zebra_rpc/methods/types/

transaction.rs

//! Transaction-related types.

use std::{collections::HashMap, sync::Arc};

use crate::methods::arrayhex;
use chrono::{DateTime, Utc};
use derive_getters::Getters;
use derive_new::new;
use hex::ToHex;
use rand::{rand_core::UnwrapErr, rngs::SysRng};
use zcash_script::script::Asm;

use zcash_keys::address::Address;
use zcash_primitives::transaction::{
    builder::{BuildConfig, Builder},
    fees::fixed::FeeRule,
};
use zcash_protocol::{consensus::BlockHeight, memo::MemoBytes, value::ZatBalance, value::Zatoshis};
use zebra_chain::{
    amount::{self, Amount, NegativeAllowed, NegativeOrZero, NonNegative},
    block::{self, merkle::AUTH_DIGEST_PLACEHOLDER, Height},
    parameters::{
        subsidy::{
            block_subsidy, funding_stream_address, funding_stream_values, miner_subsidy,
            nsm_fee_contribution,
        },
        Network, NetworkUpgrade,
    },
    primitives::ed25519,
    sapling::ValueCommitment,
    serialization::ZcashSerialize,
    transaction::{self, SerializedTransaction, Transaction, VerifiedUnminedTx},
    transparent::{OutPoint, Script, Utxo},
};
use zebra_consensus::error::TransactionError;
use zebra_script::Sigops;

use super::zec::Zec;
use super::{super::opthex, get_block_template::MinerParams};

/// Transaction data and fields needed to generate blocks using the `getblocktemplate` RPC.
#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
#[serde(bound = "FeeConstraint: amount::Constraint + Clone")]
pub struct TransactionTemplate<FeeConstraint>
where
    FeeConstraint: amount::Constraint + Clone + Copy,
{
    /// The hex-encoded serialized data for this transaction.
    #[serde(with = "hex")]
    pub(crate) data: SerializedTransaction,

    /// The transaction ID of this transaction.
    #[serde(with = "hex")]
    #[getter(copy)]
    pub(crate) hash: transaction::Hash,

    /// The authorizing data digest of a v5 transaction, or a placeholder for older versions.
    #[serde(rename = "authdigest")]
    #[serde(with = "hex")]
    #[getter(copy)]
    pub(crate) auth_digest: transaction::AuthDigest,

    /// The transactions in this block template that this transaction depends upon.
    /// These are 1-based indexes in the `transactions` list.
    ///
    /// Populated when the selected transactions are assembled into a block template.
    ///
    /// We use `u16` because 2 MB blocks are limited to around 39,000 transactions.
    pub(crate) depends: Vec<u16>,

    /// The fee for this transaction.
    ///
    /// Non-coinbase transactions must be `NonNegative`.
    /// The coinbase transaction `fee` is the negative total collected miner fees, excluding
    /// the NSM contribution, so its fee must be `NegativeOrZero`.
    #[getter(copy)]
    pub(crate) fee: Amount<FeeConstraint>,

    /// The number of transparent signature operations in this transaction.
    pub(crate) sigops: u32,

    /// Is this transaction required in the block?
    ///
    /// Coinbase transactions are required, all other transactions are not.
    pub(crate) required: bool,
}

// Convert from a mempool transaction to a non-coinbase transaction template.
impl From<&VerifiedUnminedTx> for TransactionTemplate<NonNegative> {
    fn from(tx: &VerifiedUnminedTx) -> Self {
        assert!(
            !tx.transaction.transaction.is_coinbase(),
            "unexpected coinbase transaction in mempool"
        );

        Self {
            data: tx.transaction.transaction.as_ref().into(),
            hash: tx.transaction.id.mined_id(),
            auth_digest: tx
                .transaction
                .id
                .auth_digest()
                .unwrap_or(AUTH_DIGEST_PLACEHOLDER),

            // Indexes require the final selected transaction order.
            depends: Vec::new(),

            fee: tx.miner_fee,

            // Report the full block-level sigop count (legacy + P2SH) so the template `sigops`
            // field matches what the block verifier charges against `MAX_BLOCK_SIGOPS`.
            sigops: tx.block_sigop_count(),

            // Zebra does not require any transactions except the coinbase transaction.
            required: false,
        }
    }
}

impl From<VerifiedUnminedTx> for TransactionTemplate<NonNegative> {
    fn from(tx: VerifiedUnminedTx) -> Self {
        Self::from(&tx)
    }
}

impl TransactionTemplate<NegativeOrZero> {
    /// Constructs a transaction template for a coinbase without parent-dependent reissuance.
    ///
    /// `txs_fee` is the gross transaction fee total. The payout and the template's negative
    /// `fee` include only the miner's share after the NSM contribution.
    pub fn new_coinbase(
        net: &Network,
        height: Height,
        miner_params: &MinerParams,
        txs_fee: Amount<NonNegative>,
    ) -> Result<Self, TransactionError> {
        Self::new_coinbase_with_parent_pools(net, height, miner_params, txs_fee, None)
    }

    /// Constructs a transaction template for a coinbase transaction in a block whose parent leaves
    /// `parent_nsm_value_balance` in the NSM value balance.
    ///
    /// The parent's NSM value balance is required from the NSM reissuance height, because it
    /// determines the block subsidy.
    /// The payout and negative `fee` include only net miner fees after the NSM contribution.
    pub fn new_coinbase_with_parent_pools(
        net: &Network,
        height: Height,
        miner_params: &MinerParams,
        txs_fee: Amount<NonNegative>,
        parent_nsm_value_balance: Option<Amount<NonNegative>>,
    ) -> Result<Self, TransactionError> {
        let block_subsidy = match parent_nsm_value_balance {
            Some(parent_nsm_value_balance) => {
                zebra_chain::parameters::subsidy::block_subsidy_with_parent_nsm_value_balance(
                    height,
                    net,
                    parent_nsm_value_balance,
                )?
            }
            None => block_subsidy(height, net)?,
        };
        // From NU7 activation, the coinbase can't claim the fees ZIP 235 removes from circulation.
        let miner_fees = (txs_fee - nsm_fee_contribution(height, net, txs_fee))?;
        let miner_reward = miner_subsidy(height, net, block_subsidy)? + miner_fees;
        let miner_reward = Zatoshis::try_from(miner_reward?)?;

        let mut builder = Builder::new(
            net,
            BlockHeight::from(height),
            BuildConfig::Coinbase {
                miner_data: miner_params.data().clone(),
            },
        );

        let default_memo = MemoBytes::empty();
        let memo = miner_params.memo().unwrap_or(&default_memo);

