feat: add Context Groups on-chain support (storage, CRUD, membership, proxy governance)

[rtb-12]

Summary

Implements the Context Groups feature across the context-config and context-proxy NEAR contracts. Context Groups introduce a hierarchical relationship between contexts, enabling:

• Workspace-level grouping of related contexts (e.g., DMs, channels)
• Single-trigger version propagation (upgrade once, all contexts converge)
• Workspace-level user management with on-chain audit trail

Changes done

• Added OnChainGroupMeta and extended ContextConfigs with groups and context_group_refs; added Context.group_id, new Prefix variants (9–11), and 03_context_groups migration with feature gate.
• Added handle_group_request() with create_group(), delete_group(), add_group_members(), remove_group_members().
• Added query methods group() and is_group_admin().
• Added register_context_in_group() and unregister_context_from_group() mutations.
• Added group_contexts() (paginated scan) and context_group() (O(1) reverse lookup) queries.
• Added set_group_target() for admin-controlled application version updates with audit logging.
• Added proxy_register_in_group() and proxy_unregister_from_group() on context-config (callable only by the context’s proxy).
• Handled ProposalAction::RegisterInGroup and ProposalAction::UnregisterFromGroup in proxy’s execute_proposal() via cross-contract calls to context-config.
• Extended proxy’s ext interface with proxy_register_in_group and proxy_unregister_from_group.
• Added 03_context_groups migration and migration roundtrip tests.
• Added integration tests for group operations in context-config/tests/groups.rs.
• Updated workspace calimero-context-config dependency and Cargo.lock.

Dependency on core repo

This PR depends on the shared types crate changes in the core repo (feat/context-management-proposal branch) which adds ContextGroupId, AppKey, GroupRequest, GroupRequestKind, RequestKind::Group, ProposalAction::RegisterInGroup, and ProposalAction::UnregisterFromGroup.

Before merging: Once the core PR is merged and a new version is released, update the calimero-context-config tag in Cargo.toml (currently 0.10.0-rc.1) to the new release tag containing the context groups types.

Test plan

• Build both contracts: cd contracts/near/context-config && ./build.sh && cd ../context-proxy && ./build.sh
• Run context-config tests: cargo test --package calimero-context-config-near
• Run context-proxy tests: cargo test --package calimero-context-proxy-near
• Verify migration compiles: cargo check --features "migrations,03_context_groups"
• Verify 100% backward compatibility — existing context operations unchanged
• Update calimero-context-config tag in Cargo.toml to new core release version after core PR merges

---

Note

High Risk
High risk because it introduces new on-chain state (groups, permissions, allowlists, invitation commitments) and new authorization paths/cross-contract calls, plus multiple storage migrations that must preserve existing contract state.

Overview
Adds on-chain Context Groups to the context-config NEAR contract, introducing new persistent group state (groups, context_group_refs, Context.group_id) and a new RequestKind::Group mutation flow for group CRUD, membership management, context registration, and target-application updates (including stored migration_method).

Implements group-level permissions and visibility controls (capability bitfields, per-context Open/Restricted visibility with allowlists) and a commit/reveal group invitation mechanism with signature verification, replay protection, and nonce handling; also emits a structured NEP-297 event when an admin force-joins a restricted context.

Extends proxy governance: context-proxy proposals can now RegisterInGroup/UnregisterFromGroup via new cross-contract calls, and context-config adds corresponding proxy-only entrypoints; adds storage wipe support for groups, plus new feature-gated migrations (03–06) and substantial integration/migration test coverage.

^{Written by Cursor Bugbot for commit 370394b. This will update automatically on new commits. Configure here.}

[cursor]

Local filesystem path patch committed in Cargo.toml

High Severity

The [patch] section overrides calimero-context-config with a local filesystem path (../core/crates/context/config). This breaks builds for anyone who doesn't have the core repo checked out at that exact relative path, including CI pipelines. The corresponding Cargo.lock also lost its git source line, confirming the override is active.

 

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Erase function doesn't clear all group storage collections
  • Added clearing of member_contexts, member_capabilities, context_visibility, and context_allowlists collections to match delete_group behavior.
• ✅ Fixed: Removed member privileges not revoked from used_open_invitations guard
  • Added privilege revocation from used_open_invitations guard during cascade removal of group members.

