Onchain Risk Verifier

#![allow(deprecated)]
#![allow(unexpected_cfgs)]

use anchor_lang::prelude::*;
use anchor_lang::solana_program::hash::hash;
use prost::Message;
use switchboard_on_demand::{default_queue, QueueAccountData};
use switchboard_on_demand::{Instructions, QuoteVerifier, SlotHashes};
use switchboard_protos::oracle_job::oracle_job::http_task::Header;
use switchboard_protos::oracle_job::oracle_job::multiply_task;
use switchboard_protos::oracle_job::oracle_job::task;
use switchboard_protos::oracle_job::oracle_job::{
    BoundTask, HttpTask, JsonParseTask, MultiplyTask, Task,
};
use switchboard_protos::{OracleFeed, OracleJob};

declare_id!("YOUR_PROGRAM_ID");

#[program]
pub mod risk_oracle {
    use super::*;

    pub fn verify_risk_score_feed(ctx: Context<VerifyRiskScoreFeed>) -> Result<()> {
        let mut verifier = QuoteVerifier::new();
        let slot = Clock::get()?.slot;

        // Configure the verifier with required sysvars
        verifier
            .queue(ctx.accounts.queue.as_ref())
            .slothash_sysvar(ctx.accounts.slothashes.as_ref())
            .ix_sysvar(ctx.accounts.instructions.as_ref())
            .clock_slot(slot);

        // Verify the Ed25519 signature at instruction index 0
        let quote = verifier.verify_instruction_at(0).unwrap();
        let quote_slot = quote.slot();

        // Ensure the quote is fresh (within 50 slots ≈ 20 seconds)
        if slot.saturating_sub(quote_slot) > 50 {
            return Err(ErrorCode::StaleQuote.into());
        }

        // Extract the verified feed data
        let feeds = quote.feeds();
        require!(!feeds.is_empty(), ErrorCode::NoOracleFeeds);
        let feed = &feeds[0];

        // Reconstruct the feed ID onchain and compare
        let expected_feed_id = create_risk_score_feed_id(
            &ctx.accounts.query_account.key()
        )?;
        require!(
            *feed.feed_id() == expected_feed_id,
            ErrorCode::FeedMismatch
        );

        // The risk score is now verified - use it in your program logic
        msg!(
            "Verified risk score feed! Value: {}",
            feed.value().to_string().as_str()
        );

        Ok(())
    }
}

// Account structure for the verify_risk_score_feed instruction
#[derive(Accounts)]
pub struct VerifyRiskScoreFeed<'info> {
    #[account(address = default_queue())]
    pub queue: AccountLoader<'info, QueueAccountData>,
    pub clock: Sysvar<'info, Clock>,
    pub slothashes: Sysvar<'info, SlotHashes>,
    pub instructions: Sysvar<'info, Instructions>,
    /// CHECK: Only the pubkey is needed to reconstruct the feed ID
    pub query_account: UncheckedAccount<'info>,
}

#[error_code]
pub enum ErrorCode {
    #[msg("No oracle feeds available")]
    NoOracleFeeds,
    #[msg("Feed hash mismatch - oracle feed does not match expected configuration")]
    FeedMismatch,
    #[msg("Stale quote - the quote is too old")]
    StaleQuote,
    #[msg("Risk score exceeds allowed threshold")]
    RiskTooHigh,
}

// Helper function to reconstruct the feed ID onchain
fn create_risk_score_feed_id(query_pubkey: &Pubkey) -> Result<[u8; 32]> {
    let addr = bs58::encode(query_pubkey).into_string();
    let url = format!(
        "https://api.range.org/v1/risk/address?address={}&network=solana",
        addr
    );

    let feed = OracleFeed {
        name: Some("Risk Score".to_string()),
        jobs: vec![OracleJob {
            tasks: vec![
                Task {
                    task: Some(task::Task::HttpTask(HttpTask {
                        url: Some(url),
                        headers: [
                            Header {
                                key: Some("accept".to_string()),
                                value: Some("application/json".to_string()),
                            },
                            Header {
                                key: Some("X-API-KEY".to_string()),
                                value: Some("${RANGE_API_KEY}".to_string()),
                            },
                        ]
                        .into(),
                        ..Default::default()
                    })),
                },
                Task {
                    task: Some(task::Task::JsonParseTask(JsonParseTask {
                        path: Some("$.riskScore".to_string()),
                        ..Default::default()
                    })),
                },
                Task {
                    task: Some(task::Task::MultiplyTask(MultiplyTask {
                        multiple: Some(multiply_task::Multiple::Scalar(10.0)),
                    })),
                },
                Task {
                    task: Some(task::Task::BoundTask(BoundTask {
                        lower_bound_value: Some("0".into()),
                        upper_bound_value: Some("100".into()),
                        on_exceeds_lower_bound_value: Some("0".into()),
                        on_exceeds_upper_bound_value: Some("100".into()),
                        ..Default::default()
                    })),
                },
            ],
            weight: None,
        }],
        min_job_responses: Some(1),
        min_oracle_samples: Some(1),
        max_job_range_pct: Some(100),
    };

    // Hash the protobuf-encoded feed to get the deterministic feed ID
    let bytes = OracleFeed::encode_length_delimited_to_vec(&feed);
    Ok(hash(&bytes).to_bytes())
}