        // ZIP-233 was dropped from the v6 transaction format, so no burn amount is set here. The
        // fees ZIP 235 removes from circulation are left out of the miner reward above, and need
        // no transaction field.

        macro_rules! trace_err {
            ($res:expr, $type:expr) => {
                $res.map_err(|err| tracing::error!("Failed to add {} output: {err}", $type))
                    .ok()
            };
        }

        // On NU6.3 onward the coinbase MUST have an empty Orchard component, and newly shielded
        // coinbase value is routed to the Ironwood pool instead (see the Ironwood pool spec and
        // `coinbase_orchard_component_empty` in zebra-consensus). Ironwood outputs use the same
        // Orchard-shaped `orchard::Address` as their recipient, so a unified miner address with an
        // Orchard receiver just gets routed to the Ironwood output builder from NU6.3 onward.
        let use_ironwood = NetworkUpgrade::current(net, height) >= NetworkUpgrade::Nu6_3;

        let add_shielded_reward = |builder: &mut Builder<_, _>, addr: &_| {
            let ovk = Some(::orchard::keys::OutgoingViewingKey::from([0u8; 32]));
            if use_ironwood {
                trace_err!(
                    builder.add_ironwood_output::<String>(ovk, *addr, miner_reward, memo.clone()),
                    "Ironwood"
                )
            } else {
                trace_err!(
                    builder.add_orchard_output::<String>(ovk, *addr, miner_reward, memo.clone()),
                    "Orchard"
                )
            }
        };

        let add_sapling_reward = |builder: &mut Builder<_, _>, addr: &_| {
            trace_err!(
                builder.add_sapling_output::<String>(
                    Some(sapling_crypto::keys::OutgoingViewingKey([0u8; 32])),
                    *addr,
                    miner_reward,
                    memo.clone(),
                ),
                "Sapling"
            )
        };

        let add_transparent_reward = |builder: &mut Builder<_, _>, addr| {
            trace_err!(
                builder.add_transparent_output(addr, miner_reward),
                "transparent"
            )
        };

        match miner_params.addr() {
            Address::Unified(addr) => addr
                .orchard()
                .and_then(|addr| add_shielded_reward(&mut builder, addr))
                .or_else(|| {
                    addr.sapling()
                        .and_then(|addr| add_sapling_reward(&mut builder, addr))
                })
                .or_else(|| {
                    addr.transparent()
                        .and_then(|addr| add_transparent_reward(&mut builder, addr))
                }),

            Address::Sapling(addr) => add_sapling_reward(&mut builder, addr),

            Address::Transparent(addr) => add_transparent_reward(&mut builder, addr),

            _ => Err(TransactionError::CoinbaseConstruction(
                "Address not supported for miner rewards".to_string(),
            ))?,
        }
        .ok_or(TransactionError::CoinbaseConstruction(
            "Could not construct output with miner reward".to_string(),
        ))?;

        let mut funding_streams = funding_stream_values(height, net, block_subsidy)?
            .into_iter()
            .filter_map(|(receiver, amount)| {
                Some((*funding_stream_address(height, net, receiver)?, amount))
            })
            .chain(net.lockbox_disbursements(height))
            .filter_map(|(addr, amount)| {
                Some((Zatoshis::try_from(amount).ok()?, addr.try_into().ok()?))
            })
            .collect::<Vec<_>>();

        funding_streams.sort();

        for (fs_amount, fs_addr) in funding_streams {
            builder.add_transparent_output(&fs_addr, fs_amount)?;
        }

        let sapling_prover = zebra_consensus::sapling_prover();
        let build_result = builder.build(
            &Default::default(),
            Default::default(),
            Default::default(),
            UnwrapErr(SysRng),
            sapling_prover,
            sapling_prover,
            &FeeRule::non_standard(Zatoshis::ZERO),
        )?;

        let tx = build_result.transaction();
        let mut data = vec![];
        tx.write(&mut data)?;

        Ok(Self {
            data: data.into(),
            hash: tx.txid().as_ref().into(),
            auth_digest: tx.auth_commitment().as_ref().try_into()?,
            depends: Vec::new(),
            fee: (-miner_fees).constrain()?,
            sigops: tx.sigops()?,
            required: true,
        })
    }
}

/// A Transaction object as returned by `getrawtransaction` and `getblock` RPC
/// requests.
#[allow(clippy::too_many_arguments)]
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct TransactionObject {
    /// Whether specified block is in the active chain or not (only present with
    /// explicit "blockhash" argument)
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) in_active_chain: Option<bool>,
    /// The raw transaction, encoded as hex bytes.
    #[serde(with = "hex")]
    pub(crate) hex: SerializedTransaction,
    /// The height of the block in the best chain that contains the tx, -1 if
    /// it's in a side chain block, or `None` if the tx is in the mempool.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) height: Option<i32>,
    /// The height diff between the block containing the tx and the best chain
    /// tip + 1, 0 if it's in a side chain, or `None` if the tx is in the
    /// mempool.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) confirmations: Option<i64>,

    /// The transaction fee in ZEC, only present at `getblock` verbosity 3.
    ///
    /// Omitted for the coinbase transaction and when a spent output cannot be found.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) fee: Option<f64>,

    /// Transparent inputs of the transaction.
    #[serde(rename = "vin")]
    pub(crate) inputs: Vec<Input>,

    /// Transparent outputs of the transaction.
    #[serde(rename = "vout")]
    pub(crate) outputs: Vec<Output>,

    /// Sapling spends of the transaction.
    #[serde(rename = "vShieldedSpend")]
    pub(crate) shielded_spends: Vec<ShieldedSpend>,

    /// Sapling outputs of the transaction.
    #[serde(rename = "vShieldedOutput")]
    pub(crate) shielded_outputs: Vec<ShieldedOutput>,

    /// Transparent outputs of the transaction.
    #[serde(rename = "vjoinsplit")]
    pub(crate) joinsplits: Vec<JoinSplit>,

    /// Sapling binding signature of the transaction.
    #[serde(
        skip_serializing_if = "Option::is_none",
        with = "opthex",
        default,
        rename = "bindingSig"
    )]
    #[getter(copy)]
    pub(crate) binding_sig: Option<[u8; 64]>,

    /// JoinSplit public key of the transaction.
    #[serde(
        skip_serializing_if = "Option::is_none",
        with = "opthex",
        default,
        rename = "joinSplitPubKey"
    )]
    #[getter(copy)]
    pub(crate) joinsplit_pub_key: Option<[u8; 32]>,

