CleanverseIdentityRegistry.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
import {IIdentityRegistry} from "./interfaces/IIdentityRegistry.sol";
import {ICleanverseAPass, IAPassComplianceValidator} from "./interfaces/ICleanverseAPass.sol";

/// @title CleanverseIdentityRegistry
/// @notice Covenant's production identity source: it reads Cleanverse CVI directly
///         on-chain and holds no identity state of its own.
///
///         This replaces an earlier design in which an off-chain relayer polled
///         `query_apass` and mirrored the answer into storage. That design existed
///         because of a wrong assumption — that CVI had no on-chain read surface. It
///         does. `getAPassData` on the CVI registry returns status, tier, subTier,
///         group, subGroup and expiry for any wallet, and `generate_apass` writes
///         through to that same contract. So the relayer's oracle key, its liveness,
///         and its staleness window are all removed from the trust path: a Covenant
///         gate now fails exactly when Cleanverse says the wallet is not compliant,
///         in the same transaction, with no third party in between.
///
///         Every path fails closed. An A-Pass that is missing, inactive, expired, or
///         whose read reverts for any reason at all resolves to "not verified" rather
///         than propagating a revert — a compliance gate that goes down should deny,
///         not brick the contracts that depend on it.
contract CleanverseIdentityRegistry is Ownable, IIdentityRegistry {
    /// @notice Cleanverse's A-Pass registry. Immutable: repointing the identity source
    ///         of a live desk should be a redeploy, not an owner call.
    ICleanverseAPass public immutable apass;

    /// @notice Cleanverse's rule engine. Optional and owner-settable, because a
    ///         contract can only be registered as a pool AFTER it has an address, so
    ///         this cannot be wired in the constructor. While unset, verification uses
    ///         the raw A-Pass fields below. Once set, Cleanverse's own RuleV2 for this
    ///         pool must ALSO pass — the rule can tighten the gate, never loosen it.
    IAPassComplianceValidator public validator;

    uint256 private constant STATUS_ACTIVE = 1;

    event ValidatorChanged(address indexed validator);

    constructor(address apassAddr) Ownable(msg.sender) {
        apass = ICleanverseAPass(apassAddr);
    }

    function setValidator(address validatorAddr) external onlyOwner {
        validator = IAPassComplianceValidator(validatorAddr);
        emit ValidatorChanged(validatorAddr);
    }

    // ---------------------------------------------------------------------
    // IIdentityRegistry
    // ---------------------------------------------------------------------

    function isVerified(address subject) public view returns (bool) {
        (bool ok, ICleanverseAPass.APassData memory data) = _read(subject);
        if (!ok) return false;
        if (data.status != STATUS_ACTIVE) return false;
        if (block.timestamp >= data.expirationTime) return false;

        if (address(validator) != address(0) && !_ruleSatisfied(subject)) return false;
        return true;
    }

    function tier(address subject) external view returns (uint8) {
        (bool ok, ICleanverseAPass.APassData memory data) = _read(subject);
        return ok ? _toUint8(data.tier) : 0;
    }

    function subTier(address subject) external view returns (uint8) {
        (bool ok, ICleanverseAPass.APassData memory data) = _read(subject);
        return ok ? _toUint8(data.subTier) : 0;
    }

    /// @notice Cleanverse's jurisdiction `group`, narrowed to the uint16 the rest of
    ///         Covenant speaks. Sandbox-issued passes currently carry an empty group,
    ///         which lands here as 0 — and 0 is exactly what Covenant's jurisdiction
    ///         gate treats as "unconstrained", so the gate stays honestly disabled
    ///         instead of matching against a value that was never populated.
    function jurisdiction(address subject) external view returns (uint16) {
        (bool ok, ICleanverseAPass.APassData memory data) = _read(subject);
        return ok ? uint16(bytes2(data.group)) : 0;
    }

    // ---------------------------------------------------------------------
    // Extended reads
    // ---------------------------------------------------------------------

    /// @notice The full live A-Pass, for surfaces that want to show what Cleanverse
    ///         actually holds. `found` is false for a wallet with no pass; the struct
    ///         is then zeroed rather than reverting.
    function apassOf(address subject) external view returns (bool found, ICleanverseAPass.APassData memory data) {
        return _read(subject);
    }

    // ---------------------------------------------------------------------
    // Internals
    // ---------------------------------------------------------------------

    function _read(address subject) internal view returns (bool, ICleanverseAPass.APassData memory) {
        try apass.getAPassData(subject) returns (ICleanverseAPass.APassData memory data) {
            return (true, data);
        } catch {
            ICleanverseAPass.APassData memory empty;
            return (false, empty);
        }
    }

    function _ruleSatisfied(address subject) internal view returns (bool) {
        try validator.complianceVerify(address(this), subject) returns (bool allowed) {
            return allowed;
        } catch {
            return false;
        }
    }

    /// @dev Cleanverse documents tier and subTier as 0-99. Anything outside that range
    ///      resolves to 0 rather than being truncated: `uint8(300)` would silently
    ///      become 44 and land in a real pricing band, whereas 0 matches no band and
    ///      blocks origination. An unreadable value must deny, not guess.
    function _toUint8(uint256 value) internal pure returns (uint8) {
        return value > 99 ? 0 : uint8(value);
    }
}