morph: Use Global scope for proxy contract #999

Merged

fyrchik merged 1 commits from fyrchik/frostfs-node:fix-morph-proxy into master

2024-02-21 20:34:49 +00:00

fyrchik commented

2024-02-20 16:01:49 +00:00

Owner

Proxy contract can now be used as an owner of NNS domains, thus we need
it not only to pay for the transaction but also to check domain
ownership.

Testing (fails on master, passes on this PR):

create namespace in the frostfsid contract (key from devenv wallet)

ADM="../node/bin/frostfs-adm"
$ADM morph frostfsid create-namespace -c frostfs-adm.yml --namespace kapusta
$ADM morph frostfsid create-subject -c frostfs-adm.yml --subject-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a --subject-name omg --namespace kapusta

create domain which is owned by proxy contract (playground.ns)

func TestKek(t *testing.T) {
	ctx := context.Background()
	endpoint := "http://morph-chain.frostfs.devenv:30333"
    devenvPath := "/repo/frostfs/dev-env"
	c, err := rpcclient.New(ctx, endpoint, rpcclient.Options{
		MaxConnsPerHost: 10,
		RequestTimeout:  10 * time.Second,
	})
	require.NoError(t, err)

	w, err := wallet.NewWalletFromFile(devenvPath + "/services/ir/az.json")
	require.NoError(t, err)
	a, err := helper.GetWalletAccount(w, "committee")
	require.NoError(t, err)
	require.NoError(t, a.Decrypt("one", keys.NEP2ScryptParams()))

	cs, err := c.GetContractStateByID(1)
	require.NoError(t, err)

	proxy, err := helper.NNSResolveHash(invoker.New(c, nil), cs.Hash, "proxy.frostfs")
	require.NoError(t, err)

	act, err := actor.New(c, []actor.SignerAccount{
		{
			Signer: transaction.Signer{
				Account: proxy,
				Scopes:  transaction.Global,
			},
			Account: wallet.NewContractAccount(proxy),
		},
		{
			Signer: transaction.Signer{
				Account: a.Contract.ScriptHash(),
				Scopes:  transaction.Global,
			},
			Account: a,
		}})
	require.NoError(t, err)

	params := []any{
		"ns",
		a.Contract.ScriptHash(),
		constants.FrostfsOpsEmail,
		int64(3600), int64(600), int64(constants.DefaultExpirationTime), int64(3600),
	}
	_, err = act.Wait(act.SendCall(cs.Hash, "register", params...))
	require.NoError(t, err)

	params[0] = "kapusta.ns"
	params[1] = proxy
	_, err = act.Wait(act.SendCall(cs.Hash, "register", params...))
	require.NoError(t, err)
}

create a container with this NNS_ZONE attribute

bin/frostfs-cli container create --policy 'REP 1' -r s01.frostfs.devenv:8080 -w ../dev-env/wallets/wallet.json --await --trace --force --nns-name kek --nns-zone kapusta.ns

Proxy contract can now be used as an owner of NNS domains, thus we need it not only to pay for the transaction but also to check domain ownership. Testing (fails on master, passes on this PR): - create namespace in the frostfsid contract (key from devenv wallet) ```bash ADM="../node/bin/frostfs-adm" $ADM morph frostfsid create-namespace -c frostfs-adm.yml --namespace kapusta $ADM morph frostfsid create-subject -c frostfs-adm.yml --subject-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a --subject-name omg --namespace kapusta ``` - create domain which is owned by proxy contract (`playground.ns`) ```go func TestKek(t *testing.T) { ctx := context.Background() endpoint := "http://morph-chain.frostfs.devenv:30333" devenvPath := "/repo/frostfs/dev-env" c, err := rpcclient.New(ctx, endpoint, rpcclient.Options{ MaxConnsPerHost: 10, RequestTimeout: 10 * time.Second, }) require.NoError(t, err) w, err := wallet.NewWalletFromFile(devenvPath + "/services/ir/az.json") require.NoError(t, err) a, err := helper.GetWalletAccount(w, "committee") require.NoError(t, err) require.NoError(t, a.Decrypt("one", keys.NEP2ScryptParams())) cs, err := c.GetContractStateByID(1) require.NoError(t, err) proxy, err := helper.NNSResolveHash(invoker.New(c, nil), cs.Hash, "proxy.frostfs") require.NoError(t, err) act, err := actor.New(c, []actor.SignerAccount{ { Signer: transaction.Signer{ Account: proxy, Scopes: transaction.Global, }, Account: wallet.NewContractAccount(proxy), }, { Signer: transaction.Signer{ Account: a.Contract.ScriptHash(), Scopes: transaction.Global, }, Account: a, }}) require.NoError(t, err) params := []any{ "ns", a.Contract.ScriptHash(), constants.FrostfsOpsEmail, int64(3600), int64(600), int64(constants.DefaultExpirationTime), int64(3600), } _, err = act.Wait(act.SendCall(cs.Hash, "register", params...)) require.NoError(t, err) params[0] = "kapusta.ns" params[1] = proxy _, err = act.Wait(act.SendCall(cs.Hash, "register", params...)) require.NoError(t, err) } ``` - create a container with this NNS_ZONE attribute ```bash bin/frostfs-cli container create --policy 'REP 1' -r s01.frostfs.devenv:8080 -w ../dev-env/wallets/wallet.json --await --trace --force --nns-name kek --nns-zone kapusta.ns ```