users state

initControllerPath

controllers

// caller whitelist

init.2

AddControllerAtGenesis

AddControllerAtGenesis allows adding a controller during chain genesis (height 0). This is mostly useful for testing.

ProposeNewController

ProposeNewController allows GovDAO to add a whitelisted caller

ProposeControllerRemoval

ProposeControllerRemoval allows GovDAO to add a whitelisted caller

ProposeControllerAdditionAndRemoval

ProposeControllerAdditionAndRemoval allows GovDAO to add a new caller and remove an old caller in the same proposal.

applyControllerSwap

applyControllerSwap is the callback body of ProposeControllerAdditionAndRemoval, extracted so it can be unit-tested without driving the full GovDAO flow. The desired end state is "toAdd is in the whitelist AND toRemove is out". Both operations are made idempotent so the swap doesn't silently no-op when the chain state has drifted between proposal creation and execution: - If toAdd is already whitelisted, treat addToWhitelist's ErrAlreadyWhitelisted as benign and continue to the remove step. - If toRemove is already absent, treat deleteFromWhitelist's ErrNotWhitelisted as benign and return success. Without this idempotency, the original code returned early on an "already whitelisted" toAdd and skipped the remove entirely — a swap proposal could pass governance and silently leave the old controller active. (audit finding #6)

ProposeRegisterUser

ProposeRegisterUser allows GovDAO to register a name without checking controllers. The executor closure runs with ignoreCanonical=true (decision #3): DAO grants always bypass canonical-collision detection. Voters see any collision in the proposal description and can vote NO if unintended.

ProposeUpdateName

ProposeUpdateName allows GovDAO to update a name with an alias without checking controllers. Like ProposeRegisterUser, the executor runs with ignoreCanonical=true (decision #3).

ProposeDeleteUser

ProposeDeleteUser allows GovDAO to delete a user without checking controllers

IsController

IsController reports whether the given address is currently in the controller whitelist. Returns the same boolean that gating checks (RegisterUser, UpdateName, Delete) use internally — useful for off-chain monitoring and for governance proposals to inspect state before voting.

Controllers

deleteFromWhitelist

addToWhitelist

IsNameTaken

IsNameTaken reports whether the exact-string name exists in nameStore. Returns true for any name ever registered, including: - active registrations - tombstoned (deleted) users' names — Delete() sets \`deleted=true\` but does not remove the nameStore entry (anti-revival policy) - old aliases from renames — UpdateName inserts the new name alongside the old; the old key stays (anti-rename-squat policy) In short: IsNameTaken(name) answers "would RegisterUser(name, \_) fail with ErrNameTaken?" — same answer for active, deleted, or aliased-away names. Pairs with IsCanonicalTaken (canonical-match) and ResolveName (active-current-user lookup with full UserData). No canonicalization is applied. For controllers that want exact- match uniqueness without pulling in canonical-collision logic.

IsCanonicalTaken

IsCanonicalTaken reports whether the given name's canonical form is already registered. Pass the raw name; canonicalization is applied internally. The first return is the original (non-canonical) name that owns the canonical key, for UX in collision messages. When a bypass write (RegisterUserIgnoreCanonical or the bypass path through ProposeRegisterUser/ProposeUpdateName) overwrites a prior canonical entry, this returns the most-recently-written original.

canonicalStore

canonicalStore maps canonicalized full names to the original name that was registered. Keyed by the result of Canonicalize. Multiple controllers (namereg/v1, future registries, governance, genesis bootstrapping) all share this single store via RegisterUser and the bypass variant RegisterUserIgnoreCanonical. Cross-controller canonical-collision detection is uniform and atomic with the nameStore write.

Canonicalize

Canonicalize returns the canonical form of a name. The substitutions collapse single-character visual confusables that arise across the allowed \[a-z0-9] character set, and strip the three separators that can sneak between identical alphanumeric runs. - {l, i, 1} → i - {0, o} → o - {-, ., \_} → stripped - all other characters unchanged CONTRACT: stable. Future controllers that want to share this canonical namespace MUST use this exact function — do not roll your own. Adding new substitutions later is a breaking change because it would silently re-key existing entries in canonicalStore. Input contract: ASCII-only. r/sys/users.validateName already rejects non-ASCII at the registration boundary, so by the time a name reaches Canonicalize through the standard write path it is guaranteed to be ASCII. Direct callers from other realms must honor this contract; non-ASCII bytes are passed through as-is and will produce undefined collision behavior. Multi-char confusables (m↔rn, nn↔m, cl↔d) are NOT canonicalized. They require fixed-point substring substitution rounds, which is out of scope for the unified store. Pure: no state access. Safe to call from anywhere.

prefix

ErrAlreadyWhitelisted

ErrWhitelistRemoveFailed

ErrNameTaken

ErrCanonicalCollision

ErrInvalidAddress

ErrEmptyUsername

ErrNameLikeAddress

ErrInvalidUsername

ErrAlreadyHasName

ErrDeletedUser

ErrUserNotExistOrDeleted

ErrInvalidRealm

ErrNotWhitelisted

ErrNotWhitelisted stores the failing caller's realm identity as a plain string so the error is a pure data record (no live realm values in its fields).

NewErrNotWhitelisted

NewErrNotWhitelisted constructs the error with the caller's realm identity captured as a string at construction time. The \_ int discriminator keeps this non-crossing (a non-crossing function can't take a \`realm\`-named-\`cur\` first param, so we use the standard \_ int, rlm realm shape).

Render

nameStore

// name/aliases > \*UserData

addressStore

// address > \*UserData

reAddressLookalike

reName

maxNameLen

RegisterUserEvent

UpdateNameEvent

DeleteUserEvent

UserData

registerUser

registerUser adds a new user to the system without checking controllers. The ignoreCanonical flag suppresses ErrCanonicalCollision; the canonical store is written either way (decision #14: later-wins on bypass).

RegisterUser

RegisterUser adds a new user to the system. Enforces canonical- collision detection: a name whose Canonicalize-form matches a prior registration returns ErrCanonicalCollision.

RegisterUserIgnoreCanonical

RegisterUserIgnoreCanonical is the bypass path: same controller- whitelist gate, but ErrCanonicalCollision is suppressed. The canonical store is still written; a prior entry with the same canonical key is silently overwritten (decision #14, later-wins). Use sparingly — names registered here can canonical-collide with existing ones, weakening confusable protection for everyone.

validateName

Validate validates username and address passed in Most of the validation is done in the controllers This provides more flexibility down the line

ResolveName

ResolveName returns the latest UserData of a specific user by name or alias

ResolveAddress

ResolveAddress returns the latest UserData of a specific user by address

ResolveAny

ResolveAny tries to resolve any given string to \*UserData If the input is not found in the registry in any form, nil is returned

GetReadonlyAddrStore

GetReadonlyAddrStore exposes the address store in readonly mode

GetReadOnlyNameStore

GetReadOnlyNameStore exposes the name store in readonly mode

makeUserDataSafe