Merge pull request #319 from Simcrypt/feat/307-308-309-310-multi-token-refund-allowlist-upgrade

feat: multi-token support, auto-refund, allowlist fixes, upgrade authority (#307 #308 #309 #310)

Author: Kingsman-99

contracts/split/src/lib.rs

@@ -25,7 +25,7 @@ use types::{
     Invoice, InvoiceCore, InvoiceExt, InvoiceExt2, InvoiceOptions, InvoicePayment, InvoiceStatus,
     InvoiceTemplate, LegacyInvoice, OverflowBehavior, Payment, PaymentCertificate, PaymentProof,
     QueuedAction, ResolveAction, ResolveRule, SplitRule, SubscriptionParams,
-    TimelockAction, Tranche, TreasuryRecord,
+    TimelockAction, Tranche, TreasuryRecord, UpgradeProposal,
 };
 
 // ---------------------------------------------------------------------------
@@ -385,6 +385,16 @@ fn pending_admin_key() -> Symbol {
     symbol_short!("pend_adm")
 }
 
+/// Issue #310: pending upgrade proposal — instance storage.
+fn upgrade_proposal_key() -> Symbol {
+    symbol_short!("upg_prop")
+}
+
+/// Issue #308: per-invoice refunded-addresses set — persistent storage.
+fn refunded_key(invoice_id: u64) -> (Symbol, u64) {
+    (symbol_short!("refunded"), invoice_id)
+}
+
 fn maybe_record_created(env: &Env, creator: &Address, total: i128) {
     if let Some(dashboard) = env.storage().persistent().get::<Symbol, Address>(&dashboard_contract_key()) {
         let _: Val = env.invoke_contract(
@@ -475,6 +485,7 @@ fn load_invoice(env: &Env, id: u64) -> Invoice {
             penalty_tiers: Vec::new(env),
             allowed_callers: None,
             refund_grace_secs: None,
+            refunded_addresses: Vec::new(env),
         });
     let ext2: InvoiceExt2 = env.storage().persistent()
         .get(&invoice_ext2_key(id))
@@ -1272,6 +1283,7 @@ impl SplitContract {
                         penalty_tiers: Vec::new(&env),
                         allowed_callers: None,
                         refund_grace_secs: None,
+                        refunded_addresses: Vec::new(&env),
                     })
             });
         let ext2: types::InvoiceExt2 = env
@@ -1534,7 +1546,8 @@ impl SplitContract {
             creator,
             recipients,
             amounts,
-            token,
+            // Issue #307: if payment_token is explicitly set, use it instead of the token param.
+            options.payment_token.unwrap_or(token),
             deadline,
             options.co_creators,
             options.allow_early_withdrawal,
@@ -1933,6 +1946,7 @@ impl SplitContract {
             priorities,
             penalty_tiers: Vec::new(env),
             allowed_callers: None,
+            refunded_addresses: Vec::new(env),
             admin_frozen: false,
             min_funding_amount: 0,
             target_usd_cents: None,
@@ -2313,6 +2327,7 @@ impl SplitContract {
             scheduled_release_at: source.scheduled_release_at,
             priorities: source.priorities.clone(),
             target_usd_cents: source.target_usd_cents,
+            refunded_addresses: Vec::new(&env),
         };
 
         save_invoice(&env, id, &new_invoice);
@@ -3374,14 +3389,16 @@ impl SplitContract {
             invoice.allowed_payers = Some(new_whitelist);
             save_invoice(&env, invoice_id, &invoice);
             append_audit_entry(&env, invoice_id, symbol_short!("rem_payer"), &creator);
+            // Issue #309: emit AllowlistUpdated event on removal
+            events::allowlist_updated(&env, invoice_id, &creator, &payer, false);
         }
     }
 
     /// Add a payer to the invoice's allowed_payers allowlist.
     ///
     /// Only the creator (or a co-creator) may call this. If allowed_payers is None
-    /// (open invoice), this is a no-op and does not error. If the payer is already
-    /// in the allowlist, this is a no-op.
+    /// (open invoice), initializes the list with this payer (making the invoice private).
+    /// If the payer is already in the allowlist, this is a no-op.
     pub fn add_allowed_payer(env: Env, creator: Address, invoice_id: u64, payer: Address) {
         require_not_paused(&env);
         creator.require_auth();
@@ -3393,13 +3410,21 @@ impl SplitContract {
             "only creator can modify allowlist"
         );
 
