PetDIDRegistry.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "@openzeppelin/contracts/access/AccessControl.sol";
import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
import "@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol";

/**
 * @title PetDIDRegistry
 * @notice Pet Digital Identity Registry with biometric-based DID
 * @dev Optimized for Hyperledger Besu private network
 * @author DogCatPaw Team
 */
contract PetDIDRegistry is AccessControl, ReentrancyGuard {
    using ECDSA for bytes32;
    using MessageHashUtils for bytes32;

    // ==================== Roles ====================

    bytes32 public constant MODEL_SERVER_ROLE = keccak256("MODEL_SERVER_ROLE");
    bytes32 public constant GUARDIAN_ROLE = keccak256("GUARDIAN_ROLE");
    bytes32 public constant SHELTER_ROLE = keccak256("SHELTER_ROLE");

    // ==================== Structs ====================

    struct DIDDocument {
        address biometricOwner;
        address controller;
        uint48 created;
        uint48 updated;
        bool exists;
    }

    struct BiometricData {
        bytes32 featureVectorHash;
        string modelServerReference;
        uint8 sampleCount;
        uint48 registrationTime;
    }

    struct VerificationRecord {
        address verifier;
        uint48 timestamp;
        uint8 similarity;
        uint8 purpose;
    }

    struct CredentialMetadata {
        bytes32 credentialHash;
        address issuer;
        address subject;
        uint48 issuanceDate;
        uint48 expirationDate;
        bool revoked;
    }

    // ==================== Storage ====================

    mapping(bytes32 => DIDDocument) private identities;
    mapping(bytes32 => BiometricData) private biometricData;
    mapping(bytes32 => VerificationRecord[]) private verificationHistory;
    mapping(bytes32 => CredentialMetadata) public credentials;
    mapping(string => bytes32) private didToIdentity;
    mapping(bytes32 => string) private identityToDID;
    mapping(address => string[]) private controllerPets;

    uint256 private totalPets;

    // ==================== Events ====================

    event DIDCreated(
        string indexed petDID,
        bytes32 indexed identity,
        address indexed biometricOwner,
        address controller
    );

    event BiometricVerified(
        string indexed petDID,
        address indexed verifier,
        uint8 similarity,
        uint8 purpose
    );

    event CredentialIssued(
        bytes32 indexed credentialHash,
        string credentialType,
        address indexed issuer,
        address indexed subject
    );

    event CredentialRevoked(
        bytes32 indexed credentialHash,
        address indexed revoker
    );

    event ControllerChanged(
        string indexed petDID,
        address indexed oldController,
        address indexed newController
    );

    event EmergencyAccessed(
        string indexed petDID,
        address indexed accessor,
        string location
    );

    // ==================== Errors ====================

    error InvalidDIDFormat();
    error DIDAlreadyExists();
    error DIDNotFound();
    error Unauthorized();
    error InvalidSimilarity();
    error InvalidServerSignature();
    error CredentialAlreadyExists();
    error CredentialNotFound();
    error CredentialAlreadyRevoked();
    error InvalidHexCharacter();

    // ==================== Constructor ====================

    constructor() {
        _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
    }

    // ==================== Core Functions ====================

    function registerPetDID(
        string calldata _petDID,
        bytes32 _featureVectorHash,
        string calldata _modelServerReference,
        uint8 _sampleCount,
        string calldata _species,
        string calldata _metadataURI
    ) external nonReentrant {
        if (bytes(_petDID).length == 0) revert InvalidDIDFormat();
        if (didToIdentity[_petDID] != bytes32(0)) revert DIDAlreadyExists();
        if (_sampleCount < 1 || _sampleCount > 2) revert InvalidSimilarity();

        address biometricAddress = extractBiometricAddress(_petDID);
        bytes32 identity = keccak256(abi.encodePacked(biometricAddress));

        identities[identity] = DIDDocument({
            biometricOwner: biometricAddress,
            controller: msg.sender,
            created: uint48(block.timestamp),
            updated: uint48(block.timestamp),
            exists: true
        });

