VRF-881: sync with develop

.github/actions/build-sign-publish-chainlink/action.yml

@@ -122,7 +122,7 @@ runs:
 
     - name: Generate docker metadata for root image
       id: meta-root
-      uses: docker/metadata-action@2c0bd771b40637d97bf205cbccdd294a32112176 # v4.5.0
+      uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
       env:
         DOCKER_METADATA_PR_HEAD_SHA: "true"
       with:

.github/actions/delete-deployments/action.yml

@@ -29,7 +29,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@c3b53f6a16e57305370b4ae5a540c2077a1d50dd # v2.2.4
+    - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
       with:
         version: ^8.0.0
 

.github/actions/setup-nodejs/action.yaml

@@ -7,7 +7,7 @@ description: Setup pnpm for contracts
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@c3b53f6a16e57305370b4ae5a540c2077a1d50dd # v2.2.4
+    - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
       with:
         version: ^7.0.0
 

.github/workflows/bash-scripts.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: bash-scripts
         with:
           filters: |

.github/workflows/dependency-check.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           filters: |

.github/workflows/integration-tests.yml

@@ -57,7 +57,7 @@ jobs:
     steps:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           filters: |
@@ -123,9 +123,9 @@ jobs:
           - name: ""
             dockerfile: core/chainlink.Dockerfile
             tag-suffix: ""
-          # - name: (plugins)
-          #   dockerfile: plugins/chainlink.Dockerfile
-          #   tag-suffix: -plugins
+          - name: (plugins)
+            dockerfile: plugins/chainlink.Dockerfile
+            tag-suffix: -plugins
     name: Build Chainlink Image ${{ matrix.image.name }}
     runs-on: ubuntu20.04-16cores-64GB
     needs: [changes, enforce-ctf-version]

.github/workflows/solidity-foundry.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           # Foundry is only used for Solidity v0.8 contracts, therefore we can ignore

.github/workflows/solidity-hardhat.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           filters: |

.github/workflows/solidity.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           list-files: "csv"

contracts/src/v0.8/functions/dev/v1_X/FunctionsBilling.sol

@@ -372,4 +372,9 @@ abstract contract FunctionsBilling is Routable, IFunctionsBilling {
 
   // Overriden in FunctionsCoordinator.sol
   function _onlyOwner() internal view virtual;
+
+  // Used in FunctionsCoordinator.sol
+  function _isExistingRequest(bytes32 requestId) internal view returns (bool) {
+    return s_requestCommitments[requestId] != bytes32(0);
+  }
 }

contracts/src/v0.8/functions/dev/v1_X/FunctionsCoordinator.sol

@@ -125,14 +125,9 @@ contract FunctionsCoordinator is OCR2Base, IFunctionsCoordinator, FunctionsBilli
     return s_transmitters;
   }
 
-  /// @dev Report hook called within OCR2Base.sol
-  function _report(
-    uint256 /*initialGas*/,
-    address /*transmitter*/,
-    uint8 /*signerCount*/,
-    address[MAX_NUM_ORACLES] memory /*signers*/,
+  function _beforeTransmit(
     bytes calldata report
-  ) internal override {
+  ) internal view override returns (bool shouldStop, DecodedReport memory decodedReport) {
     (
       bytes32[] memory requestIds,
       bytes[] memory results,
@@ -152,15 +147,44 @@ contract FunctionsCoordinator is OCR2Base, IFunctionsCoordinator, FunctionsBilli
       revert ReportInvalid("Fields must be equal length");
     }
 
+    for (uint256 i = 0; i < numberOfFulfillments; ++i) {
+      if (_isExistingRequest(requestIds[i])) {
+        // If there is an existing request, validate report
+        // Leave shouldStop to default, false
+        break;
+      }
+      if (i == numberOfFulfillments - 1) {
+        // If the last fulfillment on the report does not exist, then all are duplicates
+        // Indicate that it's safe to stop to save on the gas of validating the report
+        shouldStop = true;
+      }
+    }
+
+    return (
+      shouldStop,
+      DecodedReport({
+        requestIds: requestIds,
+        results: results,
+        errors: errors,
+        onchainMetadata: onchainMetadata,
+        offchainMetadata: offchainMetadata
+      })
+    );
+  }
+
+  /// @dev Report hook called within OCR2Base.sol
+  function _report(DecodedReport memory decodedReport) internal override {
+    uint256 numberOfFulfillments = uint8(decodedReport.requestIds.length);
+
     // Bounded by "MaxRequestBatchSize" on the Job's ReportingPluginConfig
     for (uint256 i = 0; i < numberOfFulfillments; ++i) {
       FunctionsResponse.FulfillResult result = FunctionsResponse.FulfillResult(
         _fulfillAndBill(
-          requestIds[i],
-          results[i],
-          errors[i],
-          onchainMetadata[i],
-          offchainMetadata[i],
+          decodedReport.requestIds[i],
+          decodedReport.results[i],
+          decodedReport.errors[i],
+          decodedReport.onchainMetadata[i],
+          decodedReport.offchainMetadata[i],
           uint8(numberOfFulfillments) // will not exceed "MaxRequestBatchSize" on the Job's ReportingPluginConfig
         )
       );
@@ -172,7 +196,7 @@ contract FunctionsCoordinator is OCR2Base, IFunctionsCoordinator, FunctionsBilli
         result == FunctionsResponse.FulfillResult.FULFILLED ||
         result == FunctionsResponse.FulfillResult.USER_CALLBACK_ERROR
       ) {
-        emit OracleResponse(requestIds[i], msg.sender);
+        emit OracleResponse(decodedReport.requestIds[i], msg.sender);
       }
     }
   }

contracts/src/v0.8/functions/dev/v1_X/accessControl/TermsOfServiceAllowList.sol

@@ -39,8 +39,24 @@ contract TermsOfServiceAllowList is ITermsOfServiceAllowList, IAccessController,
   // |                       Initialization                         |
   // ================================================================
 
