@cofhe/mock-contracts 0.6.0 → 0.7.0

package/contracts/MockACL.sol

@@ -2,7 +2,7 @@
 pragma solidity >=0.8.19 <0.9.0;
 
 import { Strings } from '@openzeppelin/contracts/utils/Strings.sol';
-import { MockPermissioned, Permission } from './Permissioned.sol';
+import { MockPermissioned, ACP, SCOPE_GLOBAL, SCOPE_CONTRACT, SCOPE_HANDLES } from './Permissioned.sol';
 import { TASK_MANAGER_ADDRESS } from '@fhenixprotocol/cofhe-contracts/FHE.sol';
 
 /**
@@ -27,6 +27,16 @@ contract MockACL is MockPermissioned {
   /// @param sender   Sender address.
   error DirectAllowForbidden(address sender);
 
+  /// @notice         Returned when no share is pending for `receiver` on `handle`.
+  /// @param handle   Handle.
+  /// @param receiver Address the share would have been directed at.
+  error NotShared(uint256 handle, address receiver);
+
+  /// @notice          Returned when a share is pending but was written by a different party.
+  /// @param expected  Sharer the receiver named.
+  /// @param actual    Sharer recorded in the slot.
+  error UnexpectedSharer(address expected, address actual);
+
   /// @notice             Emitted when a list of handles is allowed for decryption.
   /// @param handlesList  List of handles allowed for decryption.
   event AllowedForDecryption(uint256[] handlesList);
@@ -37,17 +47,21 @@ contract MockACL is MockPermissioned {
   /// @param contractAddress  Contract address.
   event NewDelegation(address indexed sender, address indexed delegatee, address indexed contractAddress);
 
+  /// @notice Emitted when the default revoker contract address is updated (zero = unset).
+  event DefaultRevokerContractUpdated(address oldAddress, address newAddress);
+
+  /// @notice Emitted when the share registry address is updated (zero = unset).
+  event ShareRegistryUpdated(address oldAddress, address newAddress);
+
   /// @custom:storage-location erc7201:cofhe.storage.ACL
   struct ACLStorage {
     mapping(uint256 handle => bool isGlobal) globalHandles;
     mapping(uint256 handle => mapping(address account => bool isAllowed)) persistedAllowedPairs;
     mapping(uint256 => bool) allowedForDecryption;
     mapping(address account => mapping(address delegatee => mapping(address contractAddress => bool isDelegate))) delegates;
-    /// @dev Approximates EIP-1153 transient storage: stores the block.number when the allowance
-    ///      was granted. An allowance is considered active only if it was set in the current block,
-    ///      so it auto-expires when the block changes — no explicit cleanup required.
-    ///      In Hardhat automine mode (one tx per block) this faithfully replicates per-tx transience.
-    mapping(bytes32 => uint256) transientAllowanceBlocks;
+    /// @dev ACP infrastructure addresses served to SDKs (appended fields — do not reorder)
+    address defaultRevokerContract;
+    address shareRegistry;
   }
 
   /// @notice Name of the contract.
@@ -69,6 +83,11 @@ contract MockACL is MockPermissioned {
   bytes32 private constant ACL_SLOT =
     keccak256(abi.encode(uint256(keccak256('cofhe.storage.ACL')) - 1)) & ~bytes32(uint256(0xff));
 
+  /// @dev Domain separator for share slots. Transient allowance keys are
+  ///      keccak256(abi.encodePacked(handle, account)) with no prefix, so share keys must be
+  ///      separated to stop a (handle, receiver) pair aliasing between the two namespaces.
+  bytes32 private constant SHARE_DOMAIN = keccak256('cofhe.acl.share');
+
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor() MockPermissioned() {}
 
@@ -156,9 +175,92 @@ contract MockACL is MockPermissioned {
       revert SenderNotAllowed(requester);
     }
 