    /// JoinSplit signature of the transaction.
    #[serde(
        skip_serializing_if = "Option::is_none",
        with = "opthex",
        default,
        rename = "joinSplitSig"
    )]
    #[getter(copy)]
    pub(crate) joinsplit_sig: Option<[u8; ed25519::Signature::BYTE_SIZE]>,

    /// Orchard actions of the transaction.
    #[serde(rename = "orchard", skip_serializing_if = "Option::is_none")]
    pub(crate) orchard: Option<Orchard>,

    /// Ironwood actions of the transaction (v6 transactions from NU6.3 onward).
    ///
    /// The Ironwood pool reuses the Orchard-shaped bundle, so this uses the same [`Orchard`] object.
    #[serde(rename = "ironwood", skip_serializing_if = "Option::is_none")]
    pub(crate) ironwood: Option<Orchard>,

    /// The net value of Sapling Spends minus Outputs in ZEC
    #[serde(rename = "valueBalance", skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) value_balance: Option<f64>,

    /// The net value of Sapling Spends minus Outputs in zatoshis
    #[serde(rename = "valueBalanceZat", skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) value_balance_zat: Option<i64>,

    /// The size of the transaction in bytes.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) size: Option<i64>,

    /// The time the transaction was included in a block.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) time: Option<i64>,

    /// The transaction identifier, encoded as hex bytes.
    #[serde(with = "hex")]
    #[getter(copy)]
    pub txid: transaction::Hash,

    /// The transaction's auth digest. For pre-v5 transactions this will be
    /// ffff..ffff
    #[serde(
        rename = "authdigest",
        with = "opthex",
        skip_serializing_if = "Option::is_none",
        default
    )]
    #[getter(copy)]
    pub(crate) auth_digest: Option<transaction::AuthDigest>,

    /// Whether the overwintered flag is set
    pub(crate) overwintered: bool,

    /// The version of the transaction.
    pub(crate) version: u32,

    /// The version group ID.
    #[serde(
        rename = "versiongroupid",
        with = "opthex",
        skip_serializing_if = "Option::is_none",
        default
    )]
    pub(crate) version_group_id: Option<Vec<u8>>,

    /// The lock time
    #[serde(rename = "locktime")]
    pub(crate) lock_time: u32,

    /// The block height after which the transaction expires.
    /// Included for Overwinter+ transactions (matching zcashd), omitted for V1/V2.
    /// See: <https://github.com/zcash/zcash/blob/v6.11.0/src/rpc/rawtransaction.cpp#L224-L226>
    #[serde(rename = "expiryheight", skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) expiry_height: Option<Height>,

    /// The block hash
    #[serde(
        rename = "blockhash",
        with = "opthex",
        skip_serializing_if = "Option::is_none",
        default
    )]
    #[getter(copy)]
    pub(crate) block_hash: Option<block::Hash>,

    /// The block height after which the transaction expires
    #[serde(rename = "blocktime", skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    pub(crate) block_time: Option<i64>,
}

/// The transparent input of a transaction.
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(untagged)]
pub enum Input {
    /// A coinbase input.
    Coinbase {
        /// The coinbase scriptSig as hex.
        #[serde(with = "hex")]
        coinbase: Vec<u8>,
        /// The script sequence number.
        sequence: u32,
    },
    /// A non-coinbase input.
    NonCoinbase {
        /// The transaction id.
        txid: String,
        /// The vout index.
        vout: u32,
        /// The script.
        #[serde(rename = "scriptSig")]
        script_sig: ScriptSig,
        /// The script sequence number.
        sequence: u32,
        /// The value of the output being spent in ZEC.
        #[serde(skip_serializing_if = "Option::is_none")]
        value: Option<f64>,
        /// The value of the output being spent, in zats, named to match zcashd.
        #[serde(rename = "valueSat", skip_serializing_if = "Option::is_none")]
        value_zat: Option<i64>,
        /// The address of the output being spent.
        #[serde(skip_serializing_if = "Option::is_none")]
        address: Option<String>,
        /// The output being spent, only present at `getblock` verbosity 3.
        ///
        /// Boxed to keep the common (verbosity 1/2) input small.
        #[serde(skip_serializing_if = "Option::is_none")]
        prevout: Option<Box<Prevout>>,
    },
}

/// The previous output spent by a transparent input.
///
/// Only present at `getblock` verbosity 3. The fields match Bitcoin Core's `getblock`
/// verbosity 3 `prevout` object.
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct Prevout {
    /// Whether the output being spent was created by a coinbase transaction.
    #[getter(copy)]
    generated: bool,
    /// The height of the block that created the output being spent.
    #[getter(copy)]
    height: u32,
    /// The value of the output being spent in ZEC.
    #[getter(copy)]
    value: f64,
    /// The scriptPubKey of the output being spent.
    #[serde(rename = "scriptPubKey")]
    script_pub_key: ScriptPubKey,
}

/// The transparent output of a transaction.
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct Output {
    /// The value in ZEC.
    value: f64,
    /// The value in zats.
    #[serde(rename = "valueZat")]
    value_zat: i64,
    /// index.
    n: u32,
    /// The scriptPubKey.
    #[serde(rename = "scriptPubKey")]
    script_pub_key: ScriptPubKey,
}

/// The output object returned by `gettxout` RPC requests.
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct OutputObject {
    #[serde(rename = "bestblock")]
    best_block: String,
    confirmations: u32,
    value: f64,
    #[serde(rename = "scriptPubKey")]
    script_pub_key: ScriptPubKey,
    version: u32,
    coinbase: bool,
}
impl OutputObject {
    pub fn from_output(
        output: &zebra_chain::transparent::Output,
        best_block: String,
        confirmations: u32,
        version: u32,
        coinbase: bool,
        network: &Network,
    ) -> Self {
        Self {
            best_block,
            confirmations,
            value: crate::methods::types::zec::Zec::from(output.value()).lossy_zec(),
            script_pub_key: ScriptPubKey::from_output(output, network),
            version,
            coinbase,
        }
    }
}

/// The scriptPubKey of a transaction output.
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct ScriptPubKey {
    /// the asm.
    asm: String,
    /// the hex.
    #[serde(with = "hex")]
    hex: Script,
    /// The required sigs.
    #[serde(rename = "reqSigs")]
    #[serde(default)]
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    req_sigs: Option<u32>,
    /// The type, eg 'pubkeyhash'.
    r#type: String,
    /// The addresses.
    #[serde(default)]
    #[serde(skip_serializing_if = "Option::is_none")]
    addresses: Option<Vec<String>>,
}

impl ScriptPubKey {
    /// Builds the `scriptPubKey` object for a transparent output's lock script.
    pub fn from_output(output: &zebra_chain::transparent::Output, network: &Network) -> Self {
        let lock_script = &output.lock_script;
        let addresses = output.address(network).map(|addr| vec![addr.to_string()]);
        let req_sigs = addresses.as_ref().map(|a| a.len() as u32);

