chore: reject compress for mints with restricted extensions in build_mint_extension_cache

[ananas-block]

Summary by CodeRabbit

• Bug Fixes
  • Improved validation for token compression: tokens from mints with restricted extensions are now blocked from standard compression operations while still allowing compress-and-close, preventing unintended compressions and returning appropriate errors.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a validation branch that returns an error when a mint has restricted extensions and a regular Compress is attempted; preserves CompressAndClose behavior and updates comments to document behavior for CompressAndClose, Compress, and Decompress.

Changes

Cohort / File(s)	Summary
Mint Extension Validation programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs	Introduce a branch that errors on regular Compress when has_restricted_extensions && !compress_and_close; retain existing CompressAndClose (CompressedOnly) path and update comments to clarify behavior across compression modes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• chore: increase mint cache robustness #2237: Adds/unwraps has_restricted_extensions and mint checks that this validation relies on.
• fix: compressed and close mint check #2094: Tightens CompressAndClose/compressible validation; closely related to compression-path adjustments here.

Suggested reviewers

• SwenSchaeferjohann
• sergeytimoshin

Poem

🔐 A mint stood firm with guarded ends,
Compress denied where rule extends;
CompressAndClose still finds its way,
Rules kept tidy, night and day —
Small code guard, big tidy bends ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: rejecting compress operations for mints with restricted extensions in the build_mint_extension_cache function.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 70.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch jorrit/chore-increase-mint-checks-robustness

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs (1)

109-117: 🛠️ Refactor suggestion | 🟠 Major

Pre-existing: decompress with outputs also skips bypass in the caching branch.

This is the same class of issue as the new line 140 branch, but in the caching logic. When decompress mode runs with no_compressed_outputs = false, it falls through to check_mint_extensions(mint_account, deny_restricted_extensions=true) on line 114 — which, per the doc comment strategy, shouldn't enforce restrictions for decompress.

This predates your PR, but since you're tightening the logic here, it's worth aligning both branches with the documented strategy. If decompress should always bypass, this condition should also account for it:

-                let checks = if compression.mode.is_compress_and_close() || no_compressed_outputs {
+                let checks = if compression.mode.is_compress_and_close() || compression.mode.is_decompress() || no_compressed_outputs {

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In
`@programs/compressed-token/program/src/compressed_token/transfer2/check_extensions.rs`:
- Around line 140-146: The condition that blocks compressing restricted-mint
extensions is using a negated is_compress_and_close check, which is ambiguous;
update the else-if to explicitly test for compression by replacing the
`!compression.mode.is_compress_and_close()` predicate with
`compression.mode.is_compress()` so the branch only fires for compress intent
(keep the surrounding guards on checks.has_restricted_extensions and
deny_restricted_extensions and still return
ErrorCode::MintHasRestrictedExtensions when met).