Hierarchy Account 하이어라키 어카운트

// ── User AA Wallet creation (wallet.service.js) ──
const randomWallet = Ethers.Wallet.createRandom();       // unpredictable
const ownerEoaAddress = randomWallet.address;
const aaAddress = await AAService.computeAAAddress(ownerEoaAddress, account_idx);
// Result: db.Wallet = { address: aaAddress, owner_eoa: ownerEoaAddress, wallet_type: 'AA' }

// ── Slot / Content Wallet creation ──
const hash = Ethers.utils.keccak256(
  Ethers.utils.toUtf8Bytes( crypto_encryp(account_idx + process.env.W_SALT) )
);
const c_salt_eoa = new Ethers.Wallet(hash.substring(0, 66)).address;  // deterministic
const contentAddress = await AAService.computeAAAddress(c_salt_eoa, account_idx);
// Result: db.CWallet = { address: contentAddress, owner_eoa: c_salt_eoa, wallet_type: 'AA' }

// ── Address formula (ERC-4337 CREATE2) ──
// factory.getAddress(owner, salt)
//   → keccak256( 0xff | factory | keccak256(creationCode + abi.encode(owner, salt)) )[12:]

// dex.sol (Solidity)

struct slotdata {
    address payable owner_addr;   // ← user's AA wallet address (Level 2)
    uint256 cuid;                 // ← content unit ID (links slot to provider)
    uint256 used_balances;        // ← accumulated used token balance
    bool    is_sell;              // ← whether the slot is listed for sale
    uint256 price;                // ← listing price (wei)
}

mapping(address => slotdata) private _data;
//      ↑
//      key = slot / content wallet address (Level 3 — db.CWallet.address)

// Example state for slot 0xSlotAddress (db.CWallet.address)
_data[0xSlotAddress] = {
    owner_addr:    0xUserAAAddress,  // ← db.Wallet.address (user's SimpleAccount)
    cuid:          42,               // ← content provider ID
    used_balances: 500e18,           // ← 500 tokens used
    is_sell:       false,
    price:         0
}

// dex.sol — init_permission (Solidity)
function init_permission(address owner, address slot, uint256 cuid) external returns (bool) {
    require(_data[slot].owner_addr == address(0x0));  // slot must be unclaimed
    require(_data[slot].cuid      == uint256(0x0));   // cuid must be unset
    require(slot != address(0x0));                    // slot must be valid address

    // ⚠️  NO msg.sender check — any account can register any owner
    //     Safety comes from: only platform knows both addresses,
    //     and XOR key verification confirms user identity off-chain

    if (_cuid_count[cuid] == 0) {
        _cuid_releaseTokenEnabled[cuid] = false;
    }
    _cuid_count[cuid]++;

    _data[slot].owner_addr = payable(owner);  // ← user's AA wallet address set here
    _data[slot].cuid       = cuid;
    _data[slot].is_sell    = false;
    return true;
}

// Example: user AA wallet authorizing increaseUsedBal on its slot
// (called via AA UserOperation — msg.sender = user AA wallet)

function increaseUsedBal(
    address owner,      // ← user's AA wallet address
    address slot_addr,  // ← content wallet address (db.CWallet.address)
    uint256 cuid,
    uint256 amount
) public returns (uint256) {
    require(_data[slot_addr].owner_addr == owner, "Not Match Owner"); // ← ownership gate
    require(_data[slot_addr].cuid == cuid, "Not Match cuid");
    require(amount <= balanceOf(slot_addr) - _data[slot_addr].used_balances);

    _data[slot_addr].used_balances += amount;
    _totalUsed += amount;
    return _data[slot_addr].used_balances;
}

// init_permission_by_platform — B서버 (call.method.js)
async function init_permission_by_platform(userAAAddress, slotAddr, cuid, callback) {
    const platformAddr = web3.eth.accounts
        .privateKeyToAccount(process.env.PRIVATE_KEY).address;

