Skip to content

Commit c8ba2d0

Browse files
didiermisdidiermis
committed
Map permissions & roles to extrinsics/functions. Fix 174.
1 parent 450e245 commit c8ba2d0

File tree

2 files changed

+33
-42
lines changed

2 files changed

+33
-42
lines changed

‎pallets/proxy-financial/src/functions.rs‎

Lines changed: 27 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,11 @@ impl<T: Config> Pallet<T> {
1616
// --------------------------------------------------------------------------------------------
1717

1818
pub fn do_initial_setup() -> DispatchResult{
19+
// Create a global scope for the administrator role
1920
let pallet_id = Self::pallet_id();
2021
let global_scope = pallet_id.using_encoded(blake2_256);
2122
<GlobalScope<T>>::put(global_scope);
23+
T::Rbac::create_scope(Self::pallet_id(), global_scope)?;
2224

2325
//Admin rol & permissions
2426
let administrator_role_id = T::Rbac::create_and_set_roles(pallet_id.clone(), [ProxyRole::Administrator.to_vec()].to_vec())?;
@@ -39,9 +41,6 @@ impl<T: Config> Pallet<T> {
3941
// Regional center rol & permissions
4042
let regional_center_role_id = T::Rbac::create_and_set_roles(pallet_id.clone(), [ProxyRole::RegionalCenter.to_vec()].to_vec())?;
4143
T::Rbac::create_and_set_permissions(pallet_id.clone(), regional_center_role_id[0], ProxyPermission::regional_center_permissions())?;
42-
43-
// Create a global scope for the administrator role
44-
T::Rbac::create_scope(Self::pallet_id(), global_scope)?;
4544

4645
Self::deposit_event(Event::ProxySetupCompleted);
4746
Ok(())
@@ -100,7 +99,7 @@ impl<T: Config> Pallet<T> {
10099
), T::MaxRegistrationsAtTime>>,
101100
) -> DispatchResult {
102101
// Ensure admin permissions
103-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
102+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::CreateProject)?;
104103

105104
//Add timestamp
106105
let timestamp = Self::get_timestamp_in_milliseconds().ok_or(Error::<T>::TimestampError)?;
@@ -165,8 +164,8 @@ impl<T: Config> Pallet<T> {
165164
creation_date: Option<u64>,
166165
completion_date: Option<u64>,
167166
) -> DispatchResult {
168-
//ensure admin permissions
169-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
167+
// Ensure admin permissions
168+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::EditProject)?;
170169

171170
//Ensure project exists
172171
ensure!(ProjectsInfo::<T>::contains_key(project_id), Error::<T>::ProjectNotFound);
@@ -223,8 +222,8 @@ impl<T: Config> Pallet<T> {
223222
admin: T::AccountId,
224223
project_id: [u8;32],
225224
) -> DispatchResult {
226-
//ensure admin permissions
227-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
225+
// Ensure admin permissions
226+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::DeleteProject)?;
228227

229228
//Ensure project exists & get project data
230229
let project_data = ProjectsInfo::<T>::get(project_id).ok_or(Error::<T>::ProjectNotFound)?;
@@ -265,8 +264,8 @@ impl<T: Config> Pallet<T> {
265264
AssignAction,
266265
), T::MaxRegistrationsAtTime>,
267266
) -> DispatchResult {
268-
//ensure admin permissions
269-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
267+
// Ensure admin permissions
268+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::AssignUser)?;
270269

271270
//Ensure project exists
272271
ensure!(ProjectsInfo::<T>::contains_key(project_id), Error::<T>::ProjectNotFound);
@@ -377,8 +376,8 @@ impl<T: Config> Pallet<T> {
377376
CUDAction, // 3:action
378377
), T::MaxRegistrationsAtTime>,
379378
) -> DispatchResult {
380-
//ensure admin permissions
381-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
379+
// Ensure admin permissions
380+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::RegisterUser)?;
382381

383382
for user in users{
384383
match user.3 {
@@ -573,8 +572,8 @@ impl<T: Config> Pallet<T> {
573572
Option<[u8;32]>, // 6: expenditure_id
574573
), T::MaxRegistrationsAtTime>,
575574
) -> DispatchResult {
576-
// Ensure admin permissions
577-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
575+
// Ensure admin permissions
576+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::Expenditures)?;
578577