        Self {
            // https://github.com/zcash/zcash/blob/v6.11.0/src/rpc/rawtransaction.cpp#L271
            // https://github.com/zcash/zcash/blob/v6.11.0/src/rpc/rawtransaction.cpp#L45
            asm: zcash_script::script::Code(lock_script.as_raw_bytes().to_vec()).to_asm(false),
            hex: lock_script.clone(),
            req_sigs,
            r#type: zcash_script::script::Code(lock_script.as_raw_bytes().to_vec())
                .to_component()
                .ok()
                .and_then(|c| c.refine().ok())
                .and_then(|component| zcash_script::solver::standard(&component))
                .map(|kind| match kind {
                    zcash_script::solver::ScriptKind::PubKeyHash { .. } => "pubkeyhash",
                    zcash_script::solver::ScriptKind::ScriptHash { .. } => "scripthash",
                    zcash_script::solver::ScriptKind::MultiSig { .. } => "multisig",
                    zcash_script::solver::ScriptKind::NullData { .. } => "nulldata",
                    zcash_script::solver::ScriptKind::PubKey { .. } => "pubkey",
                })
                .unwrap_or("nonstandard")
                .to_string(),
            addresses,
        }
    }
}

/// The scriptSig of a transaction input.
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct ScriptSig {
    /// The asm.
    asm: String,
    /// The hex.
    hex: Script,
}

/// A Sprout JoinSplit of a transaction.
#[allow(clippy::too_many_arguments)]
#[serde_with::serde_as]
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct JoinSplit {
    /// Public input value in ZEC.
    #[serde(rename = "vpub_old")]
    old_public_value: f64,
    /// Public input value in zatoshis.
    #[serde(rename = "vpub_oldZat")]
    old_public_value_zat: i64,
    /// Public input value in ZEC.
    #[serde(rename = "vpub_new")]
    new_public_value: f64,
    /// Public input value in zatoshis.
    #[serde(rename = "vpub_newZat")]
    new_public_value_zat: i64,
    /// Merkle root of the Sprout note commitment tree.
    #[serde(with = "hex")]
    #[getter(copy)]
    anchor: [u8; 32],
    /// The nullifier of the input notes.
    #[serde_as(as = "Vec<serde_with::hex::Hex>")]
    nullifiers: Vec<[u8; 32]>,
    /// The commitments of the output notes.
    #[serde_as(as = "Vec<serde_with::hex::Hex>")]
    commitments: Vec<[u8; 32]>,
    /// The onetime public key used to encrypt the ciphertexts
    #[serde(rename = "onetimePubKey")]
    #[serde(with = "hex")]
    #[getter(copy)]
    one_time_pubkey: [u8; 32],
    /// The random seed
    #[serde(rename = "randomSeed")]
    #[serde(with = "hex")]
    #[getter(copy)]
    random_seed: [u8; 32],
    /// The input notes MACs.
    #[serde_as(as = "Vec<serde_with::hex::Hex>")]
    macs: Vec<[u8; 32]>,
    /// A zero-knowledge proof using the Sprout circuit.
    #[serde(with = "hex")]
    proof: Vec<u8>,
    /// The output notes ciphertexts.
    #[serde_as(as = "Vec<serde_with::hex::Hex>")]
    ciphertexts: Vec<Vec<u8>>,
}

/// A Sapling spend of a transaction.
#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct ShieldedSpend {
    /// Value commitment to the input note.
    #[serde(with = "hex")]
    #[getter(skip)]
    cv: ValueCommitment,
    /// Merkle root of the Sapling note commitment tree.
    #[serde(with = "hex")]
    #[getter(copy)]
    anchor: [u8; 32],
    /// The nullifier of the input note.
    #[serde(with = "hex")]
    #[getter(copy)]
    nullifier: [u8; 32],
    /// The randomized public key for spendAuthSig.
    #[serde(with = "hex")]
    #[getter(copy)]
    rk: [u8; 32],
    /// A zero-knowledge proof using the Sapling Spend circuit.
    #[serde(with = "hex")]
    #[getter(copy)]
    proof: [u8; 192],
    /// A signature authorizing this Spend.
    #[serde(rename = "spendAuthSig", with = "hex")]
    #[getter(copy)]
    spend_auth_sig: [u8; 64],
}

// We can't use `#[getter(copy)]` as upstream `sapling_crypto::note::ValueCommitment` is not `Copy`.
impl ShieldedSpend {
    /// The value commitment to the input note.
    pub fn cv(&self) -> ValueCommitment {
        self.cv.clone()
    }
}

/// A Sapling output of a transaction.
#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct ShieldedOutput {
    /// Value commitment to the input note.
    #[serde(with = "hex")]
    #[getter(skip)]
    cv: ValueCommitment,
    /// The u-coordinate of the note commitment for the output note.
    #[serde(rename = "cmu", with = "hex")]
    cm_u: [u8; 32],
    /// A Jubjub public key.
    #[serde(rename = "ephemeralKey", with = "hex")]
    ephemeral_key: [u8; 32],
    /// The output note encrypted to the recipient.
    #[serde(rename = "encCiphertext", with = "arrayhex")]
    enc_ciphertext: [u8; 580],
    /// A ciphertext enabling the sender to recover the output note.
    #[serde(rename = "outCiphertext", with = "hex")]
    out_ciphertext: [u8; 80],
    /// A zero-knowledge proof using the Sapling Output circuit.
    #[serde(with = "hex")]
    proof: [u8; 192],
}

// We can't use `#[getter(copy)]` as upstream `sapling_crypto::note::ValueCommitment` is not `Copy`.
impl ShieldedOutput {
    /// The value commitment to the output note.
    pub fn cv(&self) -> ValueCommitment {
        self.cv.clone()
    }
}

