check caller in connected program (#119)

Author: skosito

programs/examples/connected/Cargo.toml

@@ -15,6 +15,7 @@ no-entrypoint = []
 no-idl = []
 no-log-ix-name = []
 idl-build = ["anchor-lang/idl-build", "anchor-spl/idl-build"]
+dev = ["gateway/dev"]
 
 [dependencies]
 anchor-lang = { version = "=0.31.1" }

programs/examples/connected/src/lib.rs

@@ -1,4 +1,5 @@
 use anchor_lang::prelude::*;
+use anchor_lang::solana_program::{sysvar, sysvar::instructions::get_instruction_relative};
 use std::mem::size_of;
 
 declare_id!("4xEw862A2SEwMjofPkUyd4NEekmVJKJsdHkK3UkAtDrc");
@@ -18,6 +19,26 @@ pub mod connected {
         sender: [u8; 20],
         data: Vec<u8>,
     ) -> Result<()> {
+        // NOTE: this is an illustration how connected programs can check if caller is gateway
+        // it is up to connected programs to configure sysvar account in remaining_accounts
+        // same approach can be used on on_revert and SPL connected programs
+        let current_ix = get_instruction_relative(
+            0,
+            &ctx.accounts.instruction_sysvar_account.to_account_info(),
+        )
+        .unwrap();
+
+        msg!(
+            "on_call invoked by: {}, gateway is {}",
+            current_ix.program_id,
+            gateway::ID
+        );
+
+        require!(
+            current_ix.program_id == gateway::ID,
+            ErrorCode::InvalidCaller
+        );
+
         let pda = &mut ctx.accounts.pda;
 
         // Store the sender's public key
@@ -131,6 +152,10 @@ pub struct OnCall<'info> {
     pub random_wallet: UncheckedAccount<'info>,
 
     pub system_program: Program<'info, System>,
+
+    /// CHECK: This is test program.
+    #[account(address = sysvar::instructions::id())]
+    instruction_sysvar_account: UncheckedAccount<'info>,
 }
 
 #[derive(Accounts)]
@@ -174,4 +199,7 @@ pub enum ErrorCode {
 
     #[msg("Revert message detected. Transaction execution halted.")]
     RevertMessage,
+
+    #[msg("Caller is not the gateway program.")]
+    InvalidCaller,
 }

tests/gateway.ts

@@ -870,6 +870,11 @@ describe("Gateway", () => {
           isSigner: false,
           isWritable: false,
         },
+        {
+          pubkey: anchor.web3.SYSVAR_INSTRUCTIONS_PUBKEY,
+          isSigner: false,
+          isWritable: false,
+        },
       ])
       .rpc();
 
@@ -962,6 +967,11 @@ describe("Gateway", () => {
             isSigner: false,
             isWritable: false,
           },
+          {
+            pubkey: anchor.web3.SYSVAR_INSTRUCTIONS_PUBKEY,
+            isSigner: false,
+            isWritable: false,
+          },
         ])
         .rpc();
       throw new Error("Expected error not thrown"); // This line will make the test fail if no error is thrown
@@ -1035,6 +1045,11 @@ describe("Gateway", () => {
             isSigner: false,
             isWritable: false,
           },
+          {
+            pubkey: anchor.web3.SYSVAR_INSTRUCTIONS_PUBKEY,
+            isSigner: false,
+            isWritable: false,
+          },
         ])
         .rpc();
       throw new Error("Expected error not thrown"); // This line will make the test fail if no error is thrown
@@ -1110,6 +1125,11 @@ describe("Gateway", () => {
             isSigner: false,
             isWritable: false,
           },
+          {
+            pubkey: anchor.web3.SYSVAR_INSTRUCTIONS_PUBKEY,
+            isSigner: false,
+            isWritable: false,
+          },
         ])
         .rpc();
       throw new Error("Expected error not thrown"); // This line will make the test fail if no error is thrown
@@ -1185,6 +1205,11 @@ describe("Gateway", () => {
             isSigner: false,
             isWritable: false,
           },
+          {
+            pubkey: anchor.web3.SYSVAR_INSTRUCTIONS_PUBKEY,
+            isSigner: false,
+            isWritable: false,
+          },
         ])
         .rpc();
       throw new Error("Expected error not thrown"); // This line will make the test fail if no error is thrown