Allow block.timestamp, self.program_owner, and Snark::verify in views (#29579)

These read-only ops resolve in snarkVM's view (finalize-register) path, but the
type checker rejected them by classifying them as FinalizeWrite. Reclassify them
as FinalizeRead so views accept them, matching snarkVM.

Co-authored-by: IGI-111 <igi-111@protonmail.com>

Author: mohammadfawaz

crates/compiler/src/run.rs

@@ -416,13 +416,14 @@ fn handle_view(
     };
     // For an empty in-memory consensus store there is no block 0, so route directly through
     // `evaluate_view_with_stack_at_height` with a fabricated `FinalizeGlobalState`. Tests are off-consensus
-    // by construction, so the values here only matter for queries that read `block.height` / `network.id`.
-    // `VM::evaluate_view_at_height` cannot be used here: it resolves the program edition from on-chain
-    // deployments, which an empty store does not have.
+    // by construction, so the values here only matter for queries that read `block.height` / `block.timestamp`
+    // / `network.id`; the timestamp is fixed so those reads are deterministic. `VM::evaluate_view_at_height`
+    // cannot be used here: it resolves the program edition from on-chain deployments, which an empty store
+    // does not have.
     let state = match snarkvm::synthesizer::program::FinalizeGlobalState::new::<CurrentNetwork>(
         0,
         0,
-        None,
+        Some(1234567890i64),
         0,
         0,
         Default::default(),
@@ -431,11 +432,23 @@ fn handle_view(
         Ok(s) => s,
         Err(e) => return failed(format!("Failed to build FinalizeGlobalState: {e}")),
     };
-    // Evaluate against the live (latest) stack; off-consensus tests have a single edition.
-    let stack = match vm.process().get_stack(program_id) {
+    // Off-consensus tests deploy nothing, so the registered stack carries no program owner. Rebuild the
+    // stack (the only way to a mutable handle — `get_stack` hands out a shared `Arc`) and set the owner to
+    // the test key's address, mirroring a real deployment, so views can read `self.program_owner`.
+    let registered = match vm.process().get_stack(program_id) {
         Ok(stack) => stack,
         Err(e) => return failed(format!("Failed to load stack for `{program_id}`: {e}")),
     };
+    let mut stack = match snarkvm::synthesizer::process::Stack::new(vm.process(), registered.program()) {
+        Ok(stack) => stack,
+        Err(e) => return failed(format!("Failed to build stack for `{program_id}`: {e}")),
+    };
+    match PrivateKey::<CurrentNetwork>::from_str(leo_ast::TEST_PRIVATE_KEY)
+        .and_then(|pk| Address::<CurrentNetwork>::try_from(&pk))
+    {
+        Ok(owner) => stack.set_program_owner(Some(owner)),
+        Err(e) => return failed(format!("Failed to derive program owner: {e}")),
+    };
     let response = match catch_unwind(AssertUnwindSafe(|| {
         snarkvm::synthesizer::process::evaluate_view_with_stack_at_height(
             state,

crates/passes/src/type_checking/visitor.rs

@@ -45,10 +45,11 @@ use std::ops::Deref;
 #[derive(Copy, Clone, Debug)]
 pub enum AccessScope {
     /// Read-only finalize op: permitted inside `final fn` / `final {}` blocks and inside
-    /// `view fn` bodies. Examples: `Mapping::get`, `Vector::len`, `block.height`.
+    /// `view fn` bodies. Examples: `Mapping::get`, `Vector::len`, `block.height`,
+    /// `block.timestamp`, `Snark::verify`, `self.program_owner`.
     FinalizeRead,
     /// Mutating finalize op: permitted inside `final fn` / `final {}` blocks only. Examples:
-    /// `Mapping::set`, `Vector::push`, `Snark::verify`, storage writes.
+    /// `Mapping::set`, `Vector::push`, storage writes.
     FinalizeWrite,
     /// Caller-context op: permitted inside regular `fn` and entry-point `fn` bodies only.
     /// Examples: `self.caller`, `self.signer`.
@@ -811,8 +812,9 @@ impl TypeCheckingVisitor<'_> {
                 Type::Boolean
             }
             Intrinsic::SnarkVerify => {
-                // Check that the operation is invoked in a `finalize` or `async` block.
-                self.check_access_allowed("Snark::verify", AccessScope::FinalizeWrite, function_span);
+                // Check that the operation is invoked in a `finalize` / `async` block or a view.
+                // `snark.verify` is a pure instruction (no state mutation), so views may call it.
+                self.check_access_allowed("Snark::verify", AccessScope::FinalizeRead, function_span);
 
                 // arg0: [u8; N] — verifying key (1D byte array)
                 let Type::Array(vk_arr) = &arguments[0].0 else {
@@ -877,8 +879,9 @@ impl TypeCheckingVisitor<'_> {
                 Type::Boolean
             }
             Intrinsic::SnarkVerifyBatch => {
-                // Check that the operation is invoked in a `finalize` or `async` block.
-                self.check_access_allowed("Snark::verify_batch", AccessScope::FinalizeWrite, function_span);
+                // Check that the operation is invoked in a `finalize` / `async` block or a view.
+                // `snark.verify` is a pure instruction (no state mutation), so views may call it.
+                self.check_access_allowed("Snark::verify_batch", AccessScope::FinalizeRead, function_span);
 