    //  from: platformAddr      ← tx signer (gas payer, msg.sender in dex.sol)
    //  to:   DexInfo.address
    //  data: init_permission(userAAAddress, slotAddr, cuid)
    //                          ↑ logical owner = user's AA wallet, NOT platformAddr

    const tx = {
        from: platformAddr,
        to:   DexInfo.address,
        gas:  300000,
        data: content_contract.methods
                .init_permission(userAAAddress, slotAddr, cuid)
                .encodeABI()
    };
    const signedTx = await web3.eth.accounts.signTransaction(tx, process.env.PRIVATE_KEY);
    const receipt  = await web3.eth.sendSignedTransaction(signedTx.rawTransaction);
    return callback(true, receipt);
}

// Solidity (dex.sol)
function get_slot_owner(address slot) public view returns (address) {
    return _data[slot].owner_addr;
    // Returns: user's AA wallet address (db.Wallet.address)
    //          or address(0) if init_permission was never called
}

// JavaScript (ethers.js)
const dex = new ethers.Contract(DEX_ADDRESS, DEX_ABI, provider);
const ownerAddr = await dex.get_slot_owner(slotAddress);
// ownerAddr === db.Wallet.address (user's SimpleAccount)

// JavaScript (web3.js)
const ownerAddr = await content_contract.methods
    .get_slot_owner(slotAddress)
    .call();

// Verifying the full hierarchy:
// ownerAddr                          → user's AA wallet (SimpleAccount)
// await factory.getAddress(ownerEoa, account_idx) === ownerAddr  → ✓ addresses match
// db.Wallet.owner_eoa                → signs UserOps that act on behalf of ownerAddr

// ── Traditional OAuth flow (access tied to session) ──
User Login → OAuth issues access_token (stored in platform DB)
App calls OAuth server: "Is this token valid?" → Yes/No
Platform can: DELETE token → access gone instantly
User cannot: move, sell, or keep the token if platform decides otherwise

// ── WebXcom Slot flow (access is on-chain ownership) ──
User Login (OAuth) → verifies IDENTITY only: "this is account_idx=42"
B-server checks: dex.get_slot_owner(slotAddr) → 0xUserAAWallet
Platform can: revoke OAuth session (off-chain only)
Platform cannot: change _data[slot].owner_addr — only the owner can
User can: sell, transfer, or keep the slot regardless of platform policy

// Connected app authorization check (slot-based, not session-based)
//
// Question: "Does this OAuth user have access to AppX (cuid=7)?"
//
// Step 1: resolve user's AA wallet from OAuth identity
const userAAAddress = db.Wallet.address  // from OAuth account_idx

// Step 2: find the slot address registered for this app
const slotAddress = db.CWallet.address   // user's slot for cuid=7

// Step 3: verify on-chain ownership
const owner = await dex.get_slot_owner(slotAddress)
const hasAccess = (owner.toLowerCase() === userAAAddress.toLowerCase())
//
// hasAccess=true  → user owns the slot → authorized
// hasAccess=false → slot unregistered or transferred → denied
// No OAuth server call needed. No session table lookup. Pure on-chain truth.

// One user's AA wallet owns access credentials for multiple apps
0xUserAA_Wallet
  │
  ├─ Slot_AppX  (cuid=1)  ← access to streaming service AppX
  │     owner_addr = 0xUserAA  ✓
  │     used_balances = 200 tokens (content consumed)
  │     is_sell = false
  │
  ├─ Slot_AppY  (cuid=2)  ← access to gaming platform AppY
  │     owner_addr = 0xUserAA  ✓
  │     used_balances = 0 tokens
  │     is_sell = false
  │
  └─ Slot_AppZ  (cuid=3)  ← access to developer tool AppZ
        owner_addr = 0xUserAA  ✓
        used_balances = 50 tokens
        is_sell = true, price = 0.05 ETH  ← listed for sale

// All of these require only: _data[slot].owner_addr == caller
// Platform cannot block or override any of these.

init_sell_amount(slot, price)       // list slot for sale at chosen price
init_sell_cancle(sender, slot)      // cancel listing anytime
init_self(sender, slot, newOwner)   // give slot to anyone, free
transferAdex(owner, from, to, val)  // move available token balance

// Contrast: in traditional OAuth, none of these actions exist.
// The "access credential" (token) is platform property.
// Here, the slot is user property on an immutable ledger.

