refactor(lee): centralize program-ownership check behind V03State::get_program

lee/state_machine/src/state/mod.rs

@@ -5,7 +5,7 @@ use lee_core::{
     BlockId, Commitment, CommitmentSetDigest, DUMMY_COMMITMENT, MembershipProof, Nullifier,
     Timestamp,
     account::{Account, AccountId, Data},
-    program::PROGRAM_STORAGE_OWNER,
+    program::{PROGRAM_STORAGE_OWNER, ProgramId},
 };
 
 use crate::{
@@ -281,6 +281,18 @@ impl V03State {
         self.public_state.get(&account_id)
     }
 
+    /// Looks up a deployed program's storage account by its `ProgramId`, verifying it is
+    /// actually owned by [`PROGRAM_STORAGE_OWNER`].
+    ///
+    /// An account at `AccountId::from(program_id)` that lacks this ownership isn't a deployed
+    /// program, whatever its contents — this is the single place that distinction is enforced,
+    /// so callers never have to remember to re-check it themselves.
+    #[must_use]
+    pub fn get_program(&self, program_id: ProgramId) -> Option<&Account> {
+        let account = self.get_account_by_id_ref(AccountId::from(program_id))?;
+        (account.program_owner == PROGRAM_STORAGE_OWNER).then_some(account)
+    }
+
     #[must_use]
     pub fn get_proof_for_commitment(&self, commitment: &Commitment) -> Option<MembershipProof> {
         self.private_state.0.get_proof_for(commitment)

lee/state_machine/src/validated_state_diff/mod.rs

@@ -112,9 +112,7 @@ impl ValidatedStateDiff {
                 LeeError::MaxChainedCallsDepthExceeded
             );
 
-            let Some(program_account) =
-                state.get_account_by_id_ref(AccountId::from(chained_call.program_id))
-            else {
+            let Some(program_account) = state.get_program(chained_call.program_id) else {
                 return Err(LeeError::InvalidInput("Unknown program".into()));
             };
             let program = Program::new_unchecked(
@@ -447,10 +445,7 @@ impl ValidatedStateDiff {
     ) -> Result<Self, LeeError> {
         // TODO: remove clone
         let program = Program::new(tx.message.bytecode.clone().into())?;
-        if state
-            .get_account_by_id_ref(AccountId::from(program.id()))
-            .is_some()
-        {
+        if state.get_program(program.id()).is_some() {
             return Err(LeeError::ProgramAlreadyExists);
         }
         Ok(Self(StateDiff {