Invoice Co-Creator Authorization

[Kingsman-99]

Description

Some invoices are issued jointly by multiple parties and should allow any of the designated co-creators to perform creator-privileged operations such as extending deadlines or cancelling. A co-creator list should supplement the primary creator.

Technical Context

Add co_creators: Vec<Address> to the Invoice struct in types.rs. Introduce a require_creator_or_cocreator(invoice_id, caller) helper in contracts/split/src/lib.rs that checks membership. Add add_co_creator and remove_co_creator methods restricted to the primary creator. Store the list under CoCreators(invoice_id) in storage::persistent.

Acceptance Criteria

• Co-creators can call extend_deadline and cancel_invoice
• Co-creators cannot add or remove other co-creators (primary creator only)
• The primary creator can remove a co-creator at any time
• CoCreatorAdded and CoCreatorRemoved events are emitted from events.rs
• Co-creator list is bounded to prevent unbounded storage growth
• All CI checks (cargo build --target wasm32-unknown-unknown, cargo test, cargo clippy) pass and the branch has no merge conflicts

---

[Bekirerdem]

@Bekirerdem has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Plan: Add co_creators: Vec<Address> to the Invoice struct in types.rs, stored under CoCreators(invoice_id) in storage::persistent. Introduce require_creator_or_cocreator(invoice_id, caller) in contracts/split/src/lib.rs and call it from extend_deadline and cancel_invoice, leaving add_co_creator / remove_co_creator gated on the primary creator only. Emit CoCreatorAdded / CoCreatorRemoved.

Two things I would want to get right beyond the checklist, since this is labelled security: the co-creator list is caller-growable, so it needs an explicit cap and a duplicate check - an unbounded Vec<Address> in persistent storage is both a rent problem and a cheap griefing vector. And membership has to be checked after require_auth() on the caller, not instead of it, so a co-creator address cannot be spoofed. Tests: co-creator can extend and cancel; co-creator cannot add or remove another; primary creator can always remove; duplicate add is rejected; cap is enforced; both events fire with the right topics.

Background: I shipped owner-gated authorization of exactly this shape in the Stellar Wave - C-Address-Onboarding-Bridge PR #132, an admin-managed asset whitelist with 25 passing tests, plus PR #183 (83 tests). I maintain PRISM (github.com/Bekirerdem/prism), a Soroban treasury whose whole model is caller-gated spend authorization on testnet.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Bekirerdem to this issue.

[augustinemartins]

@augustinemartins has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Maintainer,
I'd love to work on this issue. I've reviewed the requirements and I'm ready to get started. If it's available, I'd really appreciate it if you could assign it to me. Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @augustinemartins to this issue.

[drips-wave]

Congratulations, @augustinemartins! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @augustinemartins: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@augustinemartins's PR #547 was approved and merged by @Kingsman-99.

🏆 @augustinemartins: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (296 total points). Track your full progress on GrantFox.

👏 Great work, @augustinemartins! Keep contributing to Stellar-split.

[drips-wave]

This issue has been completed by @augustinemartins as part of the Stellar Wave Program's 7th Wave 🥳

😎 @augustinemartins: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.