feat: p/demo/accesscontrol & p/demo/timelock

examples/gno.land/p/demo/accesscontrol/accesscontrol.gno

@@ -0,0 +1,108 @@
+// Package accesscontrol provides a library for managing roles and
+// permissions within Gno. It allows for the creation,
+// assignment, and management of roles with specific admin privileges,
+// ensuring that only authorized accounts can perform certain actions.
+// This package utilizes an AVL tree data structure to efficiently track
+// and manage role holders.
+//
+// Example Usage:
+//
+//  import "gno.land/p/demo/accesscontrol"
+//
+//  Create a new role with a specific admin.
+//  adminRole := std.Address("admin-address")
+//  role := accesscontrol.NewRoleData("ExampleRole", adminRole)
+//
+//  Check if an account has a specific role.
+//  account := std.Address("user-address")
+//  hasRole := role.HasRole(account)
+//
+//  Grant a role to a specific account.
+//  role.GrantRole(account)
+//
+//  Revoke a role from a specific account.
+//  role.RevokeRole(account)
+//
+//  Renounce a role with caller confirmation.
+//  role.RenounceRole(std.GetOrigCaller())
+//
+//  Change the admin role for a specific role.
+//  newAdmin := std.Address("new-admin-address")
+//  role.SetRoleAdmin(newAdmin)
+
+package accesscontrol // import "gno.land/p/demo/accesscontrol"
+
+import (
+	"std"
+	"errors"
+	"gno.land/p/demo/avl"
+)
+
+// RoleData struct to store role information
+type RoleData struct {
+	Name      string
+	Holder    *avl.Tree // -> std.Address -> bool
+	AdminRole std.Address
+}
+
+// NewRoleData creates a new instance of RoleData
+func NewRoleData(name string, adminRole std.Address) *RoleData {
+	return &RoleData{
+		Name:      name,
+		Holder:    avl.NewTree(),
+		AdminRole: adminRole,
+	}
+}
+
+// Method to check if the caller has the admin role
+func (roleData *RoleData) AssertOrigCallerIsAdmin() {
+	caller := std.GetOrigCaller()
+	if roleData.AdminRole != caller {
+		panic("accesscontrol: caller does not have the admin role")
+	}
+}
+
+// Method to create a new role within the realm
+func (roleData *RoleData) CreateRole(name string, adminRole std.Address) *RoleData {
+	roleData.AssertOrigCallerIsAdmin()
+    std.Emit("RoleCreated", "roleName", name, "adminRole", adminRole.String(), "sender", std.GetOrigCaller().String())
+    return NewRoleData(name, adminRole)
+}
+
+// Method to check if an account has a specific role
+func (roleData *RoleData) HasRole(account std.Address) bool {
+	return roleData.Holder.Has(account.String())
+}
+
+// Method to grant a role to an account
+func (roleData *RoleData) GrantRole(account std.Address) {
+	roleData.AssertOrigCallerIsAdmin()
+	roleData.Holder.Set(account.String(), true)
+	std.Emit("RoleGranted", "roleName", roleData.Name, "account", account.String(), "sender", std.GetOrigCaller().String())
+}
+
+// Method to revoke a role from an account
+func (roleData *RoleData) RevokeRole(account std.Address) {
+	roleData.AssertOrigCallerIsAdmin()
+	roleData.Holder.Remove(account.String())
+	std.Emit("RoleRevoked", "roleName", roleData.Name, "account", account.String(), "sender", std.GetOrigCaller().String())
+}
+
+// Method to renounce a role with caller confirmation
+func (roleData *RoleData) RenounceRole(callerConfirmation std.Address) error {
+	caller := std.GetOrigCaller()
+	if callerConfirmation != caller {
+		return errors.New("accesscontrol: caller confirmation does not match account")
+	}
+	roleData.Holder.Remove(caller.String())
+	std.Emit("RoleRenounced", "roleName", roleData.Name, "account", caller.String(), "sender", caller.String())
+	return nil
+}
+
+// Method to set the admin role for a specific role
+func (roleData *RoleData) SetRoleAdmin(adminRole std.Address) {
+	roleData.AssertOrigCallerIsAdmin()
+	previousAdminRole := roleData.AdminRole
+	roleData.AdminRole = adminRole
+	std.Emit("RoleAdminChanged", "roleName", roleData.Name, "previousAdminRole", previousAdminRole.String(), "newAdminRole", adminRole.String())
+}

