Reject --hd-path overrides on Ledger aliases.

fnando · fnando · commit 2b9effe8c7ff · 2026-05-07T13:33:50.000-07:00
diff --git a/cmd/soroban-cli/src/commands/keys/add.rs b/cmd/soroban-cli/src/commands/keys/add.rs
@@ -45,9 +45,6 @@ pub enum Error {
 
     #[error("--hd-path is not valid with a secret key; secret keys cannot be derived")]
     HdPathNotSupportedForSecretKey,
-
-    #[error("--hd-path {0} is out of range for a Ledger account index")]
-    HdPathOutOfRange(usize),
 }
 
 #[derive(Debug, clap::Parser, Clone)]
@@ -94,7 +91,7 @@ pub struct Cmd {
     /// without re-passing the flag. Not valid with `--public-key` or a raw
     /// secret key.
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 }
 
 impl Cmd {
@@ -125,9 +122,10 @@ impl Cmd {
     }
 
     async fn derive_ledger_secret(&self) -> Result<Secret, Error> {
-        let raw = self.hd_path.unwrap_or(0);
-        let index: u32 = raw.try_into().map_err(|_| Error::HdPathOutOfRange(raw))?;
-        let public_key = ledger::new(index).await?.public_key().await?;
+        let public_key = ledger::new(self.hd_path.unwrap_or_default())
+            .await?
+            .public_key()
+            .await?;
         Ok(Secret::Ledger {
             hardware: HardwareKind::Ledger,
             public_key: public_key.to_string(),
@@ -181,7 +179,7 @@ impl Cmd {
     }
 }
 
-fn build_secret(input: &str, hd_path: Option<usize>) -> Result<Secret, Error> {
+fn build_secret(input: &str, hd_path: Option<u32>) -> Result<Secret, Error> {
     let secret: Secret = input.parse()?;
     match (secret, hd_path) {
         (Secret::SecretKey { .. }, Some(_)) => Err(Error::HdPathNotSupportedForSecretKey),
@@ -248,7 +246,7 @@ mod tests {
 
     fn cmd_with_public_key(
         public_key: &str,
-        hd_path: Option<usize>,
+        hd_path: Option<u32>,
     ) -> (tempfile::TempDir, locator::Args, Cmd) {
         let (temp_dir, locator, mut cmd) = set_up_test();
         cmd.public_key = Some(public_key.to_string());
diff --git a/cmd/soroban-cli/src/commands/keys/generate.rs b/cmd/soroban-cli/src/commands/keys/generate.rs
@@ -55,7 +55,7 @@ pub struct Cmd {
     /// `--secure-store` or plain seed-phrase storage it is persisted on the identity
     /// so later commands derive the same account without re-passing the flag.
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 
     #[command(flatten)]
     pub network: network::Args,
diff --git a/cmd/soroban-cli/src/commands/keys/public_key.rs b/cmd/soroban-cli/src/commands/keys/public_key.rs
@@ -11,9 +11,6 @@ pub enum Error {
 
     #[error(transparent)]
     Ledger(#[from] ledger::Error),
-
-    #[error("--hd-path {0} is out of range for a Ledger account index")]
-    HdPathOutOfRange(usize),
 }
 
 #[derive(Debug, clap::Parser, Clone)]
@@ -26,7 +23,7 @@ pub struct Cmd {
     /// If identity is a seed phrase use this hd path, default is 0.
     /// With --ledger this is the Ledger account index (default 0).
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 
     /// Derive the address from a connected Ledger hardware wallet at
     /// `m/44'/148'/N'`, where `N` defaults to 0 and can be set with
@@ -46,9 +43,10 @@ impl Cmd {
 
     pub async fn public_key(&self) -> Result<stellar_strkey::ed25519::PublicKey, Error> {
         if self.ledger {
-            let raw = self.hd_path.unwrap_or(0);
-            let index: u32 = raw.try_into().map_err(|_| Error::HdPathOutOfRange(raw))?;
-            return Ok(ledger::new(index).await?.public_key().await?);
+            return Ok(ledger::new(self.hd_path.unwrap_or_default())
+                .await?
+                .public_key()
+                .await?);
         }
         let name = self
             .name
diff --git a/cmd/soroban-cli/src/commands/keys/secret.rs b/cmd/soroban-cli/src/commands/keys/secret.rs
@@ -29,7 +29,7 @@ pub struct Cmd {
 
