#73 add context to token verification instead of separate parameters

Author: martti007

src/main/java/org/unicitylabs/sdk/transaction/Token.java

@@ -1,13 +1,11 @@
 package org.unicitylabs.sdk.transaction;
 
-import org.unicitylabs.sdk.api.bft.RootTrustBase;
-import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
 import org.unicitylabs.sdk.serializer.cbor.CborDeserializer;
 import org.unicitylabs.sdk.serializer.cbor.CborSerializationException;
 import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
 import org.unicitylabs.sdk.transaction.verification.CertifiedMintTransactionVerificationRule;
 import org.unicitylabs.sdk.transaction.verification.CertifiedTransferTransactionVerificationRule;
-import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService;
+import org.unicitylabs.sdk.transaction.verification.VerificationContext;
 import org.unicitylabs.sdk.util.verification.VerificationException;
 import org.unicitylabs.sdk.util.verification.VerificationResult;
 import org.unicitylabs.sdk.util.verification.VerificationStatus;
@@ -121,26 +119,20 @@ public static Token fromCbor(byte[] bytes) {
   /**
    * Creates a token from a certified genesis transaction and verifies it.
    *
-   * @param trustBase trust base used for certification checks
-   * @param predicateVerifier predicate verifier service
-   * @param mintJustificationVerifier mint justification verifier service
    * @param genesis certified mint transaction
+   * @param context shared verification context (trust base + registries)
    * @return verified token instance
    * @throws VerificationException if genesis verification fails
    */
   public static Token mint(
-          RootTrustBase trustBase,
-          PredicateVerifierService predicateVerifier,
-          MintJustificationVerifierService mintJustificationVerifier,
-          CertifiedMintTransaction genesis
+          CertifiedMintTransaction genesis,
+          VerificationContext context
   ) {
-    Objects.requireNonNull(trustBase, "trustBase cannot be null");
-    Objects.requireNonNull(predicateVerifier, "predicateVerifier cannot be null");
-    Objects.requireNonNull(mintJustificationVerifier, "mintJustificationVerifier cannot be null");
     Objects.requireNonNull(genesis, "genesis cannot be null");
+    Objects.requireNonNull(context, "context cannot be null");
 
     Token token = new Token(genesis);
-    VerificationResult<VerificationStatus> result = token.verify(trustBase, predicateVerifier, mintJustificationVerifier);
+    VerificationResult<VerificationStatus> result = token.verify(context);
     if (result.getStatus() != VerificationStatus.OK) {
       throw new VerificationException("Invalid token genesis", result);
     }
@@ -151,25 +143,21 @@ public static Token mint(
   /**
    * Returns a new token instance with an additional verified transfer transaction.
    *
-   * @param trustBase trust base used for certification checks
-   * @param predicateVerifier predicate verifier service
    * @param transaction certified transfer transaction to append
+   * @param context shared verification context (trust base + registries)
    * @return new token instance with appended transfer
    * @throws VerificationException if transfer verification fails
    */
   public Token transfer(
-          RootTrustBase trustBase,
-          PredicateVerifierService predicateVerifier,
-          CertifiedTransferTransaction transaction
+          CertifiedTransferTransaction transaction,
+          VerificationContext context
   ) {
-    Objects.requireNonNull(trustBase, "trustBase cannot be null");
-    Objects.requireNonNull(predicateVerifier, "predicateVerifier cannot be null");
     Objects.requireNonNull(transaction, "transaction cannot be null");
+    Objects.requireNonNull(context, "context cannot be null");
 
     VerificationResult<VerificationStatus> result = CertifiedTransferTransactionVerificationRule.verify(
-            trustBase,
-            predicateVerifier,
-            transaction
+            transaction,
+            context
     );
     if (result.getStatus() != VerificationStatus.OK) {
       throw new VerificationException("Invalid token transfer transaction", result);
@@ -187,19 +175,11 @@ public Token transfer(
    * verified iteratively with a worklist instead of recursion, so arbitrarily long provenance
    * chains do not grow the call stack.
    *
-   * @param trustBase trust base used for certification checks
-   * @param predicateVerifier predicate verifier service
-   * @param mintJustificationVerifier mint justification verifier service
+   * @param context shared verification context (trust base + registries)
    * @return verification result with a child result per verified token
    */
-  public VerificationResult<VerificationStatus> verify(
-          RootTrustBase trustBase,
-          PredicateVerifierService predicateVerifier,
-          MintJustificationVerifierService mintJustificationVerifier
-  ) {
-    Objects.requireNonNull(trustBase, "trustBase cannot be null");
-    Objects.requireNonNull(predicateVerifier, "predicateVerifier cannot be null");
-    Objects.requireNonNull(mintJustificationVerifier, "mintJustificationVerifier cannot be null");
+  public VerificationResult<VerificationStatus> verify(VerificationContext context) {
+    Objects.requireNonNull(context, "context cannot be null");
 
     ArrayDeque<Token> pending = new ArrayDeque<>();
     pending.add(this);
@@ -211,10 +191,8 @@ public VerificationResult<VerificationStatus> verify(
 
