Fix RWT check on permit box creating new events

Previously, while creating reports using permits, the RWT can be mixed
with arbitrary input token and be stored in other token places rather
than the first place. Now we check the RWT to be stored in the first
token place of both permit and commitment. Additionally, we check that
all input RWT tokens exist in permit and commitment box output boxes.

src/main/scala/rosen/bridge/scripts/Permit.es

@@ -35,9 +35,16 @@
   }else{
     // Event Commitment Creation
     // [Permit(s), WID] => [Permit, Commitment, WID]
+    val totalPermits = INPUTS.filter{(box:Box)
+       => box.tokens(0)._1 == SELF.tokens(0)._1
+       }
+       .map{(box:Box) => box.tokens(0)._2}
+       .fold(0L, { (a: Long, b: Long) => a + b })
     sigmaProp(
       allOf(
         Coll(
+          OUTPUTS(0).tokens(0)._1 == SELF.tokens(0)._1,
+          OUTPUTS(1).tokens(0)._2 == totalPermits - OUTPUTS(0).tokens(0)._2,
           OUTPUTS(1).tokens(0)._1 == SELF.tokens(0)._1,
           blake2b256(OUTPUTS(1).propositionBytes) == commitmentScriptHash,
           OUTPUTS(1).R5[Coll[Coll[Byte]]].isDefined,

src/test/scala/contracts/ContractTest.scala

@@ -382,6 +382,28 @@ class ContractTest extends TestSuite {
     })
   }
 
+  property("test create new commitment with RWT second place of permit tokens") {
+    networkConfig._1.ergoClient.execute(ctx => {
+      assertThrows[AnyRef] {
+        val commitment = new Commitment()
+        val prover = getProver()
+        val WID = Base16.decode(Boxes.getRandomHexString()).get
+        val box1 = Boxes.createBoxForUser(ctx, prover.getAddress, 1e9.toLong, new ErgoToken(WID, 1), new ErgoToken(networkConfig._3.RSN, 9))
+        val permit = Boxes.createPermitBox(ctx, 10L, WID).convertToInputWith(Boxes.getRandomHexString(), 0)
+        val permitOut = Boxes.createInvalidMixedPermitBox(ctx, 9L, WID)
+        val commitmentBox = Boxes.createCommitment(ctx, WID, commitment.requestId(), commitment.hash(WID), 1l)
+        val WIDOut = Boxes.createBoxCandidateForUser(ctx, prover.getAddress, 1e8.toLong, new ErgoToken(WID, 1))
+        val tx = ctx.newTxBuilder().addInputs(permit, box1)
+          .fee(Configs.fee)
+          .sendChangeTo(prover.getAddress)
+          .addOutputs(permitOut, commitmentBox, WIDOut)
+          .build()
+        val signedTx = prover.sign(tx)
+        println(signedTx.toJson(false))
+      }
+    })
+  }
+
   property("test create new commitment with more than one RWT") {
     networkConfig._1.ergoClient.execute(ctx => {
       try {

src/test/scala/testUtils/Boxes.scala

@@ -215,6 +215,23 @@ object Boxes {
       .build()
   }
 
+  def createInvalidMixedPermitBox(ctx: BlockchainContext, RWTCount: Long, WID: Array[Byte], tokens: ErgoToken*): OutBox = {
+    val txB = ctx.newTxBuilder()
+    val tokensSeq = Seq(
+      new ErgoToken(networkConfig._3.RSN, RWTCount),
+      new ErgoToken(networkConfig._2.tokens.RWTId, RWTCount),
+    ) ++ tokens.toSeq
+    txB.outBoxBuilder()
+      .value(Configs.minBoxValue)
+      .contract(contracts.WatcherPermit._1)
+      .tokens(tokensSeq: _*)
+      .registers(
+        ErgoValueBuilder.buildFor(Colls.fromArray(Seq(WID).map(item => Colls.fromArray(item)).toArray)),
+        // this value must exists in case of redeem commitment.
+        ErgoValueBuilder.buildFor(Colls.fromArray(Seq(Array(0.toByte)).map(item => Colls.fromArray(item)).toArray)),
+      )
+      .build()
+  }
   def createInvalidPermitBox(ctx: BlockchainContext, RWTCount: Long, WID: Array[Byte], tokens: ErgoToken*): OutBox = {
     val txB = ctx.newTxBuilder()
     val tokensSeq = Seq(new ErgoToken(networkConfig._3.RSN, RWTCount)) ++ tokens.toSeq