feat(contract): auto-expire unused launcher image hashes

crates/contract/README.md

@@ -324,8 +324,8 @@ These functions require the caller to be a participant or candidate.
 | `version()`                                                                | Returns the contract version.                                                                                                                                                                                                            | `String`                 | TBD             | TBD                |
 | `update_config(config: ConfigV1)`                                          | Updates the contract configuration for `V1`.                                                                                                                                                                                             | `()`                     | TBD             | TBD                |
 | `allowed_docker_image_hashes()`                                            | Returns all currently allowed MPC Docker image hashes with their eviction expiry, newest first.                                                                                                   | `Vec<AllowedMpcDockerImageHash>` | TBD            | TBD                |
-| `allowed_launcher_image_hashes()`                                          | Returns all currently allowed launcher image hashes.                                                                                                                                              | `Vec<LauncherImageHash>` | TBD             | TBD                |
-| `allowed_launcher_compose_hashes()`                                        | Returns all currently allowed launcher compose hashes (derived from launcher + MPC image pairs).                                                                                                  | `Vec<LauncherDockerComposeHash>` | TBD     | TBD                |
+| `allowed_launcher_image_hashes()`                                          | Returns the non-expired allowed launcher image hashes (the most-recently-used entry only when all are expired).                                                                                   | `Vec<LauncherImageHash>` | TBD             | TBD                |
+| `allowed_launcher_compose_hashes()`                                        | Returns the non-expired allowed launcher compose hashes (derived from launcher + MPC image pairs; the most-recently-used entry only when all are expired).                                        | `Vec<LauncherDockerComposeHash>` | TBD     | TBD                |
 | `launcher_hash_votes()`                                                    | Returns current launcher hash votes, showing each participant's vote.                                                                                                                             | `LauncherHashVotes`      | TBD             | TBD                |
 | `code_hash_votes()`                                                        | Returns current code hash votes, showing each participant's vote.                                                                                                                                 | `CodeHashesVotes`        | TBD             | TBD                |
 | `allowed_os_measurements()`                                                | Returns all currently allowed OS measurement sets.                                                                                                                                                | `Vec<ContractExpectedMeasurements>` | TBD  | TBD                |

crates/contract/src/config.rs

@@ -41,6 +41,8 @@ const DEFAULT_VERIFIER_TERA_GAS: u64 = 200;
 /// Prepaid gas for the `resolve_verification` callback. Carries the bulk of the
 /// post-DCAP work (allowlist match, RTMR3 replay, app-compose validation, store).
 const DEFAULT_RESOLVE_VERIFICATION_TERA_GAS: u64 = 60;
+/// Default TTL after which a launcher image hash unused by any participant is evicted.
+pub(crate) const DEFAULT_LAUNCHER_HASH_UNUSED_TTL_SECONDS: u64 = 14 * 24 * 60 * 60; // 14 days
 
 /// Config for V2 of the contract.
 #[near(serializers=[borsh, json])]
@@ -81,6 +83,10 @@ pub(crate) struct Config {
     pub(crate) verifier_tera_gas: u64,
     /// Prepaid gas for the `resolve_verification` callback.
     pub(crate) resolve_verification_tera_gas: u64,
+    /// TTL after which a launcher image hash unused by any participant is evicted.
+    /// Applied when an entry's expiry is next stamped (vote-in, re-vote, or a refresh on
+    /// use), not retroactively — changing it does not re-date existing entries.
+    pub(crate) launcher_hash_unused_ttl_seconds: u64,
 }
 
