fix(authenticator): normalize sparse indexer pubkey slots before key set validation

[alessandromazza98]

Problem

The indexer stores authenticator addresses/pubkeys as sparse slot arrays, where removed authenticators are kept as null to preserve stable pubkey_id positions.

The previous mapping path compacted these arrays, dropping nulls, which could shift key indices and make gateway/authenticator logic operate on the wrong slot.

Solution

Preserved sparse slot semantics end-to-end and normalized safely before validation:

• Switched indexer/gateway pubkey payloads to Vec<Option<U256>> (and added serde support for optional hex vectors).
• Updated indexer DB mappers to return full slot lists (None for removed authenticators) instead of filtering missing entries.
• Added authenticator-side decode_indexer_pubkeys normalization:
  • trims trailing empty slots,
  • preserves interior holes to keep slot positions,
  • rejects any used slot beyond MAX_AUTHENTICATOR_KEYS.
• Updated authenticator insertion to reuse the first available empty slot instead of always appending.

---

Note

Medium Risk
Changes affect wire formats and key-slot indexing semantics across services; mismatched deployments or edge cases in slot normalization could break clients or produce incorrect slot selection.

Overview
Fixes authenticator pubkey_id stability by propagating sparse authenticator slot arrays end-to-end instead of compacting away removed entries.

Indexer API payloads for authenticator pubkeys now return Vec<Option<U256>> (serialized via new hex_u256_opt_vec), indexer DB mappers stop filtering out nulls, and inclusion-proof/pubkey routes validate/normalize sparse slots before constructing AuthenticatorPublicKeySet.

On the authenticator side, indexer pubkeys are decoded via decode_sparse_authenticator_pubkeys (trim trailing None, preserve interior holes, reject out-of-bounds used slots) with a new InvalidIndexerPubkeySlot error, and insertion now reuses the first empty slot rather than always appending; tests and stubs are updated accordingly.

^{Written by Cursor Bugbot for commit 226b119. This will update automatically on new commits. Configure here.}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alessandromazza98]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[piohei]

Left only minor comment there. :)

[piohei]

I think now only one test is using that new method passing something else than None. Maybe we can change it and create empty set by default when calling new?

[alessandromazza98]

Good point, I'll do it on follow up PR🙏