Partner Executor Contract

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

/// @notice Reference adapter for partners that execute AKKA calldata through
/// their own contract. This is an integration example, not an AKKA deployment.
/// The partner must audit it and configure the exact AKKA Router addresses it
/// is willing to call.
contract AkkaPartnerExecutor is Ownable, ReentrancyGuard {
    using SafeERC20 for IERC20;

    mapping(address router => bool allowed) public allowedRouter;

    error RouterNotAllowed();
    error RouterCallFailed(bytes reason);
    error InvalidNativeValue();

    event RouterPermissionSet(address indexed router, bool allowed);

    constructor(address owner_) Ownable(owner_) {}

    receive() external payable {}

    function setRouterAllowed(address router, bool allowed) external onlyOwner {
        allowedRouter[router] = allowed;
        emit RouterPermissionSet(router, allowed);
    }

    /// @notice Pull ERC-20 input from the user, approve the allowlisted AKKA
    /// Router for exactly this call, and execute partner API `tx.data`.
    /// The output recipient is already encoded in the calldata.
    function executeERC20(
        address router,
        IERC20 tokenIn,
        uint256 amountIn,
        bytes calldata routerCalldata
    ) external nonReentrant returns (bytes memory result) {
        if (!allowedRouter[router]) revert RouterNotAllowed();

        uint256 balanceBefore = tokenIn.balanceOf(address(this));
        tokenIn.safeTransferFrom(msg.sender, address(this), amountIn);
        tokenIn.forceApprove(router, amountIn);
        (bool ok, bytes memory returnData) = router.call(routerCalldata);
        tokenIn.forceApprove(router, 0);
        if (!ok) revert RouterCallFailed(returnData);

        uint256 balanceAfter = tokenIn.balanceOf(address(this));
        if (balanceAfter > balanceBefore) {
            tokenIn.safeTransfer(msg.sender, balanceAfter - balanceBefore);
        }
        return returnData;
    }

    /// @notice Execute a native-input partner quote. `msg.value` must equal
    /// the `tx.value` returned by the partner API.
    function executeNative(
        address router,
        bytes calldata routerCalldata,
        uint256 expectedValue
    ) external payable nonReentrant returns (bytes memory result) {
        if (!allowedRouter[router]) revert RouterNotAllowed();
        if (msg.value != expectedValue) revert InvalidNativeValue();

        (bool ok, bytes memory returnData) = router.call{value: msg.value}(routerCalldata);
        if (!ok) revert RouterCallFailed(returnData);
        return returnData;
    }
}