Merge pull request #781 from walexjnr/walexjnr/issues-735-733-731-730

test: recurring payer transfer, permit nonce replay, storage TTL & supply invariants

Author: BigBen-7

CHANGELOG.md

@@ -21,6 +21,10 @@ for contract upgrades.
 - Inline doc comments explaining the purpose of each test scenario across all test files.
 - Architecture document (`docs/architecture.md`) covering module responsibilities,
   data flow, storage layout, auth model, events, and integration points.
+- `transfer_recurring_payer` — transfer a recurring payment to a new payer with
+  both parties authenticated; the payer index is updated.
+- Test coverage for recurring payer transfer, permit nonce replay protection,
+  storage TTL lifetimes, and dividend/airdrop supply invariants.
 - Recurring execution window (`set_recurring_execution_window`) — recurring
   executions past `last_charged + interval + window` panic with
   `ExecutionWindowExpired` so keepers cannot run stale payments.

src/contract.rs

@@ -237,6 +237,8 @@ pub trait VeriTixPayTrait {
     fn expire_dispute(e: Env, caller: Address, escrow_id: u32);
     fn pause_recurring(e: Env, caller: Address, recurring_id: u32);
     fn resume_recurring(e: Env, caller: Address, recurring_id: u32);
+    // #735: transfer a recurring payment to a new payer
+    fn transfer_recurring_payer(e: Env, caller: Address, recurring_id: u32, new_payer: Address);
     // #749: recurring execution window
     fn set_recurring_execution_window(e: Env, admin: Address, window_ledgers: u32);
     // #743: timed freeze
@@ -1217,6 +1219,8 @@ impl VeriTixPayTrait for VeriTixPay {
         escrow::trigger_auto_release(e, escrow_id)
     }
 
+    fn transfer_recurring_payer(e: Env, caller: Address, recurring_id: u32, new_payer: Address) {
+        recurring::transfer_recurring_payer(&e, &caller, recurring_id, new_payer)
     fn set_recurring_execution_window(e: Env, admin: Address, window_ledgers: u32) {
         recurring::set_recurring_execution_window(&e, &admin, window_ledgers)
     }

src/recurring.rs

@@ -297,6 +297,62 @@ pub fn get_recurring_by_payer(e: &Env, payer: &Address) -> Vec<u32> {
         .unwrap_or(Vec::new(e))
 }
 
+/// #735: transfer a recurring payment to a new payer. Both the current payer
+/// and the new payer must authenticate, and the payer index is updated so the
+/// recurring id shows up under the new payer.
+pub fn transfer_recurring_payer(e: &Env, caller: &Address, recurring_id: u32, new_payer: Address) {
+    caller.require_auth();
+
+    let mut record: RecurringRecord = e
+        .storage()
+        .persistent()
+        .get(&DataKey::Recurring(recurring_id))
+        .expect("recurring not found");
+    assert!(record.payer == *caller, "not the payer");
+    assert!(record.active, "recurring is not active");
+    // Reject a no-op transfer before authenticating the new payer (the host
+    // rejects double-auth of the same address, so this must be checked first).
+    assert!(
+        record.payer != new_payer,
+        "new payer must differ from current payer"
+    );
+    new_payer.require_auth();
+
+    // Remove the id from the old payer's index.
+    let old_index = DataKey::PayerRecurrings(record.payer.clone());
+    if let Some(ids) = e.storage().persistent().get::<_, Vec<u32>>(&old_index) {
+        let mut updated: Vec<u32> = Vec::new(e);
+        for i in 0..ids.len() {
+            let v = ids.get(i).unwrap();
+            if v != recurring_id {
+                updated.push_back(v);
+            }
+        }
+        e.storage().persistent().set(&old_index, &updated);
+    }
+
+    record.payer = new_payer.clone();
+    e.storage()
+        .persistent()
+        .set(&DataKey::Recurring(recurring_id), &record);
+
+    // Add the id to the new payer's index.
+    let mut payer_ids: Vec<u32> = e
+        .storage()
+        .persistent()
+        .get(&DataKey::PayerRecurrings(new_payer.clone()))
+        .unwrap_or(Vec::new(e));
+    payer_ids.push_back(recurring_id);
+    e.storage()
+        .persistent()
+        .set(&DataKey::PayerRecurrings(new_payer), &payer_ids);
+
+    e.events().publish(
+        (soroban_sdk::symbol_short!("rcr_pyr"), caller.clone(), record.payer.clone()),
+        recurring_id,
+    );
+}
+
 pub fn record_execution(e: &Env, recurring_id: u32, amount: i128) {
     let ledger = e.ledger().sequence();
     let execution = RecurringExecution {

