Street NFT Audit

;; Welsh Street Genesis NFT
 
;; NFT collection — uint token IDs assigned sequentially by street-controller's mint counter
(define-non-fungible-token welsh-street-genesis-nft uint)
 
;; errors
;; 4 unique error codes with u96x prefix — all tested, no overlap with other contracts
(define-constant ERR_NOT_CONTRACT_OWNER (err u961))
(define-constant ERR_NOT_AUTHORIZED (err u962))
(define-constant ERR_NOT_FOUND (err u963))
(define-constant ERR_NOT_OWNER (err u964))
 
;; variables
 
;; IPFS-hosted metadata base path — mutable by contract owner (see I-04)
(define-data-var base-uri (string-ascii 256) "https://ipfs.io/ipfs/bafybeifgnlibngkzvd6nfryu57kf54logbj5dbbcvmznc45hv47pkxzjli/")
 
;; initialized to deployer at deployment — transferable via set-contract-owner
(define-data-var contract-owner principal tx-sender)
 
;; minting log — tracks token IDs minted per principal, max 2 entries (see I-02)
;; not updated on transfer — reflects minting history, not current ownership
(define-map users principal (list 2 uint))
 
;; mints one NFT to recipient — callable only by street-controller
(define-public (mint (token-id uint) (recipient principal))
  (let ((existing-tokens (default-to (list) (map-get? users recipient))))
    (begin
      ;; only street-controller can mint — prevents direct minting by any user or owner
      (asserts! (is-eq contract-caller .street-controller) ERR_NOT_AUTHORIZED)
 
      ;; nft-mint? fails if token-id already exists — prevents duplicate IDs
      (try! (nft-mint? welsh-street-genesis-nft token-id recipient))
 
      ;; append new token-id to user's minting record
      ;; unwrap-panic is safe — street-controller limits each user to 2 mints,
      ;; so existing-tokens has at most 1 entry when this runs (see I-03)
      (map-set users recipient (unwrap-panic (as-max-len? (append existing-tokens token-id) u2)))
      (ok true)
    )
  )
)
 
;; direct transfer — only the token owner can transfer, no operator/approval pattern
(define-public (transfer (token-id uint) (sender principal) (recipient principal))
  (let ((owner (unwrap! (nft-get-owner? welsh-street-genesis-nft token-id) ERR_NOT_FOUND)))
    (begin
      ;; verifies sender parameter matches actual on-chain owner
      (asserts! (is-eq owner sender) ERR_NOT_OWNER)
 
      ;; contract-caller must be sender — prevents intermediary contracts from
      ;; transferring on behalf of users without direct invocation
      (asserts! (is-eq contract-caller sender) ERR_NOT_AUTHORIZED)
 
      ;; nft-transfer? is atomic — fails if sender doesn't own token (redundant with above checks)
      ;; users map is NOT updated here — minting log only (see I-02)
      (try! (nft-transfer? welsh-street-genesis-nft token-id sender recipient))
      (ok true)
    )
  )
)
 
;; single-step ownership transfer — no two-step confirmation pattern (see I-01)
(define-public (set-contract-owner (new-owner principal))
  (begin
    ;; contract-caller check — only direct caller, not tx-sender chain
    (asserts! (is-eq contract-caller (var-get contract-owner)) ERR_NOT_CONTRACT_OWNER)
 
    ;; irreversible if transferred to wrong address — owner controls only metadata and this function
    (var-set contract-owner new-owner)
    (ok true)
  )
)
 
;; updates IPFS metadata base URI — cosmetic only, no economic impact (see I-04)
(define-public (set-base-uri (new-uri (string-ascii 256)))
  (begin
    ;; owner-only — same contract-caller pattern as set-contract-owner
    (asserts! (is-eq contract-caller (var-get contract-owner)) ERR_NOT_CONTRACT_OWNER)
    (var-set base-uri new-uri)
    (ok true)
  )
)
 
;; === READ-ONLY FUNCTIONS — no access control needed ===
 
;; returns current contract owner — public information
(define-read-only (get-contract-owner)
  (ok (var-get contract-owner)))
 
;; returns on-chain NFT owner — authoritative ownership source (not the users map)
(define-read-only (get-owner (token-id uint))
  (ok (nft-get-owner? welsh-street-genesis-nft token-id)))
 
;; constructs token URI from mutable base-uri + token-id + ".json"
;; returns (some ...) for any token-id — does not validate existence
(define-read-only (get-token-uri (token-id uint))
  (ok (some (concat (concat (var-get base-uri) (int-to-ascii token-id)) ".json"))))
 
;; returns current base URI configuration
(define-read-only (get-base-uri)
  (ok (var-get base-uri)))
 
;; returns minting record for user — NOT current ownership (see I-02)
;; returns none if user has never minted via street-controller
(define-read-only (get-user-minted-tokens (user principal))
  (ok (map-get? users user)))