fix(identity): choose signing keys Platform accepts on protocol 14

docs/user-stories.md

@@ -850,6 +850,15 @@ As a user, I want to remove an identity from this device from the identity's own
 
 ---
 
+### IDN-024: Signing avoids keys that cannot sign [Implemented]
+**Persona:** Alex, Priya
+
+As a user, I want the app to sign with a key that can actually sign the action, so that my actions are not refused because of an expired, used-up or out-of-scope key.
+
+- Automatic key choice skips disabled and expired keys, keys limited to other contracts or document types, and keys bound to a contract group.
+- Only keys this device holds the private key of are chosen; among those, one without limits is preferred over a limited one.
+- Where the user picks the key, limited and expired keys stay selectable, and the key chooser shows a warning explaining the limit. Keys bound to another contract or document type are not offered.
+
 ## DPNS (DPN)
 
 ### DPN-001: Register a username [Implemented]
@@ -1109,7 +1118,8 @@ As a user, I want to view past payments sent and received through DashPay so tha
 
 As an everyday user, I want to generate a DashPay QR code so that someone nearby can scan it to add me as a contact or send a payment.
 
-- QR code encodes DashPay profile or payment info.
+- The QR code is a DashPay contact code in the standard DashPay format (DIP-15), so other DashPay wallets can scan it. It shows the identity's username and works for one hour.
+- Scanning another wallet's contact QR code sends that contact a request it can accept automatically. An expired or unreadable code is refused before anything is sent.
 
 ### DPY-009: Edit contact info [Implemented]
 **Persona:** Alex, Priya

src/backend_task/dashpay.rs

@@ -4,8 +4,6 @@ use crate::context::AppContext;
 use dash_sdk::Sdk;
 use std::sync::Arc;
 
-pub mod auto_accept_handler;
-pub mod auto_accept_proof;
 pub mod avatar_processing;
 pub mod contact_info;
 pub mod contact_requests;
@@ -85,12 +83,12 @@ pub enum DashPayTask {
         to_username: String,
         account_label: Option<String>,
     },
+    /// Send a contact request to the owner of a scanned contact QR code,
+    /// carrying the auto-accept proof its key signs.
     SendContactRequestWithProof {
         identity: QualifiedIdentity,
         signing_key: IdentityPublicKey,
-        to_identity_id: Identifier,
-        account_label: Option<String>,
-        qr_auto_accept: crate::backend_task::dashpay::auto_accept_proof::AutoAcceptProofData,
+        qr: crate::model::dashpay::ContactQr,
     },
     AcceptContactRequest {
         identity: QualifiedIdentity,
@@ -138,13 +136,11 @@ pub enum DashPayTask {
     DetectIncomingContactPayments {
         outputs: Vec<crate::model::dashpay::DetectedIncomingOutput>,
     },
-    /// Build an auto-accept contact QR payload. Resolves the ENCRYPTION key and
-    /// derives the auto-accept key through the JIT chokepoint in the backend, so
-    /// the UI never reads a seed.
+    /// Build the identity's contact QR code through upstream platform-wallet;
+    /// the wallet seed is read through the secret seam in the backend, so the
+    /// UI never reads a seed.
     GenerateAutoAcceptQrCode {
         identity: QualifiedIdentity,
-        account_reference: u32,
-        validity_hours: u32,
     },
 }
 
@@ -206,18 +202,15 @@ impl AppContext {
             DashPayTask::SendContactRequestWithProof {
                 identity,
                 signing_key,
-                to_identity_id,
-                account_label,
-                qr_auto_accept,
+                qr,
             } => Ok(contact_requests::send_contact_request_with_proof(
                 self,
                 sdk,
                 identity,
                 signing_key,
-                to_identity_id
-                    .to_string(dash_sdk::dpp::platform_value::string_encoding::Encoding::Base58),
-                account_label,
-                Some(qr_auto_accept),
+                qr.dpns_name(),
+                None,
+                Some(qr),
             )
             .await?),
             DashPayTask::AcceptContactRequest {
@@ -375,20 +368,13 @@ impl AppContext {
                     ))
                 }
             }
-            DashPayTask::GenerateAutoAcceptQrCode {
-                identity,
-                account_reference,
-                validity_hours,
-            } => {
-                let proof = auto_accept_proof::generate_auto_accept_proof(
-                    &identity,
-                    account_reference,
-                    validity_hours,
-                )
-                .await?;
-                Ok(BackendTaskSuccessResult::DashPayAutoAcceptQrCode(
-                    proof.to_qr_string(),
-                ))
+            DashPayTask::GenerateAutoAcceptQrCode { identity } => {
+                let seed_hash = self.contact_qr_wallet_seed_hash(&identity)?;
+                let uri = self
+                    .wallet_backend()?
+                    .dashpay_build_auto_accept_qr(&identity, seed_hash)
+                    .await?;
+                Ok(BackendTaskSuccessResult::DashPayAutoAcceptQrCode(uri))
             }
         }
     }