        biometricData[identity] = BiometricData({
            featureVectorHash: _featureVectorHash,
            modelServerReference: _modelServerReference,
            sampleCount: _sampleCount,
            registrationTime: uint48(block.timestamp)
        });

        didToIdentity[_petDID] = identity;
        identityToDID[identity] = _petDID;
        controllerPets[msg.sender].push(_petDID);

        unchecked {
            ++totalPets;
        }

        emit DIDCreated(_petDID, identity, biometricAddress, msg.sender);
    }

    function verifyBiometric(
        string calldata _petDID,
        uint8 _similarity,
        uint8 _purpose,
        bytes calldata _modelServerSignature
    ) external returns (bool) {
        bytes32 identity = didToIdentity[_petDID];
        if (identity == bytes32(0)) revert DIDNotFound();
        if (_similarity < 85 || _similarity > 100) revert InvalidSimilarity();

        bytes32 messageHash = keccak256(
            abi.encodePacked(_petDID, _similarity, _purpose, block.timestamp)
        );

        address signer = messageHash.toEthSignedMessageHash().recover(_modelServerSignature);

        if (!hasRole(MODEL_SERVER_ROLE, signer)) revert InvalidServerSignature();

        verificationHistory[identity].push(VerificationRecord({
            verifier: msg.sender,
            timestamp: uint48(block.timestamp),
            similarity: _similarity,
            purpose: _purpose
        }));

        emit BiometricVerified(_petDID, msg.sender, _similarity, _purpose);
        return true;
    }

    function registerCredential(
        bytes32 _credentialHash,
        string calldata _credentialType,
        address _subject,
        uint48 _expirationDate
    ) external {
        if (credentials[_credentialHash].issuanceDate != 0) {
            revert CredentialAlreadyExists();
        }

        credentials[_credentialHash] = CredentialMetadata({
            credentialHash: _credentialHash,
            issuer: msg.sender,
            subject: _subject,
            issuanceDate: uint48(block.timestamp),
            expirationDate: _expirationDate,
            revoked: false
        });

        emit CredentialIssued(_credentialHash, _credentialType, msg.sender, _subject);
    }

    function revokeCredential(bytes32 _credentialHash) external {
        CredentialMetadata storage cred = credentials[_credentialHash];

        if (cred.issuanceDate == 0) revert CredentialNotFound();
        if (cred.issuer != msg.sender) revert Unauthorized();
        if (cred.revoked) revert CredentialAlreadyRevoked();

        cred.revoked = true;
        emit CredentialRevoked(_credentialHash, msg.sender);
    }

    function changeController(
        string calldata _petDID,
        address _newController
    ) external {
        bytes32 identity = didToIdentity[_petDID];
        DIDDocument storage doc = identities[identity];

        if (!doc.exists) revert DIDNotFound();
        if (doc.controller != msg.sender) revert Unauthorized();

        address oldController = doc.controller;
        doc.controller = _newController;
        doc.updated = uint48(block.timestamp);

        removePetFromController(oldController, _petDID);
        controllerPets[_newController].push(_petDID);

        emit ControllerChanged(_petDID, oldController, _newController);
    }

    function logEmergencyAccess(
        string calldata _petDID,
        string calldata _location
    ) external {
        bytes32 identity = didToIdentity[_petDID];
        if (identity == bytes32(0)) revert DIDNotFound();

        emit EmergencyAccessed(_petDID, msg.sender, _location);
    }

    // ==================== View Functions ====================

    function getDIDDocument(string calldata _petDID)
        external
        view
        returns (
            address biometricOwner,
            address controller,
            uint48 created,
            uint48 updated,
            bool exists
        )
    {
        bytes32 identity = didToIdentity[_petDID];
        DIDDocument storage doc = identities[identity];

        return (
            doc.biometricOwner,
            doc.controller,
            doc.created,
            doc.updated,
            doc.exists
        );
    }

