fix(solana_test_utils): reject confirmed-but-failed airdrops, redact datasource credentials

[shahan-khatchadourian-anchorage]

Closes #291.

What

SurfpoolManager::airdrop reports a confirmed-but-failed airdrop as success.
get_signature_status returns Result<Option<Result<(), TransactionError>>>,
so a confirmed failure is still a status, and matching Ok(Some(_status))
discards the inner result.

Three commits:

1. Reject confirmed-but-failed airdrops. All four cases are matched
explicitly: only Ok(Some(Ok(()))) returns the signature, a confirmed
TransactionError returns Err naming it, Ok(None) retries, and an
RPC-level error retries while retaining the error for the timeout message.
Both blocking RPC calls run under spawn_blocking behind an Arc<RpcClient> —
the blocking client calls block_in_place internally, which panics on a
current_thread runtime, so the previous direct call made airdrop unusable
from a plain #[tokio::test].

2. Keep datasource credentials out of logs. SurfpoolConfig::default()
builds rpc_url from HELIUS_API_KEY, and two log sites render it: the
config's Debug output and the spawn argument list. redact_url_credentials
reduces a URL to scheme and host, covering credentials in the query string,
the path, and the userinfo. A hand-written Debug for SurfpoolConfig routes
rpc_url through it, so every {:?} is covered rather than one call site.

3. Cover every confirmation outcome offline. airdrop_with takes the
client and retry budget as arguments, so RpcClient::new_mock can drive each
outcome without a validator. Four tests pin all four arms and run in normal CI
in milliseconds.

Verification

• cargo test -p solana_test_utils --lib — 11 passed (4 confirmation arms,
  7 redaction).
• Mutation-checked: reintroducing if let Ok(Some(_status)) fails the two
  confirmed-failure tests and leaves success and timeout passing, so the
  regression cannot return silently.
• cargo test -p solana_test_utils --test airdrop -- --ignored passes against
  a live surfpool mainnet fork.
• cargo clippy -p solana_test_utils --all-targets -- -D warnings and
  cargo fmt --check clean under the pinned 1.88.0 toolchain.

Notes for review

• The credential redaction is a separate concern from the airdrop fix, kept as
  its own commit so it can be read independently. Neither log site currently
  emits anywhere — nothing in these tests installs a tracing subscriber — so
  this is defense-in-depth for whenever one is present, not a live leak.
• tests/airdrop.rs is #[ignore] and no CI job runs it: the only --ignored
  runner is scoped to -p visualsign-solana --test surfpool_fuzz. The four
  offline tests cover the logic; wiring the live test into
  surfpool-solana.yml is left for after test(surfpool): native cargo runner via build.rs + per-IDL macro #285 rewrites that workflow, to avoid
  authoring a conflict.
• The live test compares a balance delta rather than an exact balance:
  Pubkey::new_unique is a counter, not a random source, so the target address
  is identical on every run.
• A follow-up worth considering, out of scope here:
  solana_client::nonblocking::rpc_client::RpcClient would delete the Arc,
  both spawn_blocking hops, and the nested per-client runtime — but
  rpc_client() must keep returning the blocking client for existing callers,
  so adopting it means two client types in one file.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes solana_test_utils Surfpool airdrop confirmation to correctly fail on confirmed TransactionError, prevents datasource credentials from being logged, and adds both offline and live (ignored) coverage for the new behavior.

Changes:

• Refactors SurfpoolManager::airdrop to explicitly handle all get_signature_status outcomes and avoid blocking-client panics by using spawn_blocking.
• Redacts RPC datasource credentials from SurfpoolConfig Debug output and from Surfpool spawn-arg logging.
• Adds offline unit tests for all confirmation outcomes and an ignored live test that validates the end-to-end RPC path.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/solana_test_utils/src/surfpool/manager.rs	Fixes airdrop confirmation semantics; adds retry/error reporting and blocking-client isolation; redacts logged spawn args.
src/solana_test_utils/src/surfpool/config.rs	Introduces redact_url_credentials and a custom Debug impl to prevent leaking datasource credentials; adds unit tests.
src/solana_test_utils/tests/airdrop.rs	Adds an ignored live integration test that validates credited lamports and confirmed-success status against a real surfpool fork.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.