-    ACLStorage storage $ = _getACLStorage();
-    bytes32 key = keccak256(abi.encodePacked(handle, account));
-    $.transientAllowanceBlocks[key] = block.number;
+    _allowTransient(handle, account);
+  }
+
+  /**
+   * @dev             Derives the transient slot holding the sharer for a directed share.
+   * @param handle    Handle.
+   * @param receiver  Address the share is directed at.
+   */
+  function _shareKey(uint256 handle, address receiver) private pure returns (bytes32) {
+    return keccak256(abi.encodePacked(SHARE_DOMAIN, handle, receiver));
+  }
+
+  /**
+   * @dev         tstore plus registration in the cleanup index at transient slot 0, so that
+   *              cleanTransientStorage() clears the key. Every transient write goes through here,
+   *              which is what keeps allowances and share slots cleared together.
+   * @param key   Transient slot.
+   * @param value Value to store.
+   */
+  function _tstoreTracked(bytes32 key, uint256 value) private {
+    assembly {
+      tstore(key, value)
+      let length := tload(0)
+      let lengthPlusOne := add(length, 1)
+      tstore(lengthPlusOne, key)
+      tstore(0, lengthPlusOne)
+    }
+  }
+
+  /**
+   * @dev             Writes the transient allowance. Callers own the custody check.
+   * @param handle    Handle.
+   * @param account   Address being granted access.
+   */
+  function _allowTransient(uint256 handle, address account) internal {
+    _tstoreTracked(keccak256(abi.encodePacked(handle, account)), 1);
+  }
+
+  /**
+   * @notice          Grants `receiver` transient access to `handle` and records `sharer` as the
+   *                  party that handed it over, for the duration of this transaction.
+   * @dev             The caller must be the Task Manager contract.
+   * @dev             Stricter than allowTransient: there is no TASK_MANAGER_ADDRESS bypass, since
+   *                  nothing shares on the Task Manager's own behalf.
+   * @param handle    Handle.
+   * @param sharer    Address handing the handle over.
+   * @param receiver  Address the handle is being handed to.
+   */
+  function shareCtHash(uint256 handle, address sharer, address receiver) public virtual {
+    if (msg.sender != TASK_MANAGER_ADDRESS_) {
+      revert DirectAllowForbidden(msg.sender);
+    }
+
+    if (!isAllowed(handle, sharer)) {
+      revert SenderNotAllowed(sharer);
+    }
+
+    _allowTransient(handle, receiver); // capability
+    _tstoreTracked(_shareKey(handle, receiver), uint256(uint160(sharer))); // provenance
+  }
+
+  /**
+   * @notice                Consumes the share directed at `receiver` for `handle`.
+   * @dev                   The caller must be the Task Manager contract. The slot is cleared, so a
+   *                        share is claimable exactly once. On revert the clear is rolled back with
+   *                        the frame, leaving the share available to its intended receiver.
+   * @param handle          Handle.
+   * @param expectedSharer  Sharer the receiver requires. Must be the party that delivered the
+   *                        handle, not merely one the receiver trusts.
+   * @param receiver        Address consuming the share.
+   */
+  function receiveCtHash(uint256 handle, address expectedSharer, address receiver) public virtual {
+    if (msg.sender != TASK_MANAGER_ADDRESS_) {
+      revert DirectAllowForbidden(msg.sender);
+    }
+
+    bytes32 shareKey = _shareKey(handle, receiver);
+    address sharer;
+    assembly {
+      sharer := tload(shareKey)
+      tstore(shareKey, 0)
+    }
+
+    if (sharer == address(0)) revert NotShared(handle, receiver);
+    if (sharer != expectedSharer) revert UnexpectedSharer(expectedSharer, sharer);
+    if (!isAllowed(handle, sharer)) revert SenderNotAllowed(sharer);
   }
 
   /**
@@ -213,9 +315,12 @@ contract MockACL is MockPermissioned {
    * @return isAllowedTransient   Whether the account can access transiently the handle.
    */
   function allowedTransient(uint256 handle, address account) public view virtual returns (bool) {
-    ACLStorage storage $ = _getACLStorage();
+    bool isAllowedTransient;
     bytes32 key = keccak256(abi.encodePacked(handle, account));
-    return $.transientAllowanceBlocks[key] == block.number;
+    assembly {
+      isAllowedTransient := tload(key)
+    }
+    return isAllowedTransient;
   }
 