src/recurring_test.rs

@@ -489,6 +489,18 @@ mod recurring_active_tests {
         // Setup mock record and test active vs paused states...
     }
 }
+// ── #735: transfer_recurring_payer ───────────────────────────────────────────
+
+fn transfer_setup(
+) -> (
+    Env,
+    crate::contract::VeriTixPayClient<'static>,
+    Address,
+    Address,
+    Address,
+    u32,
+    Address,
+) {
 // ── #749: recurring execution window ─────────────────────────────────────────
 
 #[test]
@@ -509,6 +521,79 @@ fn test_execute_recurring_within_execution_window_succeeds() {
     soroban_sdk::token::StellarAssetClient::new(&e, &token).mint(&payer, &1000);
 
     let id = client.setup_recurring(&payer, &payee, &token, &100, &100, &5);
+    (e, client, payer, payee, token, id, contract_id)
+}
+
+#[test]
+fn test_transfer_recurring_payer_succeeds_with_both_auth() {
+    use soroban_sdk::testutils::Address as _;
+    let (e, client, payer, _payee, _token, id, contract_id) = transfer_setup();
+    let new_payer = Address::generate(&e);
+
+    // Both the current payer (caller) and the new payer authenticate.
+    client.transfer_recurring_payer(&payer, &id, &new_payer);
+
+    let record = read_recurring_record(&e, &contract_id, id);
+    assert_eq!(record.payer, new_payer);
+}
+
+#[test]
+#[should_panic(expected = "not the payer")]
+fn test_transfer_recurring_payer_old_payer_only_panics() {
+    use soroban_sdk::testutils::Address as _;
+    let (e, client, _payer, _payee, _token, id, _contract_id) = transfer_setup();
+    let new_payer = Address::generate(&e);
+
+    // A caller that is not the current payer is refused, so a transfer that
+    // only involves the old payer's authorization cannot succeed.
+    let intruder = Address::generate(&e);
+    client.transfer_recurring_payer(&intruder, &id, &new_payer);
+}
+
+#[test]
+#[should_panic(expected = "not the payer")]
+fn test_transfer_recurring_payer_new_payer_only_panics() {
+    use soroban_sdk::testutils::Address as _;
+    let (e, client, _payer, payee, _token, id, _contract_id) = transfer_setup();
+    let new_payer = Address::generate(&e);
+
+    // The payee is not the payer, so authorizing only the new payer still fails.
+    client.transfer_recurring_payer(&payee, &id, &new_payer);
+}
+
+#[test]
+#[should_panic(expected = "new payer must differ from current payer")]
+fn test_transfer_recurring_payer_same_address_panics() {
+    let (_e, client, payer, _payee, _token, id, _contract_id) = transfer_setup();
+
+    client.transfer_recurring_payer(&payer, &id, &payer);
+}
+
+#[test]
+fn test_transfer_recurring_payer_updates_payer_index() {
+    use soroban_sdk::testutils::Address as _;
+    let (e, client, payer, _payee, _token, id, _contract_id) = transfer_setup();
+    let new_payer = Address::generate(&e);
+
+    client.transfer_recurring_payer(&payer, &id, &new_payer);
+
+    // The recurring id moves from the old payer's index to the new payer's.
+    let old_ids = client.get_recurring_by_payer(&payer);
+    assert_eq!(old_ids.len(), 0);
+    let new_ids = client.get_recurring_by_payer(&new_payer);
+    assert_eq!(new_ids.len(), 1);
+    assert_eq!(new_ids.get(0).unwrap(), id);
+}
+
+#[test]
+#[should_panic(expected = "recurring is not active")]
+fn test_transfer_recurring_payer_inactive_recurring_panics() {
+    use soroban_sdk::testutils::Address as _;
+    let (e, client, payer, _payee, _token, id, _contract_id) = transfer_setup();
+    let new_payer = Address::generate(&e);
+
+    client.cancel_recurring(&payer, &id);
+    client.transfer_recurring_payer(&payer, &id, &new_payer);
 
     // Configure a 1000-ledger execution window.
     client.set_recurring_execution_window(&admin, &1000);