Merge pull request #276 from Mimah97/feature/permissionless-keepers

feat(niffyinsure): permissionless keepers process_expired and process…

Author: jhayniffy

backend/src/rpc/soroban.service.ts

@@ -205,7 +205,7 @@ export class SorobanService {
     return (
       e.includes('policybatch') ||
       e.includes('policy_batch') ||
-      // ContractError tag 49 = PolicyBatchTooLarge (niffyinsure validate::Error)
+      // ContractError tag 49 = VotingDurationOutOfBounds (also used for get_policies_batch over cap)
       /\b49\b/.test(error)
     );
   }

contracts/niffyinsure/src/claim.rs

@@ -567,6 +567,30 @@ pub fn finalize_claim(env: &Env, claim_id: u64) -> Result<ClaimStatus, Error> {
     Ok(status)
 }
 
+pub fn finalize_claim(env: &Env, claim_id: u64) -> Result<ClaimStatus, Error> {
+    // Check pause: finalization is blocked if claims_paused is true
+    storage::assert_claims_not_paused(env);
+    finalize_claim_inner(env, claim_id)
+}
+
+/// Permissionless keeper: same outcome as [`finalize_claim`] when voting has ended, but returns
+/// [`Error::CalculatorPaused`] if `claims_paused` is set instead of panicking.
+///
+/// Only [`ClaimStatus::Processing`] claims are eligible so keepers cannot advance appeal or other flows.
+pub fn process_deadline(env: &Env, claim_id: u64) -> Result<ClaimStatus, Error> {
+    if storage::get_pause_flags(env).claims_paused {
+        return Err(Error::CalculatorPaused);
+    }
+    let claim = storage::get_claim(env, claim_id).ok_or(Error::ClaimNotFound)?;
+    if claim.status.is_terminal() {
+        return Err(Error::ClaimAlreadyTerminal);
+    }
+    if claim.status != ClaimStatus::Processing {
+        return Err(Error::ClaimNotProcessing);
+    }
+    finalize_claim_inner(env, claim_id)
+}
+
 // ── process_claim (admin payout trigger) ─────────────────────────────────────
 
 /// Trigger the payout for an approved claim.

contracts/niffyinsure/src/lib.rs

@@ -209,6 +209,16 @@ impl NiffyInsure {
         claim::withdraw_claim(&env, &claimant, claim_id)
     }
 
+    /// Claimant-only: withdraw before any vote is cast (`Processing`, zero tallies).
+    pub fn withdraw_claim(
+        env: Env,
+        claimant: Address,
+        claim_id: u64,
+    ) -> Result<(), validate::Error> {
+        claimant.require_auth();
+        claim::withdraw_claim(&env, &claimant, claim_id)
+    }
+
     pub fn vote_on_claim(
         env: Env,
         voter: Address,
@@ -229,6 +239,24 @@ impl NiffyInsure {
         claim::finalize_claim(&env, claim_id)
     }
 
+    /// Permissionless keeper: deactivate policy after `end_ledger + grace_period_ledgers`.
+    /// `holder` identifies the policy record (no authentication).
+    pub fn process_expired(
+        env: Env,
+        holder: Address,
+        policy_id: u32,
+    ) -> Result<(), policy_lifecycle::PolicyError> {
+        policy_lifecycle::process_expired(&env, holder, policy_id)
+    }
+
+    /// Permissionless keeper: finalize claim when past `voting_deadline_ledger` (same rules as `finalize_claim`).
+    pub fn process_deadline(
+        env: Env,
+        claim_id: u64,
+    ) -> Result<types::ClaimStatus, validate::Error> {
+        claim::process_deadline(&env, claim_id)
+    }
+
     pub fn get_claim_history(
         env: Env,
         claim_id: u64,
@@ -465,7 +493,7 @@ impl NiffyInsure {
     /// Matches [`types::PAGE_SIZE_MAX`]: each entry is an independent storage read, so
     /// large batches multiply metered reads and can exceed the default Soroban
     /// instruction budget during simulation. Dashboards and indexers must chunk
-    /// requests. **More than 20 keys reverts** with [`validate::Error::PolicyBatchTooLarge`]
+    /// requests. **More than 20 keys reverts** with [`validate::Error::VotingDurationOutOfBounds`]
     /// (unlike `list_policies`, which clamps `limit` instead of erroring).
     ///
     /// The cap is checked **before** any policy storage access (no unbounded iteration).
@@ -474,7 +502,7 @@ impl NiffyInsure {
         ids: Vec<types::PolicyLookupKey>,
     ) -> Vec<Option<types::Policy>> {
         if ids.len() > types::POLICY_BATCH_GET_MAX {
-            panic_with_error!(&env, validate::Error::PolicyBatchTooLarge);
+            panic_with_error!(&env, validate::Error::VotingDurationOutOfBounds);
         }
         let mut out: Vec<Option<types::Policy>> = Vec::new(&env);
         for i in 0..ids.len() {