   /**
@@ -269,13 +374,28 @@ contract MockACL is MockPermissioned {
   }
 
   /**
-   * @dev No-op in the mock: transient allowances auto-expire when the block changes, so explicit
-   *      cleanup is not needed. Kept for interface compatibility with the production ACL.
+   * @dev This function removes the transient allowances, which could be useful for integration with
+   *      Account Abstraction when bundling several UserOps calling the TaskManagerCoprocessor.
    */
   function cleanTransientStorage() external virtual {
     if (msg.sender != TASK_MANAGER_ADDRESS_) {
       revert DirectAllowForbidden(msg.sender);
     }
+
+    assembly {
+      let length := tload(0)
+      tstore(0, 0)
+      let lengthPlusOne := add(length, 1)
+      for {
+        let i := 1
+      } lt(i, lengthPlusOne) {
+        i := add(i, 1)
+      } {
+        let handle := tload(i)
+        tstore(i, 0)
+        tstore(handle, 0)
+      }
+    }
   }
 
   /**
@@ -307,14 +427,73 @@ contract MockACL is MockPermissioned {
     }
   }
 
-  function isAllowedWithPermission(
-    Permission memory permission,
-    uint256 handle
-  ) public view withPermission(permission) returns (bool) {
-    return isAllowed(handle, permission.issuer);
+
+  // ---------------------------------------------------------------------------
+  // ACP (ACP V3) — scope-checked access
+  // ---------------------------------------------------------------------------
+
+  /// @notice Default revoker contract for newly created ACPs, served to SDKs (zero = unset).
+  function defaultRevokerContract() public view returns (address) {
+    return _getACLStorage().defaultRevokerContract;
   }
 
-  function checkPermitValidity(Permission memory permission) public view withPermission(permission) returns (bool) {
-    return true;
+  /// @notice The ACPShareRegistry address, served to SDKs (zero = sharing unavailable).
+  function shareRegistry() public view returns (address) {
+    return _getACLStorage().shareRegistry;
+  }
+
+  /// @notice Sets the default revoker contract address (unrestricted in the mock;
+  ///         the production setter is onlyOwner).
+  function setDefaultRevokerContract(address newAddress) external {
+    ACLStorage storage $ = _getACLStorage();
+    emit DefaultRevokerContractUpdated($.defaultRevokerContract, newAddress);
+    $.defaultRevokerContract = newAddress;
+  }
+
+  /// @notice Sets the share registry address (unrestricted in the mock;
+  ///         the production setter is onlyOwner).
+  function setShareRegistry(address newAddress) external {
+    ACLStorage storage $ = _getACLStorage();
+    emit ShareRegistryUpdated($.shareRegistry, newAddress);
+    $.shareRegistry = newAddress;
+  }
+
+  /// @notice V3 (ACP) access check — the scope table.
+  ///
+  ///         | condition                                            | result |
+  ///         |------------------------------------------------------|--------|
+  ///         | permission structure invalid (expired/sig/revoked)   | REVERT |
+  ///         | issuer does NOT have access to handle                | false  |
+  ///         | permission.global                                    | true   |
+  ///         | any permission.contracts allowed for handle          | true   |
+  ///         | permission.handles contains handle                   | true   |
+  ///         | otherwise                                            | false  |
+  ///
+  /// @dev Scopes narrow the issuer's existing access, never widen it.
+  ///      Contract scope is an intersection over the EXISTING
+  ///      `persistedAllowedPairs` (populated via FHE.allow/allowThis) —
+  ///      no new data structures. Transient allowances deliberately do not
+  ///      satisfy contract scope: only persisted grants count.
+  function isAllowedWithPermission(ACP memory acp, uint256 handle) public view withPermission(acp) returns (bool) {
+    // Scopes narrow the issuer's existing access, never widen it
+    if (!isAllowed(handle, acp.issuer)) return false;
+
+    if (acp.scope == SCOPE_GLOBAL) return true;
+
+    if (acp.scope == SCOPE_CONTRACT) {
+      for (uint256 i = 0; i < acp.contracts.length; i++) {
+        if (isAllowed(handle, acp.contracts[i])) return true;
+      }
+      return false;
+    }
+
+    if (acp.scope == SCOPE_HANDLES) {
+      for (uint256 i = 0; i < acp.handles.length; i++) {
+        if (acp.handles[i] == bytes32(handle)) return true;
+      }
+      return false;
+    }
+
+    return false;
   }
 }

package/contracts/MockTaskManager.sol

@@ -2,12 +2,13 @@
 /* solhint-disable one-contract-per-file */
 pragma solidity >=0.8.25 <0.9.0;
 