-  constructor(TermsOfServiceAllowListConfig memory config) ConfirmedOwner(msg.sender) {
+  constructor(
+    TermsOfServiceAllowListConfig memory config,
+    address[] memory initialAllowedSenders,
+    address[] memory initialBlockedSenders
+  ) ConfirmedOwner(msg.sender) {
     updateConfig(config);
+
+    for (uint256 i = 0; i < initialAllowedSenders.length; ++i) {
+      s_allowedSenders.add(initialAllowedSenders[i]);
+    }
+
+    for (uint256 j = 0; j < initialBlockedSenders.length; ++j) {
+      if (s_allowedSenders.contains(initialBlockedSenders[j])) {
+        // Allowed senders cannot also be blocked
+        revert InvalidCalldata();
+      }
+      s_blockedSenders.add(initialBlockedSenders[j]);
+    }
   }
 
   // ================================================================

contracts/src/v0.8/functions/dev/v1_X/ocr/OCR2Base.sol

@@ -59,6 +59,14 @@ abstract contract OCR2Base is ConfirmedOwner, OCR2Abstract {
   // i.e. the address the oracle actually sends transactions to the contract from
   address[] internal s_transmitters;
 
+  struct DecodedReport {
+    bytes32[] requestIds;
+    bytes[] results;
+    bytes[] errors;
+    bytes[] onchainMetadata;
+    bytes[] offchainMetadata;
+  }
+
   /*
    * Config logic
    */
@@ -238,18 +246,9 @@ abstract contract OCR2Base is ConfirmedOwner, OCR2Abstract {
   /**
    * @dev hook called after the report has been fully validated
    * for the extending contract to handle additional logic, such as oracle payment
-   * @param initialGas the amount of gas before validation
-   * @param transmitter the address of the account that submitted the report
-   * @param signers the addresses of all signing accounts
-   * @param report serialized report
+   * @param decodedReport decodedReport
    */
-  function _report(
-    uint256 initialGas,
-    address transmitter,
-    uint8 signerCount,
-    address[MAX_NUM_ORACLES] memory signers,
-    bytes calldata report
-  ) internal virtual;
+  function _report(DecodedReport memory decodedReport) internal virtual;
 
   // The constant-length components of the msg.data sent to transmit.
   // See the "If we wanted to call sam" example on for example reasoning
@@ -283,6 +282,10 @@ abstract contract OCR2Base is ConfirmedOwner, OCR2Abstract {
     if (msg.data.length != expected) revert ReportInvalid("calldata length mismatch");
   }
 
+  function _beforeTransmit(
+    bytes calldata report
+  ) internal virtual returns (bool shouldStop, DecodedReport memory decodedReport);
+
   /**
    * @notice transmit is called to post a new report to the contract
    * @param report serialized report, which the signatures are signing.
@@ -299,7 +302,11 @@ abstract contract OCR2Base is ConfirmedOwner, OCR2Abstract {
     bytes32[] calldata ss,
     bytes32 rawVs // signatures
   ) external override {
-    uint256 initialGas = gasleft(); // This line must come first
+    (bool shouldStop, DecodedReport memory decodedReport) = _beforeTransmit(report);
+
+    if (shouldStop) {
+      return;
+    }
 
     {
       // reportContext consists of:
@@ -328,7 +335,6 @@ abstract contract OCR2Base is ConfirmedOwner, OCR2Abstract {
     }
 
     address[MAX_NUM_ORACLES] memory signed;
-    uint8 signerCount = 0;
 
     {
       // Verify signatures attached to report
@@ -342,10 +348,9 @@ abstract contract OCR2Base is ConfirmedOwner, OCR2Abstract {
         if (o.role != Role.Signer) revert ReportInvalid("address not authorized to sign");
         if (signed[o.index] != address(0)) revert ReportInvalid("non-unique signature");
         signed[o.index] = signer;
-        signerCount += 1;
       }
     }
 
-    _report(initialGas, msg.sender, signerCount, signed, report);
+    _report(decodedReport);
   }
 }

contracts/src/v0.8/functions/tests/v1_X/FunctionsSubscriptions.t.sol

@@ -346,7 +346,7 @@ contract FunctionsSubscriptions_OnTokenTransfer is FunctionsClientSetup {
     s_linkToken.transferAndCall(address(s_functionsRouter), totalSupplyJuels, abi.encode(invalidSubscriptionId));
   }
 
-  function test_OnTokenTransfer_Success(uint96 fundingAmount) public {
+  function test_OnTokenTransfer_Success() public {
     // Funding amount must be less than LINK total supply
     uint256 totalSupplyJuels = 1_000_000_000 * 1e18;
     // Some of the total supply is already in the subscription account