feat(swift-sdk): send, receive and accept DashPay private contact requests

packages/rs-platform-wallet-ffi/src/contact_persistence.rs

@@ -214,6 +214,46 @@ pub struct ContactIgnoredSenderFFI {
     pub is_ignored: bool,
 }
 
+/// One identity's read position in DashPay's private contact request store
+/// ([`ContactChangeSet::private_contact_requests_positions`]), for the
+/// private contact request scan state callbacks on
+/// [`PersistenceCallbacksExtension`](crate::persistence::PersistenceCallbacksExtension).
+///
+/// Flat POD. The host stores one row per `(wallet_id, identity_id)`,
+/// replacing the previous one, and hands it back unchanged at load: a lower
+/// `position` than the stored one is a rewind, not a stale write.
+///
+/// [`ContactChangeSet::private_contact_requests_positions`]: platform_wallet::changeset::ContactChangeSet::private_contact_requests_positions
+#[repr(C)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct PrivateContactRequestsPositionFFI {
+    /// The wallet-owned identity reading the store.
+    pub identity_id: [u8; 32],
+    /// The store position the identity reads from next.
+    pub position: u64,
+    /// The fingerprint of the scanning keys `position` holds for. Opaque
+    /// to the host: store it and return it as it came.
+    pub key_fingerprint: [u8; 32],
+}
+
+/// The shielded address `contact_id`'s tracked private request to
+/// `owner_id` carries ([`ContactChangeSet::private_shielded_addresses`]).
+///
+/// Flat POD. The host stores one row per `(wallet_id, owner_id,
+/// contact_id)`, replacing the previous one.
+///
+/// [`ContactChangeSet::private_shielded_addresses`]: platform_wallet::changeset::ContactChangeSet::private_shielded_addresses
+#[repr(C)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct PrivateShieldedAddressFFI {
+    /// The wallet-owned identity the request is to.
+    pub owner_id: [u8; 32],
+    /// The contact who sent the request.
+    pub contact_id: [u8; 32],
+    /// The raw 43-byte Orchard payment address.
+    pub address: [u8; 43],
+}
+
 // Compile-time guards. Pin the expected layouts so any reshape on
 // the Rust side fails the cargo build before it can ship a dylib
 // the Swift side will mis-parse at runtime.
@@ -268,6 +308,31 @@ const _: [u8; 1] = [0u8; std::mem::align_of::<ContactRequestRemovalFFI>()];
 const _: [u8; 65] = [0u8; std::mem::size_of::<ContactIgnoredSenderFFI>()];
 const _: [u8; 1] = [0u8; std::mem::align_of::<ContactIgnoredSenderFFI>()];
 
+// Expected `PrivateContactRequestsPositionFFI` layout on 64-bit targets:
+//
+//   0..=31    identity_id      [u8; 32]
+//   32..=39   position         u64
+//   40..=71   key_fingerprint  [u8; 32]
+//
+// Total size = 72, alignment = 8 (from the u64).
+const _: [u8; 72] = [0u8; std::mem::size_of::<PrivateContactRequestsPositionFFI>()];
+const _: [u8; 8] = [0u8; std::mem::align_of::<PrivateContactRequestsPositionFFI>()];
+const _: () = assert!(std::mem::offset_of!(PrivateContactRequestsPositionFFI, position) == 32);
+const _: () =
+    assert!(std::mem::offset_of!(PrivateContactRequestsPositionFFI, key_fingerprint) == 40);
+
+// Expected `PrivateShieldedAddressFFI` layout on all targets:
+//
+//   0..=31    owner_id    [u8; 32]
+//   32..=63   contact_id  [u8; 32]
+//   64..=106  address     [u8; 43]
+//
+// Total size = 107, alignment = 1 (all-byte fields).
+const _: [u8; 107] = [0u8; std::mem::size_of::<PrivateShieldedAddressFFI>()];
+const _: [u8; 1] = [0u8; std::mem::align_of::<PrivateShieldedAddressFFI>()];
+const _: () = assert!(std::mem::offset_of!(PrivateShieldedAddressFFI, contact_id) == 32);
+const _: () = assert!(std::mem::offset_of!(PrivateShieldedAddressFFI, address) == 64);
+
 impl ContactIgnoredSenderFFI {
     /// Project an `(owner, sender)` ignore key onto its flat C mirror.
     /// `is_ignored` distinguishes an ignore (persist the row) from an