     /// If identity is a seed phrase use this hd path, default is 0
     #[arg(long, conflicts_with = "phrase")]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 
     #[command(flatten)]
     pub locator: locator::Args,
diff --git a/cmd/soroban-cli/src/commands/ledger/entry/fetch/account.rs b/cmd/soroban-cli/src/commands/ledger/entry/fetch/account.rs
@@ -20,7 +20,7 @@ pub struct Cmd {
 
     /// If identity is a seed phrase use this hd path, default is 0
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 }
 
 #[derive(thiserror::Error, Debug)]
diff --git a/cmd/soroban-cli/src/commands/ledger/entry/fetch/account_data.rs b/cmd/soroban-cli/src/commands/ledger/entry/fetch/account_data.rs
@@ -24,7 +24,7 @@ pub struct Cmd {
 
     /// If identity is a seed phrase use this hd path, default is 0
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 }
 
 #[derive(thiserror::Error, Debug)]
diff --git a/cmd/soroban-cli/src/commands/ledger/entry/fetch/offer.rs b/cmd/soroban-cli/src/commands/ledger/entry/fetch/offer.rs
@@ -24,7 +24,7 @@ pub struct Cmd {
 
     /// If identity is a seed phrase use this hd path, default is 0
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 }
 
 #[derive(thiserror::Error, Debug)]
diff --git a/cmd/soroban-cli/src/commands/ledger/entry/fetch/trustline.rs b/cmd/soroban-cli/src/commands/ledger/entry/fetch/trustline.rs
@@ -27,7 +27,7 @@ pub struct Cmd {
 
     /// If account is a seed phrase use this hd path, default is 0
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 }
 
 #[derive(thiserror::Error, Debug)]
diff --git a/cmd/soroban-cli/src/commands/message/sign.rs b/cmd/soroban-cli/src/commands/message/sign.rs
@@ -62,7 +62,7 @@ pub struct Cmd {
 
     #[arg(long)]
     /// If using a seed phrase to sign, sets which hierarchical deterministic path to use, e.g. `m/44'/148'/{hd_path}`. Example: `--hd-path 1`. Default: `0`
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 
     #[command(flatten)]
     pub locator: locator::Args,
diff --git a/cmd/soroban-cli/src/commands/message/verify.rs b/cmd/soroban-cli/src/commands/message/verify.rs
@@ -68,7 +68,7 @@ pub struct Cmd {
 
     /// If public key identity is a seed phrase use this hd path, default is 0
     #[arg(long)]
-    pub hd_path: Option<usize>,
+    pub hd_path: Option<u32>,
 
     #[command(flatten)]
     pub locator: locator::Args,
diff --git a/cmd/soroban-cli/src/config/address.rs b/cmd/soroban-cli/src/config/address.rs
@@ -66,7 +66,7 @@ impl UnresolvedMuxedAccount {
     pub fn resolve_muxed_account(
         &self,
         locator: &locator::Args,
-        hd_path: Option<usize>,
+        hd_path: Option<u32>,
     ) -> Result<xdr::MuxedAccount, Error> {
         match self {
             UnresolvedMuxedAccount::Resolved(muxed_account) => Ok(muxed_account.clone()),
diff --git a/cmd/soroban-cli/src/config/key.rs b/cmd/soroban-cli/src/config/key.rs
@@ -30,7 +30,7 @@ pub enum Key {
 }
 
 impl Key {
-    pub fn muxed_account(&self, hd_path: Option<usize>) -> Result<xdr::MuxedAccount, Error> {
+    pub fn muxed_account(&self, hd_path: Option<u32>) -> Result<xdr::MuxedAccount, Error> {
         let bytes = match self {
             Key::Secret(secret) => secret.public_key(hd_path)?.0,
             Key::PublicKey(Public(key)) => key.0,
@@ -49,7 +49,7 @@ impl Key {
 