-        // No-op if allowed_payers is None (open invoice)
+        // If allowed_payers is None, initialize a new list (makes invoice private).
+        if invoice.allowed_payers.is_none() {
+            invoice.allowed_payers = Some(Vec::new(&env));
+        }
+
         if let Some(ref mut whitelist) = invoice.allowed_payers {
             // Only add if not already present
             if !whitelist.iter().any(|p| p == payer) {
-                whitelist.push_back(payer);
+                // Issue #309: enforce max 100 allowed payers
+                assert!(whitelist.len() < 100, "allowlist is full");
+                whitelist.push_back(payer.clone());
                 save_invoice(&env, invoice_id, &invoice);
                 append_audit_entry(&env, invoice_id, symbol_short!("add_payer"), &creator);
+                // Issue #309: emit AllowlistUpdated event
+                events::allowlist_updated(&env, invoice_id, &creator, &payer, true);
             }
         }
     }
@@ -5825,6 +5850,7 @@ impl SplitContract {
                 payment_cooldown_secs: None, max_payments_per_window: None, payment_window_secs: None,
                 scheduled_release_at: None, refund_grace_secs: None,
                 penalty_tiers: Vec::new(&env), allowed_callers: None,
+                refunded_addresses: Vec::new(&env),
             });
         let ext2: InvoiceExt2 = env.storage().persistent()
             .get(&invoice_ext2_key(invoice_id))
@@ -6168,4 +6194,136 @@ impl SplitContract {
             .get::<_, PaymentCertificate>(&cert_key(invoice_id))
             .expect("certificate not found")
     }
+
+    // -----------------------------------------------------------------------
+    // Issue #308: Per-payer claim_refund after deadline
+    // -----------------------------------------------------------------------
+
+    /// Claim a refund for the calling payer's contribution after the deadline.
+    ///
+    /// Conditions: invoice must be Pending, deadline must have passed, invoice
+    /// must NOT be fully funded, and the payer must not have already claimed.
+    /// Idempotent — calling twice after the first claim is a no-op.
+    pub fn claim_refund(env: Env, payer: Address, invoice_id: u64) {
+        require_fn_not_paused(&env, &symbol_short!("refund"));
+        payer.require_auth();
+
+        let mut invoice = load_invoice(&env, invoice_id);
+
+        // Must still be pending (not fully released/refunded via bulk refund).
+        if invoice.status != InvoiceStatus::Pending {
+            // Idempotent: already refunded via bulk path — nothing to do.
+            return;
+        }
+
+        // Deadline must have passed (respecting grace period).
+        let refund_deadline = if let Some(grace_secs) = invoice.refund_grace_secs {
+            invoice.deadline.saturating_add(grace_secs)
+        } else {
+            invoice.deadline
+        };
+        assert!(
+            env.ledger().timestamp() > refund_deadline,
+            "invoice has not expired yet"
+        );
+
+        // Invoice must NOT be fully funded.
+        let total: i128 = invoice.amounts.iter().sum();
+        assert!(invoice.funded < total, "invoice is fully funded");
+
+        // Idempotent: if payer already claimed, silently return.
+        if invoice.refunded_addresses.iter().any(|a| a == payer) {
+            return;
+        }
+
+        // Compute this payer's total contribution (across all shards).
+        let mut payer_total: i128 = 0;
+        for shard_id in 0..SHARD_COUNT {
+            if let Some(shard_payments) = env.storage().persistent().get::<(Symbol, u64, u64), Vec<Payment>>(&pay_shard_key(invoice_id, shard_id)) {
+                for payment in shard_payments.iter() {
+                    if payment.payer == payer && !payment.donate_on_failure {
+                        payer_total += payment.amount;
+                    }
+                }
+            }
+        }
+
+        if payer_total == 0 {
+            return; // No contribution to refund.
+        }
+
+        let token_client = token::Client::new(&env, &invoice.tokens.get(0).expect("no token"));
+        token_client.transfer(&env.current_contract_address(), &payer, &payer_total);
+
+        // Record that this payer has claimed.
+        invoice.refunded_addresses.push_back(payer.clone());
+        invoice.funded = invoice.funded.saturating_sub(payer_total);
+        save_invoice(&env, invoice_id, &invoice);
+
+        events::refund_claimed(&env, invoice_id, &payer, payer_total);
+        append_audit_entry(&env, invoice_id, symbol_short!("clm_ref"), &payer);
+    }
+
+    // -----------------------------------------------------------------------
+    // Issue #310: Two-step upgrade with 48-hour timelock
+    // -----------------------------------------------------------------------
+
+    /// Propose a contract upgrade. Only the admin may call this.
+    ///
+    /// Stores a pending proposal with an eligible_at = now + 48 h.
+    /// Overwrites any existing proposal (only one active at a time).
+    pub fn propose_upgrade(env: Env, admin: Address, new_wasm_hash: BytesN<32>) {
+        require_admin(&env);
+        let _ = admin;
+
+        const FORTY_EIGHT_HOURS: u64 = 48 * 60 * 60;
+        let eligible_at = env.ledger().timestamp().saturating_add(FORTY_EIGHT_HOURS);
+
+        let proposal = UpgradeProposal {
+            new_wasm_hash: new_wasm_hash.clone(),
+            eligible_at,
+        };
+        env.storage().instance().set(&upgrade_proposal_key(), &proposal);
+
+        events::upgrade_proposed(&env, &new_wasm_hash, eligible_at);
+    }
+
+    /// Execute a pending upgrade once the 48-hour timelock has elapsed.
+    ///
+    /// Callable by anyone after the timelock expires. Clears the proposal on success.
+    pub fn execute_upgrade(env: Env) {
+        let proposal: UpgradeProposal = env
+            .storage()
+            .instance()
+            .get(&upgrade_proposal_key())
+            .expect("no upgrade proposal");
+
+        assert!(
+            env.ledger().timestamp() >= proposal.eligible_at,
+            "upgrade timelock still active"
+        );
+
+        env.storage().instance().remove(&upgrade_proposal_key());
+        events::upgrade_executed(&env, &proposal.new_wasm_hash);
+        env.deployer().update_current_contract_wasm(proposal.new_wasm_hash);
+    }
+
+    /// Cancel a pending upgrade proposal. Only the admin may call this.
+    pub fn cancel_upgrade(env: Env, admin: Address) {
+        let admin_addr = require_admin(&env);
+        let _ = admin;
+
+        assert!(
+            env.storage().instance().has(&upgrade_proposal_key()),
+            "no upgrade proposal"
+        );
+        env.storage().instance().remove(&upgrade_proposal_key());
+
+        events::upgrade_cancelled(&env, &admin_addr);
+    }
+
+    /// Return the pending upgrade proposal, or None if none is active.
+    pub fn get_upgrade_proposal(env: Env) -> Option<UpgradeProposal> {
+        env.storage().instance().get(&upgrade_proposal_key())
+    }
 }