    function getBiometricData(string calldata _petDID)
        external
        view
        returns (
            bytes32 featureVectorHash,
            string memory modelServerReference,
            uint8 sampleCount,
            uint48 registrationTime
        )
    {
        bytes32 identity = didToIdentity[_petDID];
        BiometricData storage data = biometricData[identity];

        return (
            data.featureVectorHash,
            data.modelServerReference,
            data.sampleCount,
            data.registrationTime
        );
    }

    function getVerificationHistory(string calldata _petDID)
        external
        view
        returns (VerificationRecord[] memory)
    {
        bytes32 identity = didToIdentity[_petDID];
        return verificationHistory[identity];
    }

    function isCredentialValid(bytes32 _credentialHash)
        external
        view
        returns (bool)
    {
        CredentialMetadata storage cred = credentials[_credentialHash];

        if (cred.issuanceDate == 0) return false;
        if (cred.revoked) return false;
        if (cred.expirationDate > 0 && block.timestamp > cred.expirationDate) {
            return false;
        }

        return true;
    }

    function isAuthorizedGuardian(string calldata _petDID, address _guardian)
        external
        view
        returns (bool)
    {
        bytes32 identity = didToIdentity[_petDID];
        return identities[identity].controller == _guardian;
    }

    function getPetsByController(address _controller)
        external
        view
        returns (string[] memory)
    {
        return controllerPets[_controller];
    }

    function getTotalPets() external view returns (uint256) {
        return totalPets;
    }

    function getIdentityFromDID(string calldata _petDID)
        external
        view
        returns (bytes32)
    {
        return didToIdentity[_petDID];
    }

    function getDIDFromIdentity(bytes32 _identity)
        external
        view
        returns (string memory)
    {
        return identityToDID[_identity];
    }

    // ==================== Internal Functions ====================

    function extractBiometricAddress(string calldata _did)
        internal
        pure
        returns (address)
    {
        bytes memory didBytes = bytes(_did);
        if (didBytes.length < 56) revert InvalidDIDFormat();

        bytes memory hexStr = new bytes(40);
        uint256 startIdx = 16;

        for (uint256 i = 0; i < 40; i++) {
            hexStr[i] = didBytes[startIdx + i];
        }

        return hexStringToAddress(string(hexStr));
    }

    function hexStringToAddress(string memory _hexStr)
        internal
        pure
        returns (address)
    {
        bytes memory hexBytes = bytes(_hexStr);
        if (hexBytes.length != 40) revert InvalidDIDFormat();

        uint160 result = 0;
        for (uint256 i = 0; i < 40; i++) {
            result = result * 16 + hexCharToUint8(hexBytes[i]);
        }

        return address(result);
    }

    function hexCharToUint8(bytes1 _char) internal pure returns (uint8) {
        uint8 c = uint8(_char);
        if (c >= 48 && c <= 57) return c - 48;
        if (c >= 65 && c <= 70) return c - 55;
        if (c >= 97 && c <= 102) return c - 87;
        revert InvalidHexCharacter();
    }

    function removePetFromController(address _controller, string calldata _petDID)
        internal
    {
        string[] storage pets = controllerPets[_controller];
        uint256 length = pets.length;

        for (uint256 i = 0; i < length; ) {
            if (keccak256(bytes(pets[i])) == keccak256(bytes(_petDID))) {
                pets[i] = pets[length - 1];
                pets.pop();
                break;
            }
            unchecked { ++i; }
        }
    }

    // ==================== Admin Functions ====================

    function grantModelServerRole(address _server)
        external
        onlyRole(DEFAULT_ADMIN_ROLE)
    {
        _grantRole(MODEL_SERVER_ROLE, _server);
    }

    function grantGuardianRole(address _guardian)
        external
        onlyRole(DEFAULT_ADMIN_ROLE)
    {
        _grantRole(GUARDIAN_ROLE, _guardian);
    }

    function grantShelterRole(address _shelter)
        external
        onlyRole(DEFAULT_ADMIN_ROLE)
    {
        _grantRole(SHELTER_ROLE, _shelter);
    }
}