     pub fn private_key(
         &self,
-        hd_path: Option<usize>,
+        hd_path: Option<u32>,
     ) -> Result<stellar_strkey::ed25519::PrivateKey, Error> {
         match self {
             Key::Secret(secret) => Ok(secret.private_key(hd_path)?),
diff --git a/cmd/soroban-cli/src/config/locator.rs b/cmd/soroban-cli/src/config/locator.rs
@@ -313,7 +313,7 @@ impl Args {
     pub fn read_key_with_secure_store_cache(
         &self,
         key_or_name: &str,
-        hd_path: Option<usize>,
+        hd_path: Option<u32>,
     ) -> Result<Key, Error> {
         if let Ok(literal) = key_or_name.parse::<Key>() {
             return Ok(literal);
@@ -362,7 +362,7 @@ impl Args {
     pub fn get_secret_key_with_hd_path(
         &self,
         key_or_name: &str,
-        hd_path: Option<usize>,
+        hd_path: Option<u32>,
     ) -> Result<Secret, Error> {
         let key = self
             .read_key_with_secure_store_cache(key_or_name, hd_path)
@@ -379,7 +379,7 @@ impl Args {
     pub fn get_public_key(
         &self,
         key_or_name: &str,
-        hd_path: Option<usize>,
+        hd_path: Option<u32>,
     ) -> Result<xdr::MuxedAccount, Error> {
         Ok(self.read_key(key_or_name)?.muxed_account(hd_path)?)
     }
diff --git a/cmd/soroban-cli/src/config/mod.rs b/cmd/soroban-cli/src/config/mod.rs
@@ -186,7 +186,7 @@ impl Args {
         .into())
     }
 
-    pub fn hd_path(&self) -> Option<usize> {
+    pub fn hd_path(&self) -> Option<u32> {
         self.sign_with.hd_path
     }
 }
diff --git a/cmd/soroban-cli/src/config/sc_address.rs b/cmd/soroban-cli/src/config/sc_address.rs
@@ -44,7 +44,7 @@ impl UnresolvedScAddress {
         self,
         locator: &locator::Args,
         network_passphrase: &str,
-        hd_path: Option<usize>,
+        hd_path: Option<u32>,
     ) -> Result<xdr::ScAddress, Error> {
         let alias = match self {
             UnresolvedScAddress::Resolved(addr) => return Ok(addr),
diff --git a/cmd/soroban-cli/src/config/secret.rs b/cmd/soroban-cli/src/config/secret.rs
diff --git a/cmd/soroban-cli/src/config/sign_with.rs b/cmd/soroban-cli/src/config/sign_with.rs
diff --git a/cmd/soroban-cli/src/signer/keyring.rs b/cmd/soroban-cli/src/signer/keyring.rs
diff --git a/cmd/soroban-cli/src/signer/mod.rs b/cmd/soroban-cli/src/signer/mod.rs
diff --git a/cmd/soroban-cli/src/signer/secure_store.rs b/cmd/soroban-cli/src/signer/secure_store.rs

Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,7 @@ pub struct Cmd {`
`20`	`20`
`21`	`21`	`/// If identity is a seed phrase use this hd path, default is 0`
`22`	`22`	`#[arg(long)]`
`23`		`- pub hd_path: Option<usize>,`
	`23`	`+ pub hd_path: Option<u32>,`
`24`	`24`	`}`
`25`	`25`
`26`	`26`	`#[derive(thiserror::Error, Debug)]`
Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@ pub struct Cmd {`
`24`	`24`
`25`	`25`	`/// If identity is a seed phrase use this hd path, default is 0`
`26`	`26`	`#[arg(long)]`
`27`		`- pub hd_path: Option<usize>,`
	`27`	`+ pub hd_path: Option<u32>,`
`28`	`28`	`}`
`29`	`29`
`30`	`30`	`#[derive(thiserror::Error, Debug)]`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ pub struct Cmd {`
`27`	`27`
`28`	`28`	`/// If account is a seed phrase use this hd path, default is 0`
`29`	`29`	`#[arg(long)]`
`30`		`- pub hd_path: Option<usize>,`
	`30`	`+ pub hd_path: Option<u32>,`
`31`	`31`	`}`
`32`	`32`
`33`	`33`	`#[derive(thiserror::Error, Debug)]`