packages/rs-platform-wallet-ffi/src/dashpay.rs

@@ -190,7 +190,7 @@ impl ContactRequestHandleArray {
     }
 
     /// Copy a slice of contact requests into the global handle storage.
-    fn from_requests(requests: Vec<ContactRequest>) -> Self {
+    pub(crate) fn from_requests(requests: Vec<ContactRequest>) -> Self {
         if requests.is_empty() {
             return Self::empty();
         }
@@ -325,22 +325,9 @@ pub unsafe extern "C" fn platform_wallet_send_contact_request_with_signer(
     } else {
         Some(unwrap_result_or_return!(CStr::from_ptr(account_label).to_str()).to_string())
     };
-    let proof: Option<Vec<u8>> = if auto_accept_proof.is_null() || auto_accept_proof_len == 0 {
-        None
-    } else {
-        // Defense-in-depth: bound the copy at the DIP-15 auto-accept proof
-        // ceiling (102 bytes) BEFORE allocating, so a malformed binding or a
-        // hostile (ptr, len) pair can't force an oversized allocation. The SDK
-        // re-validates the exact 38..=102 range after this.
-        if auto_accept_proof_len > 102 {
-            return crate::error::PlatformWalletFFIResult::err(
-                crate::error::PlatformWalletFFIResultCode::ErrorInvalidParameter,
-                format!(
-                    "auto_accept_proof length {auto_accept_proof_len} exceeds the DIP-15 maximum of 102 bytes"
-                ),
-            );
-        }
-        Some(std::slice::from_raw_parts(auto_accept_proof, auto_accept_proof_len).to_vec())
+    let proof = match read_auto_accept_proof(auto_accept_proof, auto_accept_proof_len) {
+        Ok(proof) => proof,
+        Err(result) => return result,
     };
 
     let signer_addr = signer_handle as usize;
@@ -380,6 +367,31 @@ pub unsafe extern "C" fn platform_wallet_send_contact_request_with_signer(
     PlatformWalletFFIResult::ok()
 }
 
+/// Copy an optional auto-accept proof from `(ptr, len)`; `(null, 0)` omits it.
+///
+/// Defense-in-depth: the copy is bounded at the DIP-15 auto-accept proof
+/// ceiling (102 bytes) BEFORE allocating, so a malformed binding or a hostile
+/// (ptr, len) pair can't force an oversized allocation. The SDK re-validates
+/// the exact 38..=102 range after this.
+///
+/// # Safety
+/// A non-null `ptr` must point to `len` readable bytes.
+pub(crate) unsafe fn read_auto_accept_proof(
+    ptr: *const u8,
+    len: usize,
+) -> Result<Option<Vec<u8>>, PlatformWalletFFIResult> {
+    if ptr.is_null() || len == 0 {
+        return Ok(None);
+    }
+    if len > 102 {
+        return Err(PlatformWalletFFIResult::err(
+            PlatformWalletFFIResultCode::ErrorInvalidParameter,
+            format!("auto_accept_proof length {len} exceeds the DIP-15 maximum of 102 bytes"),
+        ));
+    }
+    Ok(Some(std::slice::from_raw_parts(ptr, len).to_vec()))
+}
+
 /// Send a contact request from a scanned DIP-15 auto-accept QR
 /// (`dash:?du=<username>&dapk=<key_blob>`). Resolves the QR's username to the
 /// owner's identity, decodes the handed auto-accept key, signs the proof over
@@ -1752,6 +1764,84 @@ pub unsafe extern "C" fn platform_wallet_drainable_contact_crypto_count(
 mod tests {
     use super::*;
 