/// Object with Orchard-specific information.
#[serde_with::serde_as]
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct Orchard {
    /// Array of Orchard actions.
    actions: Vec<OrchardAction>,
    /// The net value of Orchard Actions in ZEC.
    #[serde(rename = "valueBalance")]
    value_balance: f64,
    /// The net value of Orchard Actions in zatoshis.
    #[serde(rename = "valueBalanceZat")]
    value_balance_zat: i64,
    /// The flags.
    #[serde(skip_serializing_if = "Option::is_none")]
    flags: Option<OrchardFlags>,
    /// A root of the Orchard note commitment tree at some block height in the past
    #[serde_as(as = "Option<serde_with::hex::Hex>")]
    #[serde(skip_serializing_if = "Option::is_none")]
    #[getter(copy)]
    anchor: Option<[u8; 32]>,
    /// Encoding of aggregated zk-SNARK proofs for Orchard Actions
    #[serde_as(as = "Option<serde_with::hex::Hex>")]
    #[serde(skip_serializing_if = "Option::is_none")]
    proof: Option<Vec<u8>>,
    /// An Orchard binding signature on the SIGHASH transaction hash
    #[serde(rename = "bindingSig")]
    #[serde(skip_serializing_if = "Option::is_none")]
    #[serde_as(as = "Option<serde_with::hex::Hex>")]
    #[getter(copy)]
    binding_sig: Option<[u8; 64]>,
}

/// Object with Orchard-specific information.
#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct OrchardFlags {
    /// Whether Orchard outputs are enabled.
    #[serde(rename = "enableOutputs")]
    enable_outputs: bool,
    /// Whether Orchard spends are enabled.
    #[serde(rename = "enableSpends")]
    enable_spends: bool,
}

/// The Orchard action of a transaction.
#[allow(clippy::too_many_arguments)]
#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize, Getters, new)]
pub struct OrchardAction {
    /// A value commitment to the net value of the input note minus the output note.
    #[serde(with = "hex")]
    cv: [u8; 32],
    /// The nullifier of the input note.
    #[serde(with = "hex")]
    nullifier: [u8; 32],
    /// The randomized validating key for spendAuthSig.
    #[serde(with = "hex")]
    rk: [u8; 32],
    /// The x-coordinate of the note commitment for the output note.
    #[serde(rename = "cmx", with = "hex")]
    cm_x: [u8; 32],
    /// An encoding of an ephemeral Pallas public key.
    #[serde(rename = "ephemeralKey", with = "hex")]
    ephemeral_key: [u8; 32],
    /// The output note encrypted to the recipient.
    #[serde(rename = "encCiphertext", with = "arrayhex")]
    enc_ciphertext: [u8; 580],
    /// A ciphertext enabling the sender to recover the output note.
    #[serde(rename = "spendAuthSig", with = "hex")]
    spend_auth_sig: [u8; 64],
    /// A signature authorizing the spend in this Action.
    #[serde(rename = "outCiphertext", with = "hex")]
    out_ciphertext: [u8; 80],
}

/// Builds the RPC object for an Orchard-shaped shielded pool (Orchard or Ironwood) from its
/// shielded data and net value balance.
///
/// The Ironwood pool reuses the Orchard bundle shape, so both pools serialize through the same
/// [`Orchard`] object; the caller selects which pool's shielded data and value balance to pass.
/// Builds the RPC object for an Orchard-shaped bundle.
///
/// Both the Orchard and Ironwood pools use the same bundle type and the same wire shape, so this
/// serves both. The caller supplies the pool's own value balance, since that is read from a
/// separate field per pool.
fn orchard_shaped_object(
    bundle: Option<&::orchard::Bundle<::orchard::bundle::Authorized, ZatBalance>>,
    value_balance: Amount<NegativeAllowed>,
) -> Orchard {
    let actions = bundle
        .into_iter()
        .flat_map(|bundle| bundle.actions().iter())
        .map(|action| OrchardAction {
            cv: action.cv_net().to_bytes(),
            nullifier: action.nullifier().to_bytes(),
            rk: action.rk().into(),
            cm_x: action.cmx().to_bytes(),
            ephemeral_key: action.encrypted_note().epk_bytes,
            enc_ciphertext: action.encrypted_note().enc_ciphertext.0,
            spend_auth_sig: action.authorization().into(),
            out_ciphertext: action.encrypted_note().out_ciphertext,
        })
        .collect();

    Orchard {
        actions,
        value_balance: Zec::from(value_balance).lossy_zec(),
        value_balance_zat: value_balance.zatoshis(),
        flags: bundle.map(|bundle| {
            let flags = bundle.flags();
            OrchardFlags::new(flags.outputs_enabled(), flags.spends_enabled())
        }),
        anchor: bundle.map(|bundle| {
            let mut anchor = bundle.anchor().to_bytes();
            // Display order is reversed in the RPC output.
            anchor.reverse();
            anchor
        }),
        proof: bundle.map(|bundle| bundle.authorization().proof().as_ref().to_vec()),
        binding_sig: bundle
            .map(|bundle| <[u8; 64]>::from(bundle.authorization().binding_signature())),
    }
}

impl Default for TransactionObject {
    fn default() -> Self {
        Self {
            hex: SerializedTransaction::from(
                [0u8; zebra_chain::transaction::MIN_TRANSPARENT_TX_SIZE as usize].to_vec(),
            ),
            height: Option::default(),
            confirmations: Option::default(),
            fee: None,
            inputs: Vec::new(),
            outputs: Vec::new(),
            shielded_spends: Vec::new(),
            shielded_outputs: Vec::new(),
            joinsplits: Vec::new(),
            orchard: None,
            ironwood: None,
            binding_sig: None,
            joinsplit_pub_key: None,
            joinsplit_sig: None,
            value_balance: None,
            value_balance_zat: None,
            size: None,
            time: None,
            txid: transaction::Hash::from([0u8; 32]),
            in_active_chain: None,
            auth_digest: None,
            overwintered: false,
            version: 4,
            version_group_id: None,
            lock_time: 0,
            expiry_height: None,
            block_hash: None,
            block_time: None,
        }
    }
}