                 // arg0: [[u8; N]; M] — verifying keys (2D byte array)
                 let Type::Array(vks_outer) = &arguments[0].0 else {
@@ -1624,8 +1627,10 @@ impl TypeCheckingVisitor<'_> {
             Intrinsic::SelfEdition => Type::Integer(IntegerType::U16),
             Intrinsic::SelfId => Type::Address,
             Intrinsic::SelfProgramOwner => {
-                // Check that the operation is only invoked in a `finalize` block.
-                self.check_access_allowed("program_owner", AccessScope::FinalizeWrite, function_span);
+                // Check that the operation is invoked in a `finalize` block or a view.
+                // The program owner resolves read-only in the finalize register path, so views can read it
+                // (matching the externally-addressed `Program::program_owner` form).
+                self.check_access_allowed("program_owner", AccessScope::FinalizeRead, function_span);
                 Type::Address
             }
             Intrinsic::SelfSigner => {
@@ -1640,8 +1645,9 @@ impl TypeCheckingVisitor<'_> {
                 Type::Integer(IntegerType::U32)
             }
             Intrinsic::BlockTimestamp => {
-                // Check that the operation is invoked in a `finalize` block. Rejected in view fns.
-                self.check_access_allowed("block.timestamp", AccessScope::FinalizeWrite, function_span);
+                // Check that the operation is invoked in a `finalize` block or a view.
+                // Views see the block timestamp via FinalizeGlobalState, exactly like `block.height`.
+                self.check_access_allowed("block.timestamp", AccessScope::FinalizeRead, function_span);
                 Type::Integer(IntegerType::I64)
             }
             Intrinsic::NetworkId => {

tests/expectations/compiler/view/view_calls_snark_verify.out

@@ -0,0 +1,20 @@
+program test.aleo;
+
+function dummy:
+    input r0 as u32.private;
+    output r0 as u32.private;
+
+view check:
+    input r0 as [u8; 128u32].public;
+    input r1 as u8.public;
+    input r2 as [field; 4u32].public;
+    input r3 as [u8; 256u32].public;
+    input r4 as [[u8; 128u32]; 2u32].public;
+    input r5 as [[[field; 4u32]; 3u32]; 2u32].public;
+    snark.verify r0 r1 r2 r3 into r6;
+    snark.verify.batch r4 r1 r5 r3 into r7;
+    and r6 r7 into r8;
+    output r8 as boolean.public;
+
+constructor:
+    assert.eq edition 0u16;

tests/expectations/compiler/view/view_reads_block_timestamp.out

@@ -0,0 +1,11 @@
+program test.aleo;
+
+function dummy:
+    input r0 as u32.private;
+    output r0 as u32.private;
+
+view read_time:
+    output block.timestamp as i64.public;
+
+constructor:
+    assert.eq edition 0u16;

tests/expectations/compiler/view/view_reads_block_timestamp_fail.out

@@ -0,0 +1,19 @@
+program test.aleo;
+
+function dummy_transition:
+    input r0 as u32.private;
+    add r0 1u32 into r1;
+    output r1 as u32.private;
+
+view read_time:
+    output block.timestamp as i64.public;
+
+view read_height:
+    output block.height as u32.public;
+
+constructor:
+    assert.eq edition 0u16;
+status: success
+output: 1234567890i64
+status: success
+output: 0u32

tests/expectations/execution/view_reads_block_timestamp.out

@@ -0,0 +1,14 @@
+program test.aleo;
+
+function dummy_transition:
+    input r0 as u32.private;
+    add r0 1u32 into r1;
+    output r1 as u32.private;
+
+view read_owner:
+    output program_owner as address.public;
+
+constructor:
+    assert.eq edition 0u16;
+status: success
+output: aleo1rhgdu77hgyqd3xjj8ucu3jj9r2krwz6mnzyd80gncr5fxcwlh5rsvzp9px

tests/expectations/execution/view_reads_program_owner.out

@@ -0,0 +1,23 @@
+// `Snark::verify` and `Snark::verify_batch` are pure instructions (no state mutation), so they are
+// allowed inside a `view fn`, exactly as they are inside a `final fn`. Executing them requires real
+// proof bytes (see the compile-only `core/algorithms/snark_verify` test), so this only checks that
+// the type checker accepts them in a view and that codegen emits valid Aleo.
+program test.aleo {
+    fn dummy(x: u32) -> u32 { return x; }
+
+    view fn check(
+        vk: [u8; 128],
+        varuna_version: u8,
+        inputs: [field; 4],
+        proof: [u8; 256],
+        vks: [[u8; 128]; 2],
+        batch_inputs: [[[field; 4]; 3]; 2],
+    ) -> bool {
+        let single: bool = Snark::verify(vk, varuna_version, inputs, proof);
+        let batch: bool = Snark::verify_batch(vks, varuna_version, batch_inputs, proof);
+        return single && batch;
+    }
+
+    @noupgrade
+    constructor() {}
+}

tests/tests/compiler/view/view_calls_snark_verify.leo

@@ -0,0 +1,13 @@
+// `block.timestamp` is readable inside a `view fn`, exactly like `block.height` and `network.id`.
+// snarkVM populates the view's `FinalizeGlobalState` with the block timestamp (present from
+// ConsensusVersion::V12 onward), so views can read it off-consensus.
+program test.aleo {
+    fn dummy(x: u32) -> u32 { return x; }
+
+    view fn read_time() -> i64 {
+        return block.timestamp;
+    }
+
+    @noupgrade
+    constructor() {}
+}