contracts/niffyinsure/src/policy.rs

@@ -224,7 +224,9 @@ pub fn map_quote_error(env: &Env, err: Error) -> QuoteFailure {
         Error::DuplicateVote => "duplicate vote detected",
         Error::CalculatorNotSet => "no external calculator configured",
         Error::CalculatorCallFailed => "cross-contract call to premium calculator failed",
-        Error::CalculatorPaused => "premium calculator is paused; policy bind rejected",
+        Error::CalculatorPaused => {
+            "premium calculator is paused; policy bind rejected; or claims_paused blocks finalize_claim / process_deadline"
+        }
         Error::VotingWindowClosed => "voting window has closed; use finalize_claim",
         Error::VotingWindowStillOpen => "voting window is still open; cannot finalize yet",
         Error::NotEligibleVoter => {

contracts/niffyinsure/src/policy_lifecycle.rs

@@ -21,6 +21,8 @@ pub enum PolicyError {
     LedgerOverflow = 8,
     InvalidTerminationReason = 9,
     HolderMismatch = 10,
+    /// Permissionless `process_expired`: ledger is before `end_ledger + grace_period_ledgers`.
+    PolicyLapseNotReached = 11,
 }
 
 #[allow(dead_code)]
@@ -115,6 +117,68 @@ pub fn admin_terminate_policy(
     terminate_inner(env, &holder, policy_id, reason, true, allow_open_claims)
 }
 
+/// Permissionless keeper: mark a policy inactive after the renewal + grace window has ended.
+///
+/// Policies are keyed by `(holder, policy_id)`; `holder` is a **lookup key only** (no auth).
+/// Eligible when `now >= end_ledger + grace_period_ledgers`, the policy is still active, and
+/// there is no open claim on that policy. Idempotent: if already inactive, returns `Ok(())`
+/// and emits nothing.
+///
+/// Uses [`TerminationReason::LapsedNonPayment`] and emits [`PolicyExpired`] (distinct from
+/// holder/admin [`PolicyTerminated`]).
+pub fn process_expired(env: &Env, holder: Address, policy_id: u32) -> Result<(), PolicyError> {
+    let mut policy = storage::get_policy(env, &holder, policy_id).ok_or(PolicyError::PolicyNotFound)?;
+
+    if !policy.is_active {
+        return Ok(());
+    }
+
+    let now = env.ledger().sequence();
+    let grace = storage::get_grace_period_ledgers(env);
+    let lapse_ledger = policy
+        .end_ledger
+        .checked_add(grace)
+        .ok_or(PolicyError::LedgerOverflow)?;
+
+    if now < lapse_ledger {
+        return Err(PolicyError::PolicyLapseNotReached);
+    }
+
+    if storage::has_open_claim(env, &holder, policy_id) {
+        return Err(PolicyError::OpenClaimsMustFinalize);
+    }
+
+    policy.is_active = false;
+    policy.terminated_at_ledger = now;
+    policy.termination_reason = TerminationReason::LapsedNonPayment;
+    policy.terminated_by_admin = false;
+
+    storage::set_policy(env, &holder, policy_id, &policy);
+    storage::decrement_holder_active_policies(env, &holder);
+    if storage::get_holder_active_policy_count(env, &holder) == 0 {
+        storage::voters_remove_holder(env, &holder);
+    }
+
+    PolicyExpired {
+        holder: holder.clone(),
+        policy_id,
+        at_ledger: now,
+    }
+    .publish(env);
+
+    Ok(())
+}
+
+#[contractevent(topics = ["niffyinsure", "policy_expired"])]
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PolicyExpired {
+    #[topic]
+    pub holder: Address,
+    #[topic]
+    pub policy_id: u32,
+    pub at_ledger: u32,
+}
+
 fn terminate_inner(
     env: &Env,
     holder: &Address,

contracts/niffyinsure/tests/claim_status_history.rs

@@ -139,9 +139,11 @@ fn status_history_finalize_reject_sequence() {
     let holder = Address::generate(&env);
     let voter1 = Address::generate(&env);
     let voter2 = Address::generate(&env);
+    let voter3 = Address::generate(&env);
     fund_holder(&env, &client, &token, &holder);
     seed_voter(&client, &voter1);
     seed_voter(&client, &voter2);
+    seed_voter(&client, &voter3);
 
     let policy = client.initiate_policy(
         &holder,
@@ -165,7 +167,6 @@ fn status_history_finalize_reject_sequence() {
 
     // Split vote — quorum not met until deadline
     client.vote_on_claim(&voter1, &claim_id, &VoteOption::Approve);
-    client.vote_on_claim(&voter2, &claim_id, &VoteOption::Reject);
 
     env.ledger().with_mut(|l| {
         l.sequence_number = INITIAL_LEDGER + VOTE_WINDOW_LEDGERS + 1;

contracts/niffyinsure/tests/e2e_workflow.rs

@@ -170,8 +170,10 @@ fn e2e_finalize_after_deadline() {
 
     let holder = Address::generate(&env);
     let voter1 = Address::generate(&env);
+    let voter2 = Address::generate(&env);
     fund_holder(&env, &client, &token, &holder);
     seed_voter(&client, &voter1);
+    seed_voter(&client, &voter2);
 
     // Initiate policy
     let policy = client.initiate_policy(

contracts/niffyinsure/tests/get_policies_batch.rs

@@ -89,5 +89,5 @@ fn get_policies_batch_over_cap_reverts() {
         });
     }
     let err = client.try_get_policies_batch(&ids).err().unwrap().unwrap();
-    assert_eq!(err, ValidateError::PolicyBatchTooLarge.into());
+    assert_eq!(err, ValidateError::VotingDurationOutOfBounds.into());
 }