-import { MockACL, Permission } from './MockACL.sol';
+import { MockACL } from './MockACL.sol';
+import { ACP } from './Permissioned.sol';
 // import {PlaintextsStorage} from "./PlaintextsStorage.sol";
 import { Strings } from '@openzeppelin/contracts/utils/Strings.sol';
 import { ECDSA } from '@openzeppelin/contracts/utils/cryptography/ECDSA.sol';
 import { MockCoFHE } from './MockCoFHE.sol';
-import { ITaskManager, FunctionId, Utils, EncryptedInput } from '@fhenixprotocol/cofhe-contracts/ICofhe.sol';
+import { ITaskManager, FunctionId, Utils, UnsignedEncryptedInput } from '@fhenixprotocol/cofhe-contracts/ICofhe.sol';
 
 error DecryptionResultNotReady(uint256 ctHash);
 // Input validation errors
@@ -556,26 +557,53 @@ contract MockTaskManager is ITaskManager, MockCoFHE {
     }
   }
 
-  function verifyInput(EncryptedInput memory input, address sender) external returns (uint256) {
-    int32 securityZone = int32(uint32(input.securityZone));
-
+  /// @notice Verify a batch of encrypted inputs that share a single signature.
+  /// @dev The verifier signs the whole batch with one signature over
+  ///      keccak256(h_0 || h_1 || ... || h_n), where each h_i is the same
+  ///      per-input message hash defined by `inputMessageHash`:
+  ///      keccak256(ctHash || utype || securityZone || sender || chainid || contractAddress).
+  ///      `contractAddress` (the caller of this function) binds the batch to the specific
+  ///      consuming contract, matching cofhe-contracts#77.
+  ///      Inputs are processed in order; the returned hashes line up with `inputs`.
+  ///      This is the sole verification path - the real FHE.sol library routes single
+  ///      inputs through here too (as a one-element batch), so there's no separate
+  ///      single-item `verifyInput` entry point to keep in sync.
+  /// @param inputs The encrypted inputs to verify (no per-input signature -
+  ///        the batch is authenticated by the single `signature` argument).
+  /// @param sender The account the inputs are bound to.
+  /// @param signature The single ECDSA signature covering the whole batch.
+  /// @return appendedHashes The metadata-appended ct hashes, in input order.
+  function batchVerifyInputs(
+    UnsignedEncryptedInput[] memory inputs,
+    address sender,
+    bytes memory signature
+  ) external returns (uint256[] memory) {
+    uint256 len = inputs.length;
     // When signer is set to 0 address we skip this logic to be able to support debug use cases.
     // In debug use cases we assume that the verifier is not necessarily running.
     if (verifierSigner != address(0)) {
-      if (!isValidSecurityZone(securityZone)) {
-        revert InvalidSecurityZone(securityZone, securityZoneMin, securityZoneMax);
+      for (uint256 i = 0; i < len; i++) {
+        int32 securityZone = int32(uint32(inputs[i].securityZone));
+        if (!isValidSecurityZone(securityZone)) {
+          revert InvalidSecurityZone(securityZone, securityZoneMin, securityZoneMax);
+        }
       }
 
-      address signer = extractSigner(input, sender);
+      address signer = extractBatchSigner(inputs, sender, msg.sender, signature);
       if (signer != verifierSigner) {
         revert InvalidSigner(signer, verifierSigner);
       }
     }
 
-    uint256 appendedHash = TMCommon.appendMetadata(input.ctHash, securityZone, input.utype, false);
+    uint256[] memory appendedHashes = new uint256[](len);
+    for (uint256 i = 0; i < len; i++) {
+      int32 securityZone = int32(uint32(inputs[i].securityZone));
+      uint256 appendedHash = TMCommon.appendMetadata(inputs[i].ctHash, securityZone, inputs[i].utype, false);
+      acl.allowTransient(appendedHash, msg.sender, address(this));
+      appendedHashes[i] = appendedHash;
+    }
 