impl TransactionObject {
    /// Converts `tx` and `height` into a new `GetRawTransaction` in the `verbose` format.
    #[allow(clippy::unwrap_in_result)]
    #[allow(clippy::too_many_arguments)]
    pub fn from_transaction(
        tx: Arc<Transaction>,
        height: Option<block::Height>,
        confirmations: Option<i64>,
        network: &Network,
        block_time: Option<DateTime<Utc>>,
        block_hash: Option<block::Hash>,
        in_active_chain: Option<bool>,
        txid: transaction::Hash,
    ) -> Self {
        let block_time = block_time.map(|bt| bt.timestamp());
        Self {
            hex: tx.clone().into(),
            height: if in_active_chain.unwrap_or_default() {
                height.map(|height| height.0 as i32)
            } else if block_hash.is_some() {
                // Side chain
                Some(-1)
            } else {
                // Mempool
                None
            },
            confirmations: if in_active_chain.unwrap_or_default() {
                confirmations
            } else if block_hash.is_some() {
                // Side chain
                Some(0)
            } else {
                // Mempool
                None
            },
            // Only populated at `getblock` verbosity 3.
            fee: None,
            inputs: tx
                .inputs()
                .iter()
                .map(|input| match input {
                    zebra_chain::transparent::Input::Coinbase { sequence, .. } => Input::Coinbase {
                        coinbase: input
                            .coinbase_script()
                            .expect("we know it is a valid coinbase script"),
                        sequence: *sequence,
                    },
                    zebra_chain::transparent::Input::PrevOut {
                        sequence,
                        unlock_script,
                        outpoint,
                    } => Input::NonCoinbase {
                        txid: outpoint.hash.encode_hex(),
                        vout: outpoint.index,
                        script_sig: ScriptSig {
                            // https://github.com/zcash/zcash/blob/v6.11.0/src/rpc/rawtransaction.cpp#L240
                            asm: zcash_script::script::Code(unlock_script.as_raw_bytes().to_vec())
                                .to_asm(true),
                            hex: unlock_script.clone(),
                        },
                        sequence: *sequence,
                        value: None,
                        value_zat: None,
                        address: None,
                        prevout: None,
                    },
                })
                .collect(),
            outputs: tx
                .outputs()
                .iter()
                .enumerate()
                .map(|(n, output)| Output {
                    value: Zec::from(output.value).lossy_zec(),
                    value_zat: output.value.zatoshis(),
                    n: n as u32,
                    script_pub_key: ScriptPubKey::from_output(output, network),
                })
                .collect(),
            shielded_spends: tx
                .sapling_spends()
                .map(|spend| {
                    let mut anchor = spend.anchor().to_bytes();
                    anchor.reverse();

                    let mut nullifier = spend.nullifier().0;
                    nullifier.reverse();

                    let mut rk: [u8; 32] = (*spend.rk()).into();
                    rk.reverse();

                    let spend_auth_sig: [u8; 64] = (*spend.spend_auth_sig()).into();

                    ShieldedSpend {
                        cv: ValueCommitment(spend.cv().clone()),
                        anchor,
                        nullifier,
                        rk,
                        proof: *spend.zkproof(),
                        spend_auth_sig,
                    }
                })
                .collect(),
            shielded_outputs: tx
                .sapling_outputs()
                .map(|output| {
                    let mut cm_u: [u8; 32] = output.cmu().to_bytes();
                    cm_u.reverse();
                    let mut ephemeral_key: [u8; 32] = output.ephemeral_key().0;
                    ephemeral_key.reverse();
                    let enc_ciphertext: [u8; 580] = *output.enc_ciphertext();
                    let out_ciphertext: [u8; 80] = *output.out_ciphertext();

                    ShieldedOutput {
                        cv: ValueCommitment(output.cv().clone()),
                        cm_u,
                        ephemeral_key,
                        enc_ciphertext,
                        out_ciphertext,
                        proof: *output.zkproof(),
                    }
                })
                .collect(),
            joinsplits: tx
                .sprout_joinsplit_descriptions()
                .map(|joinsplit| {
                    // `JsDescription` stores every field in wire order; the RPC renders the
                    // 32-byte fields in display (reversed) order, matching zcashd.
                    let display_order = |bytes: &[u8; 32]| {
                        let mut bytes = *bytes;
                        bytes.reverse();
                        bytes
                    };

                    let (ephemeral_key, proof, ciphertexts) =
                        transaction::sprout_joinsplit_key_proof_and_ciphertexts(joinsplit);

                    let vpub_old = i64::from(joinsplit.vpub_old());
                    let vpub_new = i64::from(joinsplit.vpub_new());
                    let vpub_old_amount = Amount::<NonNegative>::try_from(vpub_old)
                        .expect("vpub_old is a valid non-negative amount");
                    let vpub_new_amount = Amount::<NonNegative>::try_from(vpub_new)
                        .expect("vpub_new is a valid non-negative amount");

                    JoinSplit {
                        old_public_value: Zec::from(vpub_old_amount).lossy_zec(),
                        old_public_value_zat: vpub_old,
                        new_public_value: Zec::from(vpub_new_amount).lossy_zec(),
                        new_public_value_zat: vpub_new,
                        anchor: display_order(joinsplit.anchor()),
                        nullifiers: joinsplit.nullifiers().iter().map(display_order).collect(),
                        commitments: joinsplit.commitments().iter().map(display_order).collect(),
                        one_time_pubkey: display_order(&ephemeral_key),
                        random_seed: display_order(joinsplit.random_seed()),
                        macs: joinsplit.macs().iter().map(display_order).collect(),
                        proof,
                        ciphertexts: ciphertexts.iter().map(|c| c.to_vec()).collect(),
                    }
                })
                .collect(),
            value_balance: Some(Zec::from(tx.sapling_value_balance().sapling_amount()).lossy_zec()),
            value_balance_zat: Some(tx.sapling_value_balance().sapling_amount().zatoshis()),
            orchard: Some(orchard_shaped_object(
                tx.orchard_bundle(),
                tx.orchard_value_balance().orchard_amount(),
            )),
            ironwood: tx.ironwood_bundle().map(|bundle| {
                orchard_shaped_object(Some(bundle), tx.ironwood_value_balance().ironwood_amount())
            }),
            binding_sig: tx.sapling_bundle().map(|b| {
                let sig: [u8; 64] = b.authorization().binding_sig.into();
                sig
            }),
            joinsplit_pub_key: tx.sprout_joinsplit_pub_key().map(|raw_key| {
                // Display order is reversed in the RPC output.
                let mut key: [u8; 32] = raw_key.into();
                key.reverse();
                key
            }),
            joinsplit_sig: tx.sprout_bundle().map(|b| b.joinsplit_sig),
            size: tx.zcash_serialized_size().try_into().ok(),
            time: block_time,
            txid,
            in_active_chain,
            auth_digest: tx.auth_digest(),
            overwintered: tx.is_overwintered(),
            version: tx.version(),
            version_group_id: tx.version_group_id().map(|id| id.to_be_bytes().to_vec()),
            lock_time: tx.raw_lock_time(),
            // zcashd includes expiryheight only for Overwinter+ transactions.
            // For those, expiry_height of 0 means "no expiry" per ZIP-203.
            expiry_height: if tx.is_overwintered() {
                Some(tx.expiry_height().unwrap_or(Height(0)))
            } else {
                None
            },
            block_hash,
            block_time,
        }
    }