 impl Default for Config {
@@ -110,6 +116,22 @@ impl Default for Config {
                 DEFAULT_REMOVE_NON_PARTICIPANT_TEE_VERIFIER_VOTES_TERA_GAS,
             verifier_tera_gas: DEFAULT_VERIFIER_TERA_GAS,
             resolve_verification_tera_gas: DEFAULT_RESOLVE_VERIFICATION_TERA_GAS,
+            launcher_hash_unused_ttl_seconds: DEFAULT_LAUNCHER_HASH_UNUSED_TTL_SECONDS,
         }
     }
 }
+
+impl Config {
+    /// Invariant: a launcher hash backing a still-valid attestation must never expire,
+    /// so its unused-TTL must be at least the attestation validity window.
+    pub(crate) fn validate(&self) -> Result<(), &'static str> {
+        if self.launcher_hash_unused_ttl_seconds
+            < mpc_attestation::attestation::DEFAULT_EXPIRATION_DURATION_SECONDS
+        {
+            return Err(
+                "launcher_hash_unused_ttl_seconds must be >= DEFAULT_EXPIRATION_DURATION_SECONDS",
+            );
+        }
+        Ok(())
+    }
+}

crates/contract/src/dto_mapping.rs

@@ -446,8 +446,12 @@ impl IntoInterfaceType<dtos::ProposedUpdates> for &ProposedUpdates {
     }
 }
 
-impl From<near_mpc_contract_interface::types::InitConfig> for Config {
-    fn from(config_ext: near_mpc_contract_interface::types::InitConfig) -> Self {
+impl TryFrom<near_mpc_contract_interface::types::InitConfig> for Config {
+    type Error = Error;
+
+    fn try_from(
+        config_ext: near_mpc_contract_interface::types::InitConfig,
+    ) -> Result<Self, Self::Error> {
         let mut config = super::Config::default();
 
         if let Some(v) = config_ext.key_event_timeout_blocks {
@@ -501,8 +505,16 @@ impl From<near_mpc_contract_interface::types::InitConfig> for Config {
         if let Some(v) = config_ext.resolve_verification_tera_gas {
             config.resolve_verification_tera_gas = v;
         }
+        if let Some(v) = config_ext.launcher_hash_unused_ttl_seconds {
+            config.launcher_hash_unused_ttl_seconds = v;
+        }
 
         config
+            .validate()
+            .map_err(|reason| ConversionError::DataConversion {
+                reason: reason.to_string(),
+            })?;
+        Ok(config)
     }
 }
 
@@ -533,13 +545,16 @@ impl From<&Config> for near_mpc_contract_interface::types::Config {
                 .remove_non_participant_tee_verifier_votes_tera_gas,
             verifier_tera_gas: value.verifier_tera_gas,
             resolve_verification_tera_gas: value.resolve_verification_tera_gas,
+            launcher_hash_unused_ttl_seconds: value.launcher_hash_unused_ttl_seconds,
         }
     }
 }
 
-impl From<near_mpc_contract_interface::types::Config> for Config {
-    fn from(value: near_mpc_contract_interface::types::Config) -> Self {
-        Config {
+impl TryFrom<near_mpc_contract_interface::types::Config> for Config {
+    type Error = Error;
+
+    fn try_from(value: near_mpc_contract_interface::types::Config) -> Result<Self, Self::Error> {
+        let config = Config {
             key_event_timeout_blocks: value.key_event_timeout_blocks,
             tee_upgrade_deadline_duration_seconds: value.tee_upgrade_deadline_duration_seconds,
             contract_upgrade_deposit_tera_gas: value.contract_upgrade_deposit_tera_gas,
@@ -564,7 +579,15 @@ impl From<near_mpc_contract_interface::types::Config> for Config {
                 .remove_non_participant_tee_verifier_votes_tera_gas,
             verifier_tera_gas: value.verifier_tera_gas,
             resolve_verification_tera_gas: value.resolve_verification_tera_gas,
-        }
+            launcher_hash_unused_ttl_seconds: value.launcher_hash_unused_ttl_seconds,
+        };
+
+        config
+            .validate()
+            .map_err(|reason| ConversionError::DataConversion {
+                reason: reason.to_string(),
+            })?;
+        Ok(config)
     }
 }