       List<VerificationResult<?>> tokenResults = new ArrayList<>();
       VerificationResult<?> result = CertifiedMintTransactionVerificationRule.verify(
-              trustBase,
-              predicateVerifier,
-              mintJustificationVerifier,
               token.genesis,
+              context,
               pending::add
       );
       tokenResults.add(result);
@@ -228,7 +206,7 @@ public VerificationResult<VerificationStatus> verify(
       List<VerificationResult<?>> transferResults = new ArrayList<>();
       for (int i = 0; i < token.transactions.size(); i++) {
         CertifiedTransferTransaction transaction = token.transactions.get(i);
-        result = CertifiedTransferTransactionVerificationRule.verify(trustBase, predicateVerifier, transaction);
+        result = CertifiedTransferTransactionVerificationRule.verify(transaction, context);
         transferResults.add(result);
         if (result.getStatus() != VerificationStatus.OK) {
           tokenResults.add(

src/main/java/org/unicitylabs/sdk/transaction/verification/CertifiedMintTransactionVerificationRule.java

@@ -1,19 +1,16 @@
 package org.unicitylabs.sdk.transaction.verification;
 
 import org.unicitylabs.sdk.api.CertificationData;
-import org.unicitylabs.sdk.api.bft.RootTrustBase;
 import org.unicitylabs.sdk.crypto.MintSigningService;
 import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
 import org.unicitylabs.sdk.predicate.EncodedPredicate;
 import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
-import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
 import org.unicitylabs.sdk.transaction.CertifiedMintTransaction;
 import org.unicitylabs.sdk.transaction.Token;
 import org.unicitylabs.sdk.util.verification.VerificationResult;
 import org.unicitylabs.sdk.util.verification.VerificationStatus;
 
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.List;
 import java.util.function.Consumer;
 
@@ -31,25 +28,21 @@ private CertifiedMintTransactionVerificationRule() {
   /**
    * Verify a certified mint transaction.
    *
-   * @param trustBase root trust base
-   * @param predicateVerifier predicate verifier
-   * @param mintJustificationVerifier mint justification verifier
    * @param transaction certified mint transaction to verify
+   * @param context shared verification context (trust base + registries)
    * @param nestedTokenCollector collector receiving tokens embedded in the mint justification that
    *     the caller must verify
    *
    * @return verification result with child results for each validation step
    */
   public static VerificationResult<VerificationStatus> verify(
-          RootTrustBase trustBase,
-          PredicateVerifierService predicateVerifier,
-          MintJustificationVerifierService mintJustificationVerifier,
           CertifiedMintTransaction transaction,
+          VerificationContext context,
           Consumer<Token> nestedTokenCollector
   ) {
     List<VerificationResult<?>> results = new ArrayList<>();
 
-    if (!transaction.getNetworkId().equals(trustBase.getNetworkId())) {
+    if (!transaction.getNetworkId().equals(context.getTrustBase().getNetworkId())) {
       results.add(new VerificationResult<>("MintNetworkMatchesTrustBaseRule", VerificationStatus.FAIL));
       return new VerificationResult<>("CertifiedMintTransactionVerificationRule",
               VerificationStatus.FAIL, "Mint network does not match trust base.", results);
@@ -74,15 +67,26 @@ public static VerificationResult<VerificationStatus> verify(
               VerificationStatus.FAIL, "Invalid lock script", results);
     }
 
-    result = InclusionProofVerificationRule.verify(trustBase, predicateVerifier,
-            transaction.getInclusionProof(), transaction);
+    result = InclusionProofVerificationRule.verify(context.getTrustBase(),
+            context.getPredicateVerifier(), transaction.getInclusionProof(), transaction);
     results.add(result);
     if (result.getStatus() != InclusionProofVerificationStatus.OK) {
       return new VerificationResult<>("CertifiedMintTransactionVerificationRule",
               VerificationStatus.FAIL, "Inclusion proof verification failed", results);
     }
 
-    result = mintJustificationVerifier.verify(transaction, nestedTokenCollector);
+    result = context.getTokenIssuanceVerifier().verify(transaction);
+    results.add(result);
+    if (result.getStatus() != VerificationStatus.OK) {
+      return new VerificationResult<>(
+              "CertifiedMintTransactionVerificationRule",
+              VerificationStatus.FAIL,
+              "Invalid token issuance",
+              results
+      );
+    }
+
+    result = context.getMintJustificationVerifier().verify(transaction, nestedTokenCollector);
     results.add(result);
     if (result.getStatus() != VerificationStatus.OK) {
       return new VerificationResult<>(

src/main/java/org/unicitylabs/sdk/transaction/verification/CertifiedTransferTransactionVerificationRule.java

@@ -1,7 +1,5 @@
 package org.unicitylabs.sdk.transaction.verification;
 