    /// Fills in each transparent input's `prevout` and the transaction `fee` from the outputs
    /// `tx` spends, for `getblock` verbosity 3.
    ///
    /// `spent_utxos` maps each spent outpoint to the output it spends. Coinbase transactions
    /// spend no outputs and have no fee, so they are left unchanged. A `prevout` object is set
    /// for every input whose spent output is present in `spent_utxos`; the `fee` is only set when
    /// every spent output is present, because the value balance is otherwise incomplete.
    pub fn add_prevouts(
        &mut self,
        tx: &Transaction,
        spent_utxos: &HashMap<OutPoint, Utxo>,
        network: &Network,
    ) {
        if tx.is_coinbase() {
            return;
        }

        // `self.inputs` is built one-to-one from `tx.inputs()`, so pair each rendered input with
        // its own source input and use that input's outpoint. This keeps the alignment correct
        // even if an input carries no outpoint, rather than relying on the filtered
        // `spent_outpoints()` iterator staying in step.
        for (input, source_input) in self.inputs.iter_mut().zip(tx.inputs()) {
            let Input::NonCoinbase { prevout, .. } = input else {
                continue;
            };
            let Some(utxo) = source_input.outpoint().and_then(|o| spent_utxos.get(&o)) else {
                continue;
            };
            *prevout = Some(Box::new(Prevout::new(
                utxo.from_coinbase,
                utxo.height.0,
                Zec::from(utxo.output.value).lossy_zec(),
                ScriptPubKey::from_output(&utxo.output, network),
            )));
        }

        // The fee needs every spent output to complete the value balance.
        if tx
            .spent_outpoints()
            .all(|outpoint| spent_utxos.contains_key(&outpoint))
        {
            if let Ok(value_balance) = tx.value_balance(spent_utxos) {
                if let Ok(fee) = value_balance.remaining_transaction_value() {
                    self.fee = Some(Zec::from(fee).lossy_zec());
                }
            }
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    use zebra_chain::{block::Block, serialization::ZcashDeserializeInto, transparent::Output};

    /// Returns the first non-coinbase, transparent-only transaction in the mainnet block vectors.
    ///
    /// "Transparent-only" means it has transparent inputs and no shielded data, so its fee is just
    /// the difference between the transparent input and output totals.
    fn first_transparent_only_tx() -> Arc<Transaction> {
        zebra_test::vectors::MAINNET_BLOCKS
            .values()
            .flat_map(|bytes| {
                let block: Block = bytes
                    .zcash_deserialize_into()
                    .expect("hard-coded test vector must deserialize");
                block.transactions.clone()
            })
            .find(|tx| {
                !tx.is_coinbase()
                    && !tx.inputs().is_empty()
                    && tx.sapling_spends_count() == 0
                    && tx.sapling_outputs().count() == 0
                    && tx.orchard_actions().count() == 0
                    && tx.ironwood_actions().count() == 0
                    && tx.sprout_joinsplit_descriptions().next().is_none()
            })
            .expect("the mainnet block vectors contain a transparent-only transaction")
    }

    /// `add_prevouts` fills every input's `prevout` and computes the `fee` when all spent outputs
    /// are present.
    #[test]
    fn add_prevouts_fills_prevouts_and_fee() {
        let network = Network::Mainnet;
        let tx = first_transparent_only_tx();

        let output_total = tx
            .outputs()
            .iter()
            .try_fold(Amount::<NonNegative>::zero(), |acc, output| {
                acc + output.value
            })
            .expect("transparent outputs sum within range");

        // Put the whole input value on the first input, so the fee is exactly `FEE`.
        const FEE: i64 = 10_000;
        let first_input_value = (output_total + Amount::<NonNegative>::try_from(FEE).unwrap())
            .expect("input total within range");
        let lock_script = Script::new(&[0x76, 0xa9]);

        let mut spent_utxos = HashMap::new();
        for (i, outpoint) in tx.spent_outpoints().enumerate() {
            let value = if i == 0 {
                first_input_value
            } else {
                Amount::zero()
            };
            spent_utxos.insert(
                outpoint,
                Utxo::new(Output::new(value, lock_script.clone()), Height(123), i == 0),
            );
        }

        let mut object = TransactionObject::from_transaction(
            tx.clone(),
            None,
            None,
            &network,
            None,
            None,
            None,
            tx.hash(),
        );
        object.add_prevouts(&tx, &spent_utxos, &network);

        // Every transparent input has a prevout.
        for input in &object.inputs {
            let Input::NonCoinbase { prevout, .. } = input else {
                panic!("a transparent-only transaction has only non-coinbase inputs");
            };
            assert!(prevout.is_some(), "each input must carry a prevout");
        }

        // The first input's prevout carries the fabricated fields.
        let Input::NonCoinbase { prevout, .. } = &object.inputs[0] else {
            unreachable!("checked above");
        };
        let prevout = prevout.as_ref().expect("prevout is set");
        assert!(prevout.generated());
        assert_eq!(prevout.height(), 123);
        assert_eq!(prevout.value(), Zec::from(first_input_value).lossy_zec());

        // For a transparent-only transaction the fee is inputs minus outputs.
        let expected_fee = Zec::from(Amount::<NonNegative>::try_from(FEE).unwrap()).lossy_zec();
        assert_eq!(object.fee(), Some(expected_fee));
    }

    /// `add_prevouts` leaves a coinbase transaction unchanged: no `fee`, no `prevout`.
    #[test]
    fn add_prevouts_is_noop_for_coinbase() {
        let network = Network::Mainnet;
        let block: Block = zebra_test::vectors::BLOCK_MAINNET_1_BYTES
            .zcash_deserialize_into()
            .expect("hard-coded test vector must deserialize");
        let coinbase = block.transactions[0].clone();
        assert!(coinbase.is_coinbase());

        let mut object = TransactionObject::from_transaction(
            coinbase.clone(),
            None,
            None,
            &network,
            None,
            None,
            None,
            coinbase.hash(),
        );
        object.add_prevouts(&coinbase, &HashMap::new(), &network);

        assert_eq!(object.fee(), None);
        assert!(matches!(object.inputs[0], Input::Coinbase { .. }));
    }

    /// When a spent output is missing, `add_prevouts` sets no `prevout` for it and omits the `fee`,
    /// because the value balance would be incomplete.
    #[test]
    fn add_prevouts_omits_fee_when_a_spent_output_is_missing() {
        let network = Network::Mainnet;
        let tx = first_transparent_only_tx();

        let mut object = TransactionObject::from_transaction(
            tx.clone(),
            None,
            None,
            &network,
            None,
            None,
            None,
            tx.hash(),
        );
        // No spent outputs supplied.
        object.add_prevouts(&tx, &HashMap::new(), &network);

        assert_eq!(object.fee(), None);
        for input in &object.inputs {
            let Input::NonCoinbase { prevout, .. } = input else {
                panic!("a transparent-only transaction has only non-coinbase inputs");
            };
            assert!(
                prevout.is_none(),
                "a missing spent output must leave no prevout"
            );
        }
    }

