feat: validate transfer recipient party

config.e2e-local.yaml

@@ -87,6 +87,7 @@ token:
       symbol: "USDCx"
       decimals: 6
       instrument_id: "USDCx"
+      external_transfer: true
 
 # Ethereum JSON-RPC facade (MetaMask compatibility)
 eth_rpc:

pkg/app/api/server.go

@@ -297,7 +297,9 @@ func initServices(
 		g.Go(func() error { return sub.Start(gCtx) })
 	}
 
-	transferSvc := transfer.NewTransferService(cantonClient.Token, userStore, instrumentedCache, cfg.Token, indexerClient)
+	transferSvc := transfer.NewTransferService(
+		cantonClient.Token, userStore, instrumentedCache, cfg.Token, indexerClient, cantonClient.Identity,
+	)
 	return &services{
 		evmStore:     evmStore,
 		tokenService: tokenService,

pkg/cantonsdk/identity/client.go

@@ -34,6 +34,10 @@ type Identity interface {
 	AllocateParty(ctx context.Context, hint string) (*Party, error)
 	AllocateExternalParty(ctx context.Context, hint string, spkiPublicKey []byte, signer ExternalPartyKey) (*Party, error)
 	ListParties(ctx context.Context) ([]*Party, error) // TODO: add iterator
+	// PartyExists reports whether the party id is known to the participant's
+	// topology (which includes parties hosted on other participants connected
+	// to the same synchronizer).
+	PartyExists(ctx context.Context, partyID string) (bool, error)
 	GetParticipantID(ctx context.Context) (string, error)
 
 	CreateFingerprintMapping(ctx context.Context, req CreateFingerprintMappingRequest) (*FingerprintMapping, error)
@@ -250,6 +254,32 @@ func (c *Client) ListParties(ctx context.Context) ([]*Party, error) {
 	return out, nil
 }
 
+// PartyExists reports whether the party id is known to the participant's
+// topology. GetParties omits unknown parties from the response rather than
+// erroring, so existence is a match in the returned details.
+func (c *Client) PartyExists(ctx context.Context, partyID string) (bool, error) {
+	authCtx := c.ledger.AuthContext(ctx)
+
+	resp, err := c.ledger.PartyAdmin().GetParties(authCtx, &adminv2.GetPartiesRequest{
+		Parties: []string{partyID},
+	})
+	if err != nil {
+		// A malformed party id string is rejected with InvalidArgument; report it
+		// as non-existent rather than a lookup failure.
+		if st, ok := status.FromError(err); ok && st.Code() == codes.InvalidArgument {
+			return false, nil
+		}
+		return false, fmt.Errorf("error getting party %s: %w", partyID, err)
+	}
+
+	for _, p := range resp.PartyDetails {
+		if p.Party == partyID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 func (c *Client) GetParticipantID(ctx context.Context) (string, error) {
 	authCtx := c.ledger.AuthContext(ctx)
 

pkg/config/defaults/config.api-server.docker.yaml

@@ -91,6 +91,7 @@ token:
       symbol: "USDCx"
       decimals: 6
       instrument_id: "USDCx"
+      external_transfer: true
 
 # Ethereum JSON-RPC facade (MetaMask compatibility)
 eth_rpc:

pkg/config/defaults/config.api-server.local-devnet.yaml

@@ -84,6 +84,7 @@ token:
       symbol: "USDCx"
       decimals: 6
       instrument_id: "USDCx"
+      external_transfer: true
 
 # Ethereum JSON-RPC facade (MetaMask compatibility)
 eth_rpc:

pkg/config/defaults/config.api-server.mainnet.yaml

@@ -67,6 +67,7 @@ token:
       symbol: "USDCx"
       decimals: 6
       instrument_id: "USDCx"
+      external_transfer: true
 
 eth_rpc:
   enabled: true

pkg/config/tests/minimal.api.yaml

@@ -36,6 +36,7 @@ token:
       symbol: "USDCx"
       decimals: 6
       instrument_id: "USDCx"
+      external_transfer: true
 
 eth_rpc:
   chain_id: 31337

pkg/token/config.go

@@ -14,6 +14,10 @@ type ERC20Token struct {
 	Symbol       string `yaml:"symbol" validate:"required"`
 	Decimals     int    `yaml:"decimals" validate:"gte=0,lte=18"`
 	InstrumentID string `yaml:"instrument_id" validate:"required"`
+	// ExternalTransfer marks a token that can be transferred to parties hosted on
+	// external participant nodes (e.g. USDCx). Tokens without it can only be
+	// transferred between parties registered with this middleware.
+	ExternalTransfer bool `yaml:"external_transfer"`
 }
 
 // Config holds token metadata indexed by contract address.