Merge pull request #292 from ComputerOracle/feature/automated-compliance-checks

feat: implement automated compliance checks

Author: Mystery-CLI

contract/src/errors.rs

@@ -4,10 +4,112 @@ use soroban_sdk::contracterror;
 #[derive(Copy, Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
 #[repr(u32)]
 pub enum ContractError {
+    // Core (1–10)
     AlreadyInitialized = 1,
     NotInitialized = 2,
     InvalidAmount = 3,
     InvalidFeeBps = 4,
+    Overflow = 5,
+    Unauthorized = 6,
+    ContractPaused = 7,
+    InvalidStatus = 8,
+    TradeNotFound = 9,
+    ArbitratorNotRegistered = 10,
+
+    // Compliance (11–15)
+    KycNotVerified = 11,
+    AmlNotCleared = 12,
+    JurisdictionRestricted = 13,
+    TradeAmountLimitExceeded = 14,
+    ComplianceDataMissing = 15,
+
+    // Fees / Tiers (16–20)
+    NoFeesToWithdraw = 16,
+    InvalidTierConfig = 17,
+    TierNotFound = 18,
+    InvalidMetadata = 19,
+    MetadataValueTooLong = 20,
+
+    // Templates (21–26)
+    TemplateNotFound = 21,
+    TemplateInactive = 22,
+    TemplateNameTooLong = 23,
+    TemplateVersionLimitExceeded = 24,
+    TemplateAmountMismatch = 25,
+    InvalidExpiry = 26,
+
+    // Arbitrator reputation (27–30)
+    InvalidRating = 27,
+    AlreadyRated = 28,
+    NoArbitrator = 29,
+    TradeExpired = 30,
+    TradeNotExpired = 31,
+    InvalidSplitBps = 32,
+
+    // Subscriptions (33–36)
+    SubscriptionNotFound = 33,
+    SubscriptionExpired = 34,
+    SubscriptionAlreadyActive = 35,
+
+    // Governance (36–43)
+    ProposalNotFound = 36,
+    ProposalNotActive = 37,
+    AlreadyVoted = 38,
+    InsufficientVotingPower = 39,
+    ProposalNotPassed = 40,
+    ProposalAlreadyExecuted = 41,
+    VotingEnded = 42,
+
+    // Privacy (43–45)
+    PrivacyDataTooLong = 43,
+    DisclosureGrantNotFound = 44,
+    DisclosureUnauthorized = 45,
+
+    // Migration / Bridge (46–51)
+    MigrationAlreadyApplied = 46,
+    MigrationVersionMismatch = 47,
+    BridgeOracleNotSet = 48,
+    BridgeTradeExpired = 49,
+    BridgeTradeNotExpired = 50,
+
+    // Insurance (51–55)
+    InsuranceProviderNotRegistered = 51,
+    InsurancePremiumTooHigh = 52,
+    TradeNotInsured = 53,
+    InsuranceAlreadyClaimed = 54,
+    InsuranceClaimNotEligible = 55,
+
+    // Oracle (60–64)
+    OracleNotFound = 60,
+    OracleAlreadyRegistered = 61,
+    OracleListFull = 62,
+    OracleUnavailable = 63,
+    OraclePriceInvalid = 64,
+
+    // AMM (70–74)
+    AmmPoolNotFound = 70,
+    AmmSlippageExceeded = 71,
+    AmmInsufficientShares = 72,
+    AmmInvalidPair = 73,
+    AmmPoolAlreadyExists = 74,
+
+    // Upgrade (80–85)
+    UpgradeInProgress = 80,
+    NoUpgradeProposal = 81,
+    UpgradeTimelockActive = 82,
+    NoUpgradeInProgress = 83,
+    RollbackWindowExpired = 84,
+
+    // Multi-sig arbitration (90–94)
+    InvalidMultiSigConfig = 90,
+    VotingExpired = 91,
+    VotingNotExpired = 92,
+    NoConsensus = 93,
+
+    // Social (95–96)
+    CannotFollowSelf = 95,
+    NotFollowing = 96,
+}
     KycNotVerified = 5,
     AmlNotCleared = 6,
     JurisdictionRestricted = 7,
@@ -123,4 +225,4 @@ pub enum ContractError {
     // Social feature errors (70-74)
     CannotFollowSelf = 70,
     NotFollowing = 71,
-}
+}