-    acl.allowTransient(appendedHash, msg.sender, address(this));
-    return appendedHash;
+    return appendedHashes;
   }
 
   function allow(uint256 ctHash, address account) external {
@@ -623,11 +651,55 @@ contract MockTaskManager is ITaskManager, MockCoFHE {
     return acl.isAllowed(ctHash, account);
   }
 
-  function extractSigner(EncryptedInput memory input, address sender) private view returns (address) {
-    bytes memory combined = abi.encodePacked(input.ctHash, input.utype, input.securityZone, sender, block.chainid);
-    bytes32 expectedHash = keccak256(combined);
+  function shareCtHash(uint256 ctHash, address receiver) external {
+    acl.shareCtHash(ctHash, msg.sender, receiver);
+
+    // NOTE: MOCK
+    MOCK_logAllow('FHE.share', ctHash, receiver);
+  }
 
-    address signer = ECDSA.recover(expectedHash, input.signature);
+  function receiveCtHash(uint256 ctHash, address expectedSharer) external {
+    acl.receiveCtHash(ctHash, expectedSharer, msg.sender);
+
+    // NOTE: MOCK
+    MOCK_logAllow('FHE.receive', ctHash, expectedSharer);
+  }
+
+  /// @dev Per-input message hash used by batch verification:
+  ///      keccak256(ctHash || utype || securityZone || sender || chainid || contractAddress).
+  ///      `contractAddress` binds the input to the specific contract that consumes it
+  ///      (the caller of `batchVerifyInputs`), matching cofhe-contracts#77 -
+  ///      without this, a signed input observed on-chain could be replayed into any other
+  ///      contract, which would then obtain an ACL allowance over the ciphertext.
+  function inputMessageHash(
+    uint256 ctHash,
+    uint8 utype,
+    uint8 securityZone,
+    address sender,
+    address contractAddress
+  ) private view returns (bytes32) {
+    return keccak256(abi.encodePacked(ctHash, utype, securityZone, sender, block.chainid, contractAddress));
+  }
+
+  /// @dev Recover the signer of a batch from the single signature over
+  ///      keccak256(h_0 || h_1 || ... || h_n), where each h_i is `inputMessageHash`.
+  function extractBatchSigner(
+    UnsignedEncryptedInput[] memory inputs,
+    address sender,
+    address contractAddress,
+    bytes memory signature
+  ) private view returns (address) {
+    bytes memory concatenatedHashes;
+    for (uint256 i = 0; i < inputs.length; i++) {
+      concatenatedHashes = abi.encodePacked(
+        concatenatedHashes,
+        inputMessageHash(inputs[i].ctHash, inputs[i].utype, inputs[i].securityZone, sender, contractAddress)
+      );
+    }
+
+    bytes32 batchHash = keccak256(concatenatedHashes);
+
+    address signer = ECDSA.recover(batchHash, signature);
 
     if (signer == address(0)) {
       revert InvalidSignature();
@@ -683,8 +755,9 @@ contract MockTaskManager is ITaskManager, MockCoFHE {
     aggregator = _aggregatorAddress;
   }
 
-  function isAllowedWithPermission(Permission memory permission, uint256 handle) public view returns (bool) {
-    return acl.isAllowedWithPermission(permission, handle);
+  /// @notice ACP scope-checked access, forwarded to the ACL.
+  function isAllowedWithPermission(ACP memory acp, uint256 handle) public view returns (bool) {
+    return acl.isAllowedWithPermission(acp, handle);
   }
 
   // Stub implementations for new ITaskManager interface methods (inc PR #48)

package/contracts/MockThresholdNetwork.sol

@@ -9,7 +9,7 @@ pragma solidity >=0.8.19 <0.9.0;
 
 import { MockACL } from './MockACL.sol';
 import { MockTaskManager } from './MockTaskManager.sol';
-import { Permission, MockPermissioned } from './Permissioned.sol';
+import { MockPermissioned, ACP } from './Permissioned.sol';
 