579578
// Ensure project exists
580579
ensure!(<ProjectsInfo<T>>::contains_key(project_id), Error::<T>::ProjectNotFound);
@@ -751,7 +750,6 @@ impl<T: Config> Pallet<T> {
751750
// D R A W D O W N S
752751
// --------------------------------------------------------------------------------------------
753752
// For now drawdowns functions are private, but in the future they may be public
754-
755753
fn do_create_drawdown(
756754
project_id: [u8;32],
757755
drawdown_type: DrawdownType,
@@ -802,8 +800,8 @@ impl<T: Config> Pallet<T> {
802800
admin: T::AccountId,
803801
project_id: [u8;32],
804802
) -> DispatchResult {
805-
// Ensure admin permissions
806-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
803+
// Ensure admin permissions
804+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::Expenditures)?;
807805

808806
// Ensure project exists
809807
ensure!(ProjectsInfo::<T>::contains_key(project_id), Error::<T>::ProjectNotFound);
@@ -821,12 +819,9 @@ impl<T: Config> Pallet<T> {
821819
}
822820

823821
pub fn do_submit_drawdown(
824-
_user: T::AccountId, //TODO: remove underscore when user permissions are implemented
825822
project_id: [u8;32],
826823
drawdown_id: [u8;32],
827824
) -> DispatchResult {
828-
//TODO: Ensure builder & admin permissions
829-
830825
// Ensure project exists & is not completed
831826
Self::is_project_completed(project_id)?;
832827

@@ -873,9 +868,9 @@ impl<T: Config> Pallet<T> {
873868
project_id: [u8;32],
874869
drawdown_id: [u8;32],
875870
) -> DispatchResult {
876-
//ensure admin permissions
877-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
878-
871+
// Ensure admin permissions
872+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::Expenditures)?;
873+
879874
// Get drawdown data & ensure drawdown exists
880875
let drawdown_data = DrawdownsInfo::<T>::get(drawdown_id).ok_or(Error::<T>::DrawdownNotFound)?;
881876

@@ -931,8 +926,8 @@ impl<T: Config> Pallet<T> {
931926
transactions_feedback: Option<BoundedVec<([u8;32], FieldDescription), T::MaxRegistrationsAtTime>>,
932927
drawdown_feedback: Option<BoundedVec<FieldDescription, T::MaxBoundedVecs>>,
933928
) -> DispatchResult {
934-
//ensure admin permissions
935-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
929+
// Ensure admin permissions
930+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::Expenditures)?;
936931

937932
// Get drawdown data & ensure drawdown exists
938933
let drawdown_data = DrawdownsInfo::<T>::get(drawdown_id).ok_or(Error::<T>::DrawdownNotFound)?;
@@ -1011,7 +1006,6 @@ impl<T: Config> Pallet<T> {
10111006
// --------------------------------------------------------------------------------------------
10121007
// For now transactions functions are private, but in the future they may be public
10131008
pub fn do_execute_transactions(
1014-
_user: T::AccountId, //TODO: remove underscore when permissions are implemented
10151009
project_id: [u8;32],
10161010
drawdown_id: [u8;32],
10171011
transactions: BoundedVec<(
@@ -1022,8 +1016,6 @@ impl<T: Config> Pallet<T> {
10221016
Option<[u8;32]>, // transaction_id
10231017
), T::MaxRegistrationsAtTime>,
10241018
) -> DispatchResult {
1025-
// Check permissions here so helper private functions doesn't need to check it
1026-
// TODO: Ensure admin & builder permissions
10271019

10281020
// Ensure project exists & is not completed so helper private functions doesn't need to check it
10291021
Self::is_project_completed(project_id)?;
@@ -1202,14 +1194,15 @@ impl<T: Config> Pallet<T> {
12021194
// B U L K U P L O A D T R A N S A C T I O N S
12031195

12041196
pub fn do_up_bulk_upload(
1205-
_user: T::AccountId, //TODO: Remove underscore when permissions are implemented
1197+
user: T::AccountId, //TODO: Remove underscore when permissions are implemented
12061198
project_id: [u8;32],
12071199
drawdown_id: [u8;32],
12081200
description: FieldDescription,
12091201
total_amount: u64,
12101202
documents: Documents<T>,
12111203
) -> DispatchResult {
1212-
// TODO: Ensure builder permissions
1204+
// Ensure builder permissions
1205+
Self::is_authorized(user, &project_id, ProxyPermission::UpBulkupload)?;
12131206