contract/src/events.rs

@@ -165,6 +165,38 @@ pub fn emit_trade_created(env: &Env, trade_id: u64, seller: Address, buyer: Addr
     env.events().publish((cat_trade(), symbol_short!("created")), EvTradeCreated { v: EVENT_VERSION, trade_id, seller, buyer, amount, currency });
 }
 
+// ---------------------------------------------------------------------------
+// Compliance events
+// ---------------------------------------------------------------------------
+
+fn cat_compliance() -> Symbol { symbol_short!("compl") }
+
+#[contracttype] #[derive(Clone, Debug)]
+pub struct EvComplianceFailed { pub v: u32, pub user: Address, pub reason: String }
+#[contracttype] #[derive(Clone, Debug)]
+pub struct EvCompliancePassed { pub v: u32, pub trade_id: u64, pub seller: Address, pub buyer: Address, pub amount: u64 }
+#[contracttype] #[derive(Clone, Debug)]
+pub struct EvComplianceUpdated { pub v: u32, pub user: Address }
+
+pub fn emit_compliance_failed(env: &Env, user: Address, reason: &String) {
+    env.events().publish(
+        (cat_compliance(), symbol_short!("failed")),
+        EvComplianceFailed { v: EVENT_VERSION, user, reason: reason.clone() },
+    );
+}
+
+pub fn emit_compliance_passed(env: &Env, trade_id: u64, seller: Address, buyer: Address, amount: u64) {
+    env.events().publish(
+        (cat_compliance(), symbol_short!("passed")),
+        EvCompliancePassed { v: EVENT_VERSION, trade_id, seller, buyer, amount },
+    );
+}
+
+pub fn emit_compliance_updated(env: &Env, user: Address) {
+    env.events().publish(
+        (cat_compliance(), symbol_short!("updated")),
+        EvComplianceUpdated { v: EVENT_VERSION, user },
+    );
 pub fn emit_compliance_failed(env: &Env, user: Address, reason: &soroban_sdk::String) {
     env.events().publish((cat_sys(), symbol_short!("compl_fail")), EvComplianceFailed { v: EVENT_VERSION, user, reason: reason.clone() });
 }

contract/src/lib.rs

@@ -141,27 +141,49 @@ fn require_admin(env: &Env, admin: &Address) -> Result<(), ContractError> {
 }
 