+    mod private_store_scan_errors {
+        use super::*;
+        use platform_wallet::ContactCryptoProvider;
+        use rs_sdk_ffi::{
+            dash_sdk_mnemonic_resolver_create, dash_sdk_mnemonic_resolver_destroy,
+            mnemonic_resolver_result,
+        };
+        use std::ffi::c_void;
+        use std::str::FromStr;
+
+        unsafe extern "C" fn no_mnemonic(
+            _ctx: *const c_void,
+            _wallet_id_bytes: *const u8,
+            _out_buf: *mut c_char,
+            _out_capacity: usize,
+            _out_len: *mut usize,
+        ) -> i32 {
+            mnemonic_resolver_result::NOT_FOUND
+        }
+
+        unsafe extern "C" fn noop_destroy(_ctx: *mut c_void) {}
+
+        /// A scan of the private store whose resolver holds no mnemonic for the
+        /// wallet reaches the host as the key-unavailable outcome (code 31), as
+        /// a signer's missing key does, so the host routes it to key repair
+        /// instead of reading a generic failure.
+        #[test]
+        fn should_report_a_missing_mnemonic_while_scanning_as_key_unavailable() {
+            let resolver = unsafe {
+                dash_sdk_mnemonic_resolver_create(std::ptr::null_mut(), no_mnemonic, noop_destroy)
+            };
+            let provider = unsafe {
+                resolver_contact_crypto_provider(resolver, [0u8; 32], key_wallet::Network::Testnet)
+            };
+            let keys = PrivateDocumentKeyPaths {
+                recipients: vec![(
+                    Identifier::from([0xB0; 32]),
+                    vec![(
+                        2,
+                        key_wallet::bip32::DerivationPath::from_str("m/9'/1'/5'/0'/0'/1'/2'")
+                            .expect("valid path"),
+                    )],
+                )],
+                senders: Vec::new(),
+            };
+            let page = PrivateDocumentEntries {
+                chunk_power: None,
+                entries: Vec::new(),
+                total_count: 0,
+            };
+            let error = runtime()
+                .block_on(provider.scan_private_document_page(
+                    &keys,
+                    Identifier::from([0xD0; 32]),
+                    "privateContactRequest",
+                    0,
+                    &page,
+                ))
+                .expect_err("no mnemonic, no keys");
+            let result = PlatformWalletFFIResult::from(error);
+            assert_eq!(
+                result.code,
+                PlatformWalletFFIResultCode::ErrorSigningKeyUnavailable
+            );
+
+            // Another resolver failure keeps the code it had.
+            let other = PlatformWalletFFIResult::from(private_document_signer_error(
+                MnemonicResolverSignerError::BufferTooSmall,
+            ));
+            assert_ne!(
+                other.code,
+                PlatformWalletFFIResultCode::ErrorSigningKeyUnavailable
+            );
+
+            unsafe { dash_sdk_mnemonic_resolver_destroy(resolver) };
+        }
+    }
+
     /// A test wallet's mnemonic, counting how often the resolver reads it.
     unsafe extern "C" fn counting_resolve(
         ctx: *const std::ffi::c_void,

packages/rs-platform-wallet-ffi/src/lib.rs

@@ -71,6 +71,7 @@ pub mod platform_address_sync;
 pub mod platform_address_types;
 pub mod platform_addresses;
 pub mod platform_wallet_info;
+pub mod private_contact_request;
 pub mod provider_key_at_index;
 mod runtime;
 pub mod secp256k1_primitives;
@@ -156,6 +157,7 @@ pub use platform_address_sync::*;
 pub use platform_address_types::*;
 pub use platform_addresses::*;
 pub use platform_wallet_info::*;
+pub use private_contact_request::*;
 pub use provider_key_at_index::*;
 pub use secp256k1_primitives::*;
 #[cfg(feature = "shielded")]

packages/rs-platform-wallet-ffi/src/manager.rs

@@ -8,12 +8,14 @@ use crate::event_handler::{
 };
 use crate::handle::*;
 use crate::persistence::{
-    FFIPersister, FreeTrackedMasternodesFn, LoadAssetLockOperationIdFn,
-    LoadIdentityBalanceBlockTimeFn, LoadTrackedMasternodesFn, PersistAssetLockOperationIdFn,
-    PersistDpnsNameStatesFn, PersistIdentityBalanceBlockTimeFn, PersistTrackedMasternodesFn,
-    PersistWalletChangesetChainLockHeightFn, PersistWalletChangesetSweepsFn,
-    PersistWalletChangesetUtxoVerdictsFn, PersistWalletDashPayBackfillFn, PersistenceCallbacks,
-    PersistenceCallbacksExtension, PersistenceCapabilitiesFFI, PersistenceExtensionCallbacks,
+    FFIPersister, FreePrivateContactScanStateFn, FreeTrackedMasternodesFn,
+    LoadAssetLockOperationIdFn, LoadIdentityBalanceBlockTimeFn, LoadPrivateContactScanStateFn,
+    LoadTrackedMasternodesFn, PersistAssetLockOperationIdFn, PersistDpnsNameStatesFn,
+    PersistIdentityBalanceBlockTimeFn, PersistPrivateContactScanStateFn,
+    PersistTrackedMasternodesFn, PersistWalletChangesetChainLockHeightFn,
+    PersistWalletChangesetSweepsFn, PersistWalletChangesetUtxoVerdictsFn,
+    PersistWalletDashPayBackfillFn, PersistenceCallbacks, PersistenceCallbacksExtension,
+    PersistenceCapabilitiesFFI, PersistenceExtensionCallbacks,
     PLATFORM_WALLET_PERSISTENCE_CALLBACKS_EXTENSION_VERSION,
 };
 use crate::runtime::runtime;
@@ -290,6 +292,18 @@ unsafe fn persistence_extension_callbacks(
             on_load_asset_lock_operation_id_fn,
             LoadAssetLockOperationIdFn
         ),
+        persist_private_contact_scan_state: slot!(
+            on_persist_private_contact_scan_state_fn,
+            PersistPrivateContactScanStateFn
+        ),
+        load_private_contact_scan_state: slot!(
+            on_load_private_contact_scan_state_fn,
+            LoadPrivateContactScanStateFn
+        ),
+        load_private_contact_scan_state_free: slot!(
+            on_load_private_contact_scan_state_free_fn,
+            FreePrivateContactScanStateFn
+        ),
     }
 }
 
