Prove EveUnity receipt trust boundaries

TestProject/Packages/packages-lock.json

@@ -137,7 +137,7 @@
       "depth": 0,
       "source": "local",
       "dependencies": {
-        "org.gamecult.cultlib": "1.0.45"
+        "org.gamecult.cultlib": "1.0.56"
       }
     },
     "org.gamecult.eve.unity-scene": {
@@ -145,10 +145,10 @@
       "depth": 0,
       "source": "local",
       "dependencies": {
-        "org.gamecult.cultlib": "1.0.47",
+        "org.gamecult.cultlib": "1.0.56",
         "org.gamecult.eve.plugin-fields": "0.2.3",
-        "org.gamecult.eve.surface": "0.3.2",
+        "org.gamecult.eve.surface": "0.3.6",
-        "org.gamecult.eve.unity-uitoolkit": "0.1.4",
+        "org.gamecult.eve.unity-uitoolkit": "0.1.9",
         "com.unity.mathematics": "1.3.2",
         "com.unity.render-pipelines.universal": "17.4.0",
         "com.unity.modules.particlesystem": "1.0.0"
@@ -159,7 +159,7 @@
       "depth": 0,
       "source": "local",
       "dependencies": {
-        "org.gamecult.eve.surface": "0.3.2"
+        "org.gamecult.eve.surface": "0.3.6"
       }
     },
     "com.unity.modules.assetbundle": {

packages/org.gamecult.eve.unity-scene/Tests/Editor/EveUnityCultMeshAssetLookupTests.cs

@@ -289,6 +289,53 @@ namespace GameCult.Eve.UnityScene.Tests
             Assert.That(observed, Is.Empty);
         }
 
+        [TestCase("provider", "other.provider")]
+        [TestCase("surface", "other.surface")]
+        [TestCase("authority", "other.runtime")]
+        [TestCase("state", "mysterious")]
+        public void UntrustedReceiptCannotRetireOrPublishTheCommand(string field, string value)
+        {
+            using var transport = new EveUnityCultMeshLiveProviderTransport(
+                "test-cache",
+                "cultnet+tcp://127.0.0.1:1",
+                "test.verse",
+                "test.runtime",
+                "test.provider",
+                "test.surface");
+            var request = Request("launch-untrusted", "launch");
+            var type = typeof(EveUnityCultMeshLiveProviderTransport);
+            var pending = (IDictionary<string, EveSurfaceCommandRequest>)type.GetField(
+                "_pendingCommands",
+                BindingFlags.NonPublic | BindingFlags.Instance)!.GetValue(transport)!;
+            var publish = type.GetMethod("PublishReceipt", BindingFlags.NonPublic | BindingFlags.Instance)!;
+            pending.Add(request.CommandId, request);
+            var observed = new List<EveUnitySceneCommandReceipt>();
+            transport.CommandReceiptAvailable += observed.Add;
+
+            var providerId = field == "provider" ? value : request.ProviderId;
+            var surfaceId = field == "surface" ? value : request.SurfaceId;
+            var authority = field == "authority" ? value : "test.runtime";
+            var state = field == "state" ? value : "accepted";
+            var receipt = new EveCommandReceiptDocument(
+                "receipt-untrusted-" + field,
+                request.CommandId,
+                request.Command,
+                state,
+                "AetheriaEve",
+                authority,
+                providerId,
+                surfaceId,
+                "",
+                DateTimeOffset.UtcNow.ToString("O"),
+                1,
+                invocationHash: EveCommandInvocationHash.Compute(request));
+
+            publish.Invoke(transport, new object[] { receipt });
+
+            Assert.That(pending.ContainsKey(request.CommandId), Is.True);
+            Assert.That(observed, Is.Empty);
+        }
+
         [Test]
         public void ProviderSelectionCarriesStableIdentityWithoutExposingAPhysicalRoute()
         {

packages/org.gamecult.eve.unity-uitoolkit/package.json

@@ -5,7 +5,7 @@
     "unity": "2021.3",
     "description": "Unity UI Toolkit lowering for gamecult.eve.surface.v1 documents.",
     "dependencies": {
-        "org.gamecult.eve.surface": "0.3.5"
+        "org.gamecult.eve.surface": "0.3.6"
     },
     "keywords": [
         "Eve",