// Scenario A: Gift / organizational transfer (init_self — free)
dex.init_self(
    sender = UserA_AA,     // current owner — must match _data[slot].owner_addr
    slot   = slotAddress,  // the access credential being transferred
    owner  = UserB_AA      // recipient — their db.Wallet.address
)
// After:  _data[slot].owner_addr = UserB_AA
//         App checks get_slot_owner(slot) → UserB_AA
//         UserA has lost access. UserB has gained access.
//         No database update needed on OAuth side for on-chain truth.

// Scenario B: Marketplace sale (buy_slot — paid)
// Anyone can buy a listed slot:
dex.buy_slot{ value: price }(buyer, slotAddress, cuid, store_manager)
// Atomically:
//   - ETH distributed to platform, provider, store, and seller (UserA_AA)
//   - _data[slot].owner_addr = buyer  (UserB_AA)
//   - is_sell reset to false, price reset to 0
// The buyer inherits the slot's full on-chain state: cuid, used_balances, history.

// dex.sol — approve_slot
function approve_slot(address slot, address operator) external returns(bool) {
    // _msgSender() must equal the slot's owner_addr (AA wallet address)
    require(_data[slot].owner_addr == _msgSender(), "approve_slot: Not slot owner");
    require(_data[slot].is_sell == true,  "approve_slot: Slot is not listed for sale");
    require(operator != address(0),       "approve_slot: operator is zero address");

    // Once set, init_sell_cancle reverts until revoke_slot() is called
    _slot_approved[slot] = operator;
    return true;
}

// dex.sol — init_sell_cancle (updated guard)
function init_sell_cancle(address sender, address slot) public returns(bool) {
    require(_data[slot].owner_addr == sender, "init_sell_cancle: Not slot owner");
    require(
        _slot_approved[slot] == address(0),
        "init_sell_cancle: Slot is approved for relay. Call revoke_slot first"
    );
    _data[slot].is_sell = false;
    return true;
}

// dex.sol — revoke_slot
function revoke_slot(address slot) external returns(bool) {
    require(
        _slot_approved[slot] == _msgSender() ||   // approved operator (platform EOA)
        _data[slot].owner_addr == _msgSender(),    // or slot owner (user AA wallet)
        "revoke_slot: Not authorized"
    );
    _slot_approved[slot] = address(0);  // approval cleared → init_sell_cancle unlocked
    return true;
}

// Seller wants to cancel after approve_slot:
//   1. platform.revoke_slot(slot)   ← platform cooperates and revokes
//   2. seller.init_sell_cancle(...)  ← now allowed (slot_approved == address(0))

// dex.sol — buy_slot caller check
require(
    _msgSender() == buyer ||                   // buyer themselves (direct)
    _slot_approved[slot] == _msgSender(),      // OR: approved operator (platform relay)
    "buy_slot: Not buyer or approved operator"
);

// ETH distribution (sequential, balance-based within same tx):
// 1. platform:      balance × _fee_slot_platform / 100  (default 3%)
// 2. provider:      balance × _fee_slot_provider / 100  (default 4%, skipped if unregistered)
// 3. store_manager: balance × _fee_slot_store    / 100  (default 3%)
// 4. seller (prev owner): remaining balance → call{value:...}()
//
// State after distribution:
// _data[slot].price      = 0           ← reset (must re-register for next sale)
// _data[slot].is_sell    = false       ← reset
// _data[slot].owner_addr = buyer_AA    ← ownership transferred
// _slot_approved[slot]   = address(0)  ← approval auto-cleared (one-shot)

// State immediately after buy_slot — new owner ready for next cycle
_data[slot].price      → 0          // must call init_sell_amount again
_data[slot].is_sell    → false      // must call init_sell_amount again
_data[slot].owner_addr → buyer_AA   // new owner — signs next approve_slot
_slot_approved[slot]   → address(0) // cleared — new owner re-approves for next sale

// Cycle repeats (N rounds, each independent):
// New owner: init_sell_amount(price)
//          → approve_slot(slot, platform)    ← new owner's XOR key, once
//          → [platform]: buy_slot(nextBuyer) ← no XOR key needed
//          → next_owner owns slot, state reset