@@ -867,6 +881,9 @@ pub unsafe extern "C" fn platform_wallet_manager_remove_wallet(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::contact_persistence::{
+        ContactRequestRemovalFFI, PrivateContactRequestsPositionFFI, PrivateShieldedAddressFFI,
+    };
 
     unsafe extern "C" fn begin_changeset(_context: *mut c_void, _wallet_id: *const u8) -> i32 {
         0
@@ -1372,6 +1389,68 @@ mod tests {
         assert!(parsed.load_identity_balance_block_time.is_none());
     }
 
+    #[test]
+    fn should_size_gate_private_contact_scan_state_slots_independently() {
+        #[allow(clippy::too_many_arguments)]
+        unsafe extern "C" fn persist(
+            _: *mut c_void,
+            _: *const u8,
+            _: *const PrivateContactRequestsPositionFFI,
+            _: usize,
+            _: *const PrivateShieldedAddressFFI,
+            _: usize,
+            _: *const ContactRequestRemovalFFI,
+            _: usize,
+            _: *const [u8; 32],
+            _: usize,
+        ) -> i32 {
+            0
+        }
+        unsafe extern "C" fn load(
+            _: *mut c_void,
+            _: *const u8,
+            _: *mut *const PrivateContactRequestsPositionFFI,
+            _: *mut usize,
+            _: *mut *const PrivateShieldedAddressFFI,
+            _: *mut usize,
+        ) -> i32 {
+            0
+        }
+        unsafe extern "C" fn free(
+            _: *mut c_void,
+            _: *const PrivateContactRequestsPositionFFI,
+            _: usize,
+            _: *const PrivateShieldedAddressFFI,
+            _: usize,
+        ) {
+        }
+        let mut ext = PersistenceCallbacksExtension {
+            on_persist_private_contact_scan_state_fn: Some(persist),
+            on_load_private_contact_scan_state_fn: Some(load),
+            on_load_private_contact_scan_state_free_fn: Some(free),
+            ..Default::default()
+        };
+        let parsed = unsafe { persistence_extension_callbacks(&ext) };
+        assert!(parsed.persist_private_contact_scan_state.is_some());
+        assert!(parsed.load_private_contact_scan_state.is_some());
+        assert!(parsed.load_private_contact_scan_state_free.is_some());
+        ext.struct_size = std::mem::offset_of!(
+            PersistenceCallbacksExtension,
+            on_load_private_contact_scan_state_free_fn
+        );
+        let parsed = unsafe { persistence_extension_callbacks(&ext) };
+        assert!(parsed.load_private_contact_scan_state.is_some());
+        assert!(parsed.load_private_contact_scan_state_free.is_none());
+        ext.struct_size = std::mem::offset_of!(
+            PersistenceCallbacksExtension,
+            on_persist_private_contact_scan_state_fn
+        );
+        let parsed = unsafe { persistence_extension_callbacks(&ext) };
+        assert!(parsed.persist_private_contact_scan_state.is_none());
+        assert!(parsed.load_private_contact_scan_state.is_none());
+        assert!(parsed.load_private_contact_scan_state_free.is_none());
+    }
+
     #[test]
     fn should_size_gate_asset_lock_operation_id_slots_independently() {
         unsafe extern "C" fn persist(