFunc func() time.Time
+}
+
+func (v *Verifier) now() time.Time {
+	if v.ClockFunc != nil {
+		return v.ClockFunc()
+	}
+
+	return time.Now()
 }
 
 // Verify verifies the claim or reclaim signature
 func (v *Verifier) Verify(msg []byte, sigma []byte) error {
 	// if timeout has not elapsed, only claim is allowed
-	if time.Now().Before(v.Deadline) {
+	if v.now().Before(v.Deadline) {
 		cv := &ClaimVerifier{
 			Recipient: v.Recipient,
 			HashInfo: HashInfo{

token/services/selector/sherdlock/selector.go

@@ -162,6 +162,10 @@ func (s *selector) selectInternal(ctx context.Context, owner token.OwnerFilter,
 			return nil, nil, immediateRetries, errors.Wrapf(err, "failed to get tokens for [%s:%s] - unlock: %v", owner.ID(), tokenType, err2)
 		} else if t == nil {
 			if !tokensLockedByOthersExist {
+				if err2 := s.locker.UnlockAll(ctx); err2 != nil {
+					s.logger.Warnf("failed to unlock tokens on insufficient funds: %v", err2)
+				}
+
 				return nil, nil, immediateRetries, errors.Wrapf(
 					token.SelectorInsufficientFunds,
 					"insufficient funds, only [%s] tokens of type [%s] are available, but [%s] were requested and no other process has any tokens locked",

token/services/selector/sherdlock/selector_shutdown_test.go

@@ -56,7 +56,7 @@ func TestStubbornSelector_ContextCancellation(t *testing.T) {
 		)
 
 		// 50 ms is far shorter than time.Hour backoff — ctx.Done() fires first.
-		ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+		ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
 		defer cancel()
 
 		_, _, err := sel.Select(ctx, &ownerFilter{id: "wallet1"}, "100", "USD")

token/services/storage/db/kvs/identitydb.go

@@ -131,6 +131,7 @@ func (s *IdentityStore) StoreIdentityData(ctx context.Context, id []byte, identi
 		IdentityDBPrefix,
 		[]string{
 			IdentityDBData,
+			s.tmsID.String(),
 			tdriver.Identity(id).String(),
 		},
 	)
@@ -150,6 +151,7 @@ func (s *IdentityStore) GetAuditInfo(ctx context.Context, identity []byte) ([]by
 		IdentityDBPrefix,
 		[]string{
 			IdentityDBData,
+			s.tmsID.String(),
 			tdriver.Identity(identity).String(),
 		},
 	)
@@ -169,6 +171,7 @@ func (s *IdentityStore) GetTokenInfo(ctx context.Context, identity []byte) ([]by
 		IdentityDBPrefix,
 		[]string{
 			IdentityDBData,
+			s.tmsID.String(),
 			tdriver.Identity(identity).String(),
 		},
 	)
@@ -189,6 +192,7 @@ func (s *IdentityStore) StoreSignerInfo(ctx context.Context, id tdriver.Identity
 		IdentityDBPrefix,
 		[]string{
 			IdentityDBSigner,
+			s.tmsID.String(),
 			idHash,
 		},
 	)
@@ -210,6 +214,7 @@ func (s *IdentityStore) GetExistingSignerInfo(ctx context.Context, identities ..
 			IdentityDBPrefix,
 			[]string{
 				IdentityDBSigner,
+				s.tmsID.String(),
 				id.UniqueID(),
 			},
 		)
@@ -237,6 +242,7 @@ func (s *IdentityStore) GetSignerInfo(ctx context.Context, identity []byte) ([]b
 		IdentityDBPrefix,
 		[]string{
 			IdentityDBSigner,
+			s.tmsID.String(),
 			idHash,
 		},
 	)