 contract MockThresholdNetwork {
   MockTaskManager public mockTaskManager;
@@ -35,10 +35,10 @@ contract MockThresholdNetwork {
   function queryDecrypt(
     uint256 ctHash,
     uint256,
-    Permission memory permission
+    ACP memory acp
   ) public view returns (bool allowed, string memory error, uint256) {
     bool isAllowed;
-    try mockAcl.isAllowedWithPermission(permission, ctHash) returns (bool _isAllowed) {
+    try mockAcl.isAllowedWithPermission(acp, ctHash) returns (bool _isAllowed) {
       isAllowed = _isAllowed;
     } catch Error(string memory reason) {
       // Handle string error messages
@@ -92,12 +92,12 @@ contract MockThresholdNetwork {
   function querySealOutput(
     uint256 ctHash,
     uint256,
-    Permission memory permission
+    ACP memory acp
   ) public view returns (bool allowed, string memory error, bytes32) {
-    if (permission.sealingKey == bytes32(0)) revert SealingKeyMissing();
+    if (acp.sealingKey == bytes32(0)) revert SealingKeyMissing();
 
     bool isAllowed;
-    try mockAcl.isAllowedWithPermission(permission, ctHash) returns (bool _isAllowed) {
+    try mockAcl.isAllowedWithPermission(acp, ctHash) returns (bool _isAllowed) {
       isAllowed = _isAllowed;
     } catch Error(string memory reason) {
       // Handle string error messages
@@ -112,16 +112,16 @@ contract MockThresholdNetwork {
     if (!isAllowed) return (false, 'NotAllowed', bytes32(0));
 
     uint256 value = mockTaskManager.mockStorage(ctHash);
-    return (true, '', seal(value, permission.sealingKey));
+    return (true, '', seal(value, acp.sealingKey));
   }
 
   // DECRYPT FOR TX
 
-  function _isAllowedWithPermit(
+  function _isAllowedWithACP(
     uint256 ctHash,
-    Permission memory permission
+    ACP memory acp
   ) internal view returns (bool isAllowed, string memory error) {
-    try mockTaskManager.isAllowedWithPermission(permission, ctHash) returns (bool _isAllowed) {
+    try mockTaskManager.isAllowedWithPermission(acp, ctHash) returns (bool _isAllowed) {
       isAllowed = _isAllowed;
     } catch Error(string memory reason) {
       return (false, reason);
@@ -135,7 +135,7 @@ contract MockThresholdNetwork {
     return (true, '');
   }
 
-  function _isAllowedWithoutPermit(uint256 ctHash) internal view returns (bool isAllowed, string memory error) {
+  function _isAllowedWithoutACP(uint256 ctHash) internal view returns (bool isAllowed, string memory error) {
     try mockAcl.globalAllowed(ctHash) returns (bool _isAllowed) {
       isAllowed = _isAllowed;
     } catch Error(string memory reason) {
@@ -150,27 +150,27 @@ contract MockThresholdNetwork {
     return (true, '');
   }
 
-  /// @notice Decrypt a ciphertext for a transaction using a permit.
-  function decryptForTxWithPermit(
+  /// @notice Decrypt a ciphertext for a transaction using an ACP.
+  function decryptForTxWithACP(
     uint256 ctHash,
-    Permission memory permission
+    ACP memory acp
   ) public view returns (bool allowed, string memory error, uint256 decryptedValue) {
-    if (permission.issuer == address(0)) {
+    if (acp.issuer == address(0)) {
       return (false, 'PermissionMissing', 0);
     }
 
-    (bool isAllowed, string memory err) = _isAllowedWithPermit(ctHash, permission);
+    (bool isAllowed, string memory err) = _isAllowedWithACP(ctHash, acp);
     if (!isAllowed) return (false, err, 0);
 
     uint256 value = mockTaskManager.mockStorage(ctHash);
     return (true, '', value);
   }
 
-  /// @notice Decrypt a ciphertext for a transaction using global allowance (no permit).
-  function decryptForTxWithoutPermit(
+  /// @notice Decrypt a ciphertext for a transaction using global allowance (no acp).
+  function decryptForTxWithoutACP(
     uint256 ctHash
   ) public view returns (bool allowed, string memory error, uint256 decryptedValue) {
-    (bool isAllowed, string memory err) = _isAllowedWithoutPermit(ctHash);
+    (bool isAllowed, string memory err) = _isAllowedWithoutACP(ctHash);
     if (!isAllowed) return (false, err, 0);
 
     uint256 value = mockTaskManager.mockStorage(ctHash);