 fn validate_user_compliance(env: &Env, user: &Address, amount: u64) -> Result<(), ContractError> {
-    let comp = storage::get_user_compliance(env, user).ok_or(ContractError::KycNotVerified)?;
+    let comp = storage::get_user_compliance(env, user)
+        .ok_or(ContractError::ComplianceDataMissing)?;
+
     if comp.kyc_status != crate::types::KycStatus::Verified {
-        events::emit_compliance_failed(env, user.clone(), &soroban_sdk::String::from_str(env, "KYC_NOT_VERIFIED"));
+        events::emit_compliance_failed(
+            env,
+            user.clone(),
+            &soroban_sdk::String::from_str(env, "KYC_NOT_VERIFIED"),
+        );
         return Err(ContractError::KycNotVerified);
     }
     if !comp.aml_cleared {
-        events::emit_compliance_failed(env, user.clone(), &soroban_sdk::String::from_str(env, "AML_NOT_CLEARED"));
+        events::emit_compliance_failed(
+            env,
+            user.clone(),
+            &soroban_sdk::String::from_str(env, "AML_NOT_CLEARED"),
+        );
         return Err(ContractError::AmlNotCleared);
     }
     if !storage::is_jurisdiction_allowed(env, &comp.jurisdiction) {
-        events::emit_compliance_failed(env, user.clone(), &soroban_sdk::String::from_str(env, "JURISDICTION_BLOCKED"));
+        events::emit_compliance_failed(
+            env,
+            user.clone(),
+            &soroban_sdk::String::from_str(env, "JURISDICTION_BLOCKED"),
+        );
         return Err(ContractError::JurisdictionRestricted);
     }
     let user_limit = storage::get_user_trade_limit(env, user);
     if user_limit > 0 && amount > user_limit {
-        events::emit_compliance_failed(env, user.clone(), &soroban_sdk::String::from_str(env, "USER_LIMIT_EXCEEDED"));
+        events::emit_compliance_failed(
+            env,
+            user.clone(),
+            &soroban_sdk::String::from_str(env, "USER_LIMIT_EXCEEDED"),
+        );
         return Err(ContractError::TradeAmountLimitExceeded);
     }
     let global_limit = storage::get_global_trade_limit(env);
     if amount > global_limit {
-        events::emit_compliance_failed(env, user.clone(), &soroban_sdk::String::from_str(env, "GLOBAL_LIMIT_EXCEEDED"));
+        events::emit_compliance_failed(
+            env,
+            user.clone(),
+            &soroban_sdk::String::from_str(env, "GLOBAL_LIMIT_EXCEEDED"),
+        );
         return Err(ContractError::TradeAmountLimitExceeded);
     }
     Ok(())
@@ -389,6 +411,7 @@ impl StellarEscrowContract {
         require_not_paused(&env)?;
         require_admin(&env, &admin)?;
         storage::save_user_compliance(&env, &user, &compliance);
+        events::emit_compliance_updated(&env, user);
         Ok(())
     }
 

contract/src/test.rs

@@ -25,6 +25,16 @@ fn setup() -> (Env, Address, Address, Address, Address, Address, StellarEscrowCo
     let client = StellarEscrowContractClient::new(&env, &contract_id);
     client.initialize(&admin, &token_addr, &100u32); // 1% fee
 
+    // Default compliance: all participants verified, US jurisdiction
+    let compliant = crate::types::UserCompliance {
+        kyc_status: crate::types::KycStatus::Verified,
+        aml_cleared: true,
+        jurisdiction: soroban_sdk::String::from_str(&env, "US"),
+    };
+    client.set_user_compliance(&admin, &seller, &compliant);
+    client.set_user_compliance(&admin, &buyer, &compliant);
+    client.set_user_compliance(&admin, &arbitrator, &compliant);
+
     (env, token_addr, admin, seller, buyer, arbitrator, client)
 }
 

indexer/src/compliance_service/mod.rs

@@ -111,12 +111,23 @@ impl ComplianceService {
         let trade_id = data.get("trade_id")?.as_u64();
         let seller = data.get("seller")?.as_str()?.to_string();
         let buyer = data.get("buyer")?.as_str()?.to_string();
+        let amount = data.get("amount").and_then(|v| v.as_u64()).unwrap_or(0);
 
         let (seller_check, buyer_check) = tokio::join!(
             self.check_address(&seller, trade_id),
             self.check_address(&buyer, trade_id),
         );
 
+        // Enforce trade amount limits
+        if amount > self.config.max_trade_amount && self.config.max_trade_amount > 0 {
+            tracing::warn!(
+                trade_id = ?trade_id,
+                amount,
+                limit = self.config.max_trade_amount,
+                "Trade amount exceeds configured limit"
+            );
+        }
+
         // Emit compliance event if either party is blocked
         if seller_check.status == ComplianceStatus::Blocked
             || buyer_check.status == ComplianceStatus::Blocked

indexer/src/config.rs

@@ -54,6 +54,9 @@ pub struct ComplianceConfig {
     pub blocked_jurisdictions: Vec<String>,
     #[serde(default)]
     pub reporting_webhook_url: String,
+    /// Maximum allowed trade amount in stroops (0 = unlimited)
+    #[serde(default)]
+    pub max_trade_amount: u64,
 }
 
 fn default_kyc_level() -> u8 { 1 }