12141207
// Ensure project is not completed
12151208
Self::is_project_completed(project_id)?;
@@ -1249,8 +1242,8 @@ impl<T: Config> Pallet<T> {
12491242
admin: T::AccountId,
12501243
projects: BoundedVec<([u8;32], Option<u32>, CUDAction), T::MaxRegistrationsAtTime>,
12511244
) -> DispatchResult {
1252-
// Ensure admin permissions
1253-
Self::is_superuser(admin.clone(), &Self::get_global_scope(), ProxyRole::Administrator.id())?;
1245+
// Ensure admin permissions
1246+
Self::is_authorized(admin.clone(), &Self::get_global_scope(), ProxyPermission::Expenditures)?;
12541247

12551248
// Ensure projects is not empty
12561249
ensure!(!projects.is_empty(), Error::<T>::ProjectsIsEmpty);
@@ -1588,7 +1581,6 @@ impl<T: Config> Pallet<T> {
15881581
}
15891582
}
15901583

1591-
#[allow(dead_code)]
15921584
fn is_transaction_editable(
15931585
transaction_id: [u8;32],
15941586
) -> DispatchResult {
@@ -1608,7 +1600,7 @@ impl<T: Config> Pallet<T> {
16081600
}
16091601

16101602

1611-
fn is_authorized( authority: T::AccountId, project_id: &[u8;32], permission: ProxyPermission ) -> DispatchResult{
1603+
pub fn is_authorized( authority: T::AccountId, project_id: &[u8;32], permission: ProxyPermission ) -> DispatchResult{
16121604
T::Rbac::is_authorized(
16131605
authority,
16141606
Self::pallet_id(),
@@ -1617,6 +1609,7 @@ impl<T: Config> Pallet<T> {
16171609
)
16181610
}
16191611

1612+
#[allow(dead_code)]
16201613
fn is_superuser( authority: T::AccountId, scope_global: &[u8;32], rol_id: RoleId ) -> DispatchResult{
16211614
T::Rbac::has_role(
16221615
authority,

‎pallets/proxy-financial/src/lib.rs‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -657,12 +657,13 @@ pub mod pallet {
657657
submit: bool,
658658
) -> DispatchResult {
659659
let who = ensure_signed(origin)?; // origin need to be an admin
660-
660+
// Ensure builder permissions
661+
Self::is_authorized(who, &project_id, ProxyPermission::SubmitDrawdown)?;
662+
661663
match submit{
662664
false => {
663665
// Do execute transactions
664666
Self::do_execute_transactions(
665-
who,
666667
project_id,
667668
drawdown_id,
668669
transactions.ok_or(Error::<T>::EmptyTransactions)?,
@@ -673,15 +674,14 @@ pub mod pallet {
673674
if let Some(transactions) = transactions {
674675
// Do execute transactions
675676
Self::do_execute_transactions(
676-
who.clone(),
677677
project_id,
678678
drawdown_id,
679679
transactions,
680680
)?;
681681
}
682682

683683
// Do submit drawdown
684-
Self::do_submit_drawdown(who, project_id, drawdown_id)
684+
Self::do_submit_drawdown(project_id, drawdown_id)
685685
},
686686
}
687687

@@ -717,29 +717,27 @@ pub mod pallet {
717717
false => {
718718
// 1. Do execute transactions
719719
Self::do_execute_transactions(
720-
who.clone(),
721720
project_id,
722721
drawdown_id,
723722
transactions.ok_or(Error::<T>::EmptyTransactions)?,
724723
)?;
725724

726725
// 2. Do submit drawdown
727-
Self::do_submit_drawdown(who, project_id, drawdown_id)
726+
Self::do_submit_drawdown(project_id, drawdown_id)
728727

729728
},
730729
true => {
731730
// 1.Execute transactions if provided
732731
if let Some(transactions) = transactions {
733732
// Do execute transactions
734733
Self::do_execute_transactions(
735-
who.clone(),
736734
project_id,
737735
drawdown_id,
738736
transactions,
739737
)?;
740738

741739
// 2. Submit drawdown
742-
Self::do_submit_drawdown(who.clone(), project_id, drawdown_id)?;
740+
Self::do_submit_drawdown(project_id, drawdown_id)?;
743741
}
744742

745743
// 3. Approve drawdown

0 commit comments

Comments
 (0)