From b4a3449d7cdb38abc304c7e8d39444c63a668553 Mon Sep 17 00:00:00 2001
From: "Mark S. Miller" <erights@gmail.com>
Date: Thu, 6 Jul 2023 19:16:15 -0700
Subject: [PATCH] feat(ERTP): revoke used up payments

---
 packages/ERTP/package.json                    |  1 +
 packages/ERTP/src/payment.js                  | 17 +++++++++++++++--
 packages/ERTP/src/paymentLedger.js            |  9 ++++++++-
 packages/ERTP/test/unitTests/test-recovery.js |  9 +++++++++
 4 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/packages/ERTP/package.json b/packages/ERTP/package.json
index 7bc8f25d6aa..e752aa557f7 100644
--- a/packages/ERTP/package.json
+++ b/packages/ERTP/package.json
@@ -52,6 +52,7 @@
   },
   "devDependencies": {
     "@endo/bundle-source": "^2.5.2",
+    "@endo/exo": "^0.2.3",
     "@fast-check/ava": "^1.1.5",
     "ava": "^5.3.0",
     "tsd": "^0.28.1"
diff --git a/packages/ERTP/src/payment.js b/packages/ERTP/src/payment.js
index 9c3a0e64428..a6feb5562d1 100644
--- a/packages/ERTP/src/payment.js
+++ b/packages/ERTP/src/payment.js
@@ -11,9 +11,13 @@ import { prepareExoClass } from '@agoric/vat-data';
  * @param {string} name
  * @param {Brand<K>} brand
  * @param {InterfaceGuard} PaymentI
- * @returns {() => Payment<K>}
+ * @returns {{
+ *   makePayment: () => Payment<K>,
+ *   revokePayment: (payment: Payment<K>) => boolean
+ * }}
  */
 export const preparePaymentKind = (issuerBaggage, name, brand, PaymentI) => {
+  let revokePayment;
   const makePayment = prepareExoClass(
     issuerBaggage,
     `${name} payment`,
@@ -24,7 +28,16 @@ export const preparePaymentKind = (issuerBaggage, name, brand, PaymentI) => {
         return brand;
       },
     },
+    {
+      getRevoker(revoke) {
+        revokePayment = revoke;
+      },
+    },
   );
-  return makePayment;
+  assert(revokePayment !== undefined);
+  return harden({
+    makePayment,
+    revokePayment,
+  });
 };
 harden(preparePaymentKind);
diff --git a/packages/ERTP/src/paymentLedger.js b/packages/ERTP/src/paymentLedger.js
index b4575854d14..f8ef8db4929 100644
--- a/packages/ERTP/src/paymentLedger.js
+++ b/packages/ERTP/src/paymentLedger.js
@@ -121,7 +121,12 @@ export const preparePaymentLedger = (
     amountShape,
   );
 
-  const makePayment = preparePaymentKind(issuerBaggage, name, brand, PaymentI);
+  const { makePayment, revokePayment } = preparePaymentKind(
+    issuerBaggage,
+    name,
+    brand,
+    PaymentI,
+  );
 
   /** @type {ShutdownWithFailure} */
   const shutdownLedgerWithFailure = reason => {
@@ -198,6 +203,8 @@ export const preparePaymentLedger = (
       paymentRecoverySets.delete(payment);
       recoverySet.delete(payment);
     }
+    // @ts-expect-error The usual type param confusion
+    revokePayment(payment);
   };
 
   /** @type {(left: Amount, right: Amount) => Amount} */
diff --git a/packages/ERTP/test/unitTests/test-recovery.js b/packages/ERTP/test/unitTests/test-recovery.js
index 3ed6ef326a7..aeb13ab746d 100644
--- a/packages/ERTP/test/unitTests/test-recovery.js
+++ b/packages/ERTP/test/unitTests/test-recovery.js
@@ -1,4 +1,5 @@
 import { test } from '@agoric/swingset-vat/tools/prepare-test-env-ava.js';
+import { GET_INTERFACE_GUARD } from '@endo/exo';
 import { getCopySetKeys, keyEQ, makeCopySet } from '@agoric/store';
 
 import { makeIssuerKit, AmountMath } from '../../src/index.js';
@@ -67,4 +68,12 @@ test('payment recovery from mint recovery set', async t => {
   t.throws(() => bobPurse.deposit(payment2), {
     message: /was not a live payment for brand/,
   });
+  t.throws(() => payment2.getAllegedBrand(), {
+    message:
+      '"In \\"getAllegedBrand\\" method of (precious payment)" may only be applied to a valid instance: "[Alleged: precious payment]"',
+  });
+  t.throws(() => payment2[GET_INTERFACE_GUARD](), {
+    message:
+      '"In \\"[Symbol(getInterfaceGuard)]\\" method of (precious payment)" may only be applied to a valid instance: "[Alleged: precious payment]"',
+  });
 });