Or push these changes by commenting:

@cursor push a78ec72d3b

Preview (a78ec72d3b)

diff --git a/contracts/near/context-config/src/mutate.rs b/contracts/near/context-config/src/mutate.rs
--- a/contracts/near/context-config/src/mutate.rs
+++ b/contracts/near/context-config/src/mutate.rs
@@ -578,9 +578,7 @@
             } => {
                 self.set_default_capabilities(signer_id, group_id, default_capabilities);
             }
-            GroupRequestKind::SetDefaultVisibility {
-                default_visibility,
-            } => {
+            GroupRequestKind::SetDefaultVisibility { default_visibility } => {
                 self.set_default_visibility(signer_id, group_id, default_visibility.into());
             }
         }
@@ -611,12 +609,9 @@
         let used_invitations = IterableSet::new(Prefix::GroupUsedInvitations(*group_id));
         let member_contexts = IterableMap::new(Prefix::GroupMemberContexts(*group_id));
 
-        let member_capabilities =
-            IterableMap::new(Prefix::GroupMemberCapabilities(*group_id));
-        let context_visibility =
-            IterableMap::new(Prefix::GroupContextVisibility(*group_id));
-        let context_allowlists =
-            IterableMap::new(Prefix::GroupContextAllowlists(*group_id));
+        let member_capabilities = IterableMap::new(Prefix::GroupMemberCapabilities(*group_id));
+        let context_visibility = IterableMap::new(Prefix::GroupContextVisibility(*group_id));
+        let context_allowlists = IterableMap::new(Prefix::GroupContextAllowlists(*group_id));
 
         let meta = OnChainGroupMeta {
             app_key,
@@ -755,6 +750,10 @@
             let identity = context_identity.rt().expect("infallible conversion");
             context.members.priviledges().revoke(&identity);
             context.application.priviledges().revoke(&identity);
+            context
+                .used_open_invitations
+                .priviledges()
+                .revoke(&identity);
 
             env::log_str(&format!(
                 "Cascade-removed `{}` from context `{}`",
@@ -784,10 +783,7 @@
                 .map_or(false, |caps| {
                     caps & MemberCapabilities::CAN_CREATE_CONTEXT != 0
                 });
-        require!(
-            can_create,
-            "insufficient capabilities to create context"
-        );
+        require!(can_create, "insufficient capabilities to create context");
 
         let mode = visibility_mode.unwrap_or(group.default_context_visibility);
 
@@ -974,10 +970,7 @@
                     let on_allowlist = group
                         .context_allowlists
                         .contains_key(&(*context_id, signer_id.clone()));
-                    require!(
-                        on_allowlist,
-                        "not on allowlist for this restricted context"
-                    );
+                    require!(on_allowlist, "not on allowlist for this restricted context");
                 } else {
                     // Open context: requires CAN_JOIN_OPEN_CONTEXTS
                     let can_join = group
@@ -986,10 +979,7 @@
                         .map_or(false, |caps| {
                             caps & MemberCapabilities::CAN_JOIN_OPEN_CONTEXTS != 0
                         });
-                    require!(
-                        can_join,
-                        "insufficient capabilities to join open context"
-                    );
+                    require!(can_join, "insufficient capabilities to join open context");
                 }
             } else if is_restricted {
                 // Admin force-joining a restricted context they're not on the allowlist for
@@ -1059,10 +1049,7 @@
             "only group admins can set member capabilities"
         );
 
-        require!(
-            group.members.contains(&member),
-            "member not in group"
-        );
+        require!(group.members.contains(&member), "member not in group");
 
         let _ignored = group.member_capabilities.insert(*member, capabilities);
 
@@ -1142,20 +1129,19 @@
         );
 
         for member in &add {
-            let _ignored = group
-                .context_allowlists
-                .insert((*context_id, **member), ());
+            let _ignored = group.context_allowlists.insert((*context_id, **member), ());
         }
 
         for member in &remove {
-            let _ignored = group
-                .context_allowlists
-                .remove(&(*context_id, **member));
+            let _ignored = group.context_allowlists.remove(&(*context_id, **member));
         }
 
         env::log_str(&format!(
             "Updated allowlist for context `{}` in group `{}`: added {}, removed {}",
-            context_id, group_id, add.len(), remove.len()
+            context_id,
+            group_id,
+            add.len(),
+            remove.len()
         ));
     }
 

diff --git a/contracts/near/context-config/src/sys.rs b/contracts/near/context-config/src/sys.rs
--- a/contracts/near/context-config/src/sys.rs
+++ b/contracts/near/context-config/src/sys.rs
@@ -57,6 +57,10 @@
             group.context_ids.clear();
             group.invitation_commitments.clear();
             group.used_invitations.clear();
+            group.member_contexts.clear();
+            group.member_capabilities.clear();
+            group.context_visibility.clear();
+            group.context_allowlists.clear();
         }
         self.context_group_refs.clear();

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Repeated group join overwrites tracked context identity

Medium Severity

In join_context_via_group, the member_contexts map uses (SignerId, ContextId) as the key. If the same signer joins the same context multiple times with different ContextIdentity values, insert silently overwrites the previous entry. When remove_group_members later cascade-removes members, it only finds the last recorded identity — earlier identities become orphaned context members that can never be cascade-removed.

 

[cursor]

Test expects wrong error message for register rejection

Low Severity

test_non_admin_register_rejected asserts the error contains "only group admins can register contexts", but register_context_in_group produces "insufficient capabilities to create context" when a non-member signer lacks the CAN_CREATE_CONTEXT capability. The assertion string never matches, so this test would always fail.