-import org.unicitylabs.sdk.api.bft.RootTrustBase;
-import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
 import org.unicitylabs.sdk.transaction.CertifiedTransferTransaction;
 import org.unicitylabs.sdk.util.verification.VerificationResult;
 import org.unicitylabs.sdk.util.verification.VerificationStatus;
@@ -22,20 +20,18 @@ private CertifiedTransferTransactionVerificationRule() {
   /**
    * Verify a certified transfer transaction against the previous transaction.
    *
-   * @param trustBase root trust base used for inclusion proof verification
-   * @param predicateVerifier predicate verifier used by inclusion proof verification
    * @param transaction certified transfer transaction to verify
+   * @param context shared verification context (trust base + registries)
    *
    * @return verification result with child results for each validation step
    */
   public static VerificationResult<VerificationStatus> verify(
-          RootTrustBase trustBase,
-          PredicateVerifierService predicateVerifier,
-          CertifiedTransferTransaction transaction) {
+          CertifiedTransferTransaction transaction,
+          VerificationContext context) {
     ArrayList<VerificationResult<?>> results = new ArrayList<VerificationResult<?>>();
 
-    VerificationResult<?> result = InclusionProofVerificationRule.verify(trustBase,
-            predicateVerifier, transaction.getInclusionProof(), transaction);
+    VerificationResult<?> result = InclusionProofVerificationRule.verify(context.getTrustBase(),
+            context.getPredicateVerifier(), transaction.getInclusionProof(), transaction);
     results.add(result);
     if (result.getStatus() != InclusionProofVerificationStatus.OK) {
       return new VerificationResult<>("CertifiedTransferTransactionVerificationRule",

src/main/java/org/unicitylabs/sdk/transaction/verification/CertifiedUnicityIdMintTransactionVerificationRule.java

@@ -1,9 +1,7 @@
 package org.unicitylabs.sdk.transaction.verification;
 
-import org.unicitylabs.sdk.api.bft.RootTrustBase;
 import org.unicitylabs.sdk.predicate.EncodedPredicate;
 import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
-import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
 import org.unicitylabs.sdk.unicityid.CertifiedUnicityIdMintTransaction;
 import org.unicitylabs.sdk.util.verification.VerificationResult;
 import org.unicitylabs.sdk.util.verification.VerificationStatus;
@@ -24,23 +22,21 @@ private CertifiedUnicityIdMintTransactionVerificationRule() {
   /**
    * Verify the certified unicity id mint transaction.
    *
-   * @param trustBase root trust base
-   * @param predicateVerifier predicate verifier
    * @param genesis certified unicity id mint transaction to verify
+   * @param context shared verification context (trust base + registries)
    * @param issuerPublicKey expected issuer public key, or {@code null} to skip the lock-script
    *     issuer check (e.g., when minting a fresh token where no external issuer is being asserted)
    *
    * @return verification result
    */
   public static VerificationResult<VerificationStatus> verify(
-          RootTrustBase trustBase,
-          PredicateVerifierService predicateVerifier,
           CertifiedUnicityIdMintTransaction genesis,
+          VerificationContext context,
           byte[] issuerPublicKey
   ) {
     List<VerificationResult<?>> results = new ArrayList<>();
 
-    if (!genesis.getNetworkId().equals(trustBase.getNetworkId())) {
+    if (!genesis.getNetworkId().equals(context.getTrustBase().getNetworkId())) {
       results.add(new VerificationResult<>("MintNetworkMatchesTrustBaseRule",
               VerificationStatus.FAIL));
       return new VerificationResult<>(
@@ -71,8 +67,8 @@ public static VerificationResult<VerificationStatus> verify(
     }
 
     VerificationResult<InclusionProofVerificationStatus> result = InclusionProofVerificationRule.verify(
-            trustBase,
-            predicateVerifier,
+            context.getTrustBase(),
+            context.getPredicateVerifier(),
             genesis.getInclusionProof(),
             genesis
     );

src/main/java/org/unicitylabs/sdk/transaction/verification/TokenIssuanceVerifier.java

@@ -0,0 +1,34 @@
+package org.unicitylabs.sdk.transaction.verification;
+
+import org.unicitylabs.sdk.transaction.CertifiedMintTransaction;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.util.verification.VerificationResult;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+
+/**
+ * Application-supplied policy for tokens of a single {@link TokenType}. Plugged into
+ * {@link TokenIssuanceVerifierService}, which dispatches by token type and decides whether a
+ * token's genesis data is acceptable for its type.
+ *
+ * <p>Registering a policy is an application trust decision: cryptographic certification alone
+ * does not authorize an issuance, so a payment consumer should verify both the payload structure
+ * and its own issuance policy here.
+ */
+public interface TokenIssuanceVerifier {
+
+  /**
+   * Get the token type this policy applies to.
+   *
+   * @return token type
+   */
+  TokenType getTokenType();
+
+  /**
+   * Verify the genesis data and any application-level issuance policy.
+   *
+   * @param transaction genesis mint transaction to verify
+   *
+   * @return verification result
+   */
+  VerificationResult<VerificationStatus> verify(CertifiedMintTransaction transaction);
+}