    /// `vjoinsplit` must be populated for transactions with Sprout JoinSplits.
    ///
    /// The existing `getrawtransaction` snapshots all use blocks that predate Sprout, so an empty
    /// `vjoinsplit` is byte-identical to a correct one there and cannot catch a regression. This
    /// uses mainnet block 419,201, which contains real JoinSplits.
    #[test]
    fn vjoinsplit_is_populated_for_sprout_transactions() {
        let block: Block = zebra_test::vectors::BLOCK_MAINNET_419201_BYTES
            .zcash_deserialize_into()
            .expect("hard-coded test vector must deserialize");

        let tx = block
            .transactions
            .iter()
            .find(|tx| tx.sprout_joinsplit_descriptions().next().is_some())
            .expect("block 419,201 contains a transaction with JoinSplits")
            .clone();

        let expected_count = tx.sprout_joinsplit_descriptions().count();
        assert!(expected_count > 0);

        let object = TransactionObject::from_transaction(
            tx.clone(),
            None,
            None,
            &Network::Mainnet,
            None,
            None,
            None,
            tx.hash(),
        );

        assert_eq!(
            object.joinsplits.len(),
            expected_count,
            "every JoinSplit must appear in vjoinsplit",
        );

        // Field-level check against the parsed transaction, in the RPC's display byte order.
        let joinsplit = tx
            .sprout_joinsplit_descriptions()
            .next()
            .expect("the transaction has JoinSplits");
        let rendered = &object.joinsplits[0];

        let reversed = |bytes: &[u8; 32]| {
            let mut bytes = *bytes;
            bytes.reverse();
            bytes
        };

        assert_eq!(rendered.anchor, reversed(joinsplit.anchor()));
        assert_eq!(rendered.nullifiers[0], reversed(&joinsplit.nullifiers()[0]));
        assert_eq!(
            rendered.commitments[0],
            reversed(&joinsplit.commitments()[0])
        );
        assert_eq!(rendered.random_seed, reversed(joinsplit.random_seed()));
        assert_eq!(rendered.macs[0], reversed(&joinsplit.macs()[0]));
        assert_eq!(
            rendered.old_public_value_zat,
            i64::from(joinsplit.vpub_old())
        );
        assert_eq!(
            rendered.new_public_value_zat,
            i64::from(joinsplit.vpub_new())
        );

        // These two fields have no upstream accessor and are read back out of the wire encoding.
        assert_eq!(rendered.ciphertexts.len(), 2);
        assert!(rendered.ciphertexts.iter().all(|c| c.len() == 601));
        assert_ne!(
            rendered.one_time_pubkey, [0u8; 32],
            "the ephemeral key must be read from the JoinSplit, not left zeroed",
        );

        // V4 JoinSplits carry Groth16 proofs.
        assert_eq!(rendered.proof.len(), 192);
    }

    /// The `proof` field must carry the 296-byte PHGR13 proof for V2/V3 transactions.
    ///
    /// The sibling test above only covers V4 (Groth16) JoinSplits. PHGR13 proofs have no
    /// upstream accessor, so a Groth16-only extraction silently renders them as empty; this
    /// uses testnet block 141,042, whose non-coinbase transactions are V2 with one JoinSplit
    /// each.
    #[test]
    fn vjoinsplit_proof_is_populated_for_phgr13_transactions() {
        const PHGR_PROOF_SIZE: usize = 296;

        let block: Block = zebra_test::vectors::BLOCK_TESTNET_141042_BYTES
            .zcash_deserialize_into()
            .expect("hard-coded test vector must deserialize");

        let tx = block
            .transactions
            .iter()
            .find(|tx| tx.sprout_joinsplit_descriptions().next().is_some())
            .expect("block 141,042 contains transactions with JoinSplits")
            .clone();

        let joinsplit = tx
            .sprout_joinsplit_descriptions()
            .next()
            .expect("the transaction has JoinSplits");

        // The proof variant is what selects the extraction path, so assert on it directly rather
        // than on the transaction version that implies it.
        assert!(
            joinsplit.groth_proof_bytes().is_none(),
            "the fixture must exercise a PHGR13 proof, not a Groth16 one",
        );

        let object = TransactionObject::from_transaction(
            tx.clone(),
            None,
            None,
            &Network::new_default_testnet(),
            None,
            None,
            None,
            tx.hash(),
        );

        assert_eq!(object.joinsplits.len(), 1);
        let rendered = &object.joinsplits[0];

        assert_eq!(
            rendered.proof.len(),
            PHGR_PROOF_SIZE,
            "the PHGR13 proof must be rendered, not replaced with an empty vector",
        );

        // The length alone would hold even if the proof were read from the wrong offset, because
        // the extracted slice is always `PHGR_PROOF_SIZE` bytes wide. Pin the bytes instead: the
        // proof must appear verbatim in the transaction's wire encoding, immediately after
        // `vmacs[1]` and immediately before the first ciphertext.
        let raw = tx
            .zcash_serialize_to_vec()
            .expect("a parsed transaction re-serializes");
        let proof_offset = raw
            .windows(PHGR_PROOF_SIZE)
            .position(|window| window == rendered.proof.as_slice())
            .expect("the rendered proof must appear verbatim in the wire encoding");

        assert_eq!(
            &raw[proof_offset - 32..proof_offset],
            &joinsplit.macs()[1][..],
            "the proof must be read from immediately after `vmacs[1]`",
        );
        assert_eq!(
            &raw[proof_offset + PHGR_PROOF_SIZE..proof_offset + PHGR_PROOF_SIZE + 601],
            rendered.ciphertexts[0].as_slice(),
            "the proof must be read from immediately before the first ciphertext",
        );
    }

    /// The `Default` impl and coinbase path legitimately have no JoinSplits.
    #[test]
    fn vjoinsplit_is_empty_for_coinbase() {
        let block: Block = zebra_test::vectors::BLOCK_MAINNET_419201_BYTES
            .zcash_deserialize_into()
            .expect("hard-coded test vector must deserialize");

        let coinbase = block.transactions[0].clone();
        assert!(coinbase.is_coinbase());

        let object = TransactionObject::from_transaction(
            coinbase.clone(),
            None,
            None,
            &Network::Mainnet,
            None,
            None,
            None,
            coinbase.hash(),
        );

        assert!(object.joinsplits.is_empty());
        assert!(TransactionObject::default().joinsplits.is_empty());
    }
}