examples/gno.land/p/demo/accesscontrol/accesscontrol_test.gno

@@ -0,0 +1,227 @@
+package accesscontrol
+
+import (
+	"std"
+	"testing"
+
+	"gno.land/p/demo/testutils"
+)
+
+// TestAccessControl verifies the access control functionality.
+func TestAccessControl(t *testing.T) {
+	admin := testutils.TestAddress("admin")
+	user1 := testutils.TestAddress("user1")
+	user2 := testutils.TestAddress("user2")
+
+	// Create new RoleData
+	roleData := NewRoleData("admin", admin)
+
+	// Check initial admin role
+	if roleData.AdminRole != admin {
+		t.Fatalf("expected admin role to be %s, got %s", admin.String(), roleData.AdminRole.String())
+	}
+
+	// Grant role to user1
+	std.TestSetOrigCaller(admin)
+	roleData.GrantRole(user1)
+	if !roleData.HasRole(user1) {
+		t.Fatalf("expected user1 to have role")
+	}
+
+	// Check that user2 does not have the role
+	if roleData.HasRole(user2) {
+		t.Fatalf("expected user2 not to have role")
+	}
+
+	// Revoke role from user1
+	roleData.RevokeRole(user1)
+	if roleData.HasRole(user1) {
+		t.Fatalf("expected user1 not to have role after revocation")
+	}
+
+	// Grant role to user1 again
+	roleData.GrantRole(user1)
+
+	// User1 renounces the role
+	std.TestSetOrigCaller(user1)
+	roleData.RenounceRole(user1)
+	if roleData.HasRole(user1) {
+		t.Fatalf("expected user1 not to have role after renouncing")
+	}
+
+	// Change admin role to user2
+	std.TestSetOrigCaller(admin)
+	roleData.SetRoleAdmin(user2)
+	if roleData.AdminRole != user2 {
+		t.Fatalf("expected admin role to be %s, got %s", user2.String(), roleData.AdminRole.String())
+	}
+
+	// User1 (now not admin) tries to grant role to user2, should panic
+	std.TestSetOrigCaller(user1)
+	defer func() {
+		if r := recover(); r == nil {
+			t.Fatalf("expected panic when non-admin tries to grant role")
+		}
+	}()
+	roleData.GrantRole(user2)
+}
+
+// TestCreateRole tests the CreateRole method of the RoleData struct
+func TestCreateRole(t *testing.T) {
+	// Simulate the administrator as the current caller
+	admin := testutils.TestAddress("admin")
+	std.TestSetOrigCaller(admin)
+
+	// Create role data with the administrator
+	roleData := NewRoleData("admin", admin)
+
+	// Create a new role with a new administrator address
+	newAdmin := testutils.TestAddress("newAdmin")
+	newRoleName := "newRole"
+	newRole := roleData.CreateRole(newRoleName, newAdmin)
+
+	// Check that the new role has been created correctly
+	if newRole.Name != newRoleName {
+		t.Fatalf("expected new role name to be '%s', got '%s'", newRoleName, newRole.Name)
+	}
+	if newRole.AdminRole != newAdmin {
+		t.Fatalf("expected new role admin role to be %s, got %s", newAdmin.String(), newRole.AdminRole.String())
+	}
+
+	// Simulate newAdmin as the current caller
+	std.TestSetOrigCaller(newAdmin)
+
+	// Explicitly add the role to the new administrator to check functionality
+	newRole.GrantRole(newAdmin)
+
+	// Check if the new role has been added to the holder
+	if !newRole.HasRole(newAdmin) {
+		t.Fatalf("expected new role to be added to the holder")
+	}
+}
+
+// TestOnlyAdmin verifies the OnlyAdmin method.
+func TestAssertOrigCallerIsAdmin(t *testing.T) {
+	adminRole := testutils.TestAddress("admin-address")
+	roleData := NewRoleData("ExampleRole", adminRole)
+	// Call AssertOrigCallerIsAdmin with admin caller
+	std.TestSetOrigCaller(adminRole)
+	defer func () {
+		if r := recover(); r != nil {
+			t.Fatalf("expected no panic, got %v", r)
+		}
+	}() 
+	roleData.AssertOrigCallerIsAdmin()
+	// Call AssertOrigCallerIsAdmin with non-admin caller
+	user := testutils.TestAddress("user-address")
+	std.TestSetOrigCaller(user)
+	defer func () {
+		if r := recover(); r == nil {
+			t.Fatalf("expected panic, got nil")
+		}
+	}()
+	roleData.AssertOrigCallerIsAdmin()
+}
+
+// Testing the RevokeRole Method for a Non-Admin
+func TestRevokeRoleNonAdmin(t *testing.T) {
+	admin := testutils.TestAddress("admin")
+	user1 := testutils.TestAddress("user1")
+	user2 := testutils.TestAddress("user2")
+
+	// Create role data with the administrator
+	roleData := NewRoleData("admin", admin)
+
+	// Grant role to user1
+	std.TestSetOrigCaller(admin)
+	roleData.GrantRole(user1)
+	if !roleData.HasRole(user1) {
+		t.Fatalf("expected user1 to have role")
+	}
+
+	// Simulate user2 as the current caller
+	std.TestSetOrigCaller(user2)
+
+	// Attempting to revoke user1's role as user2 (non-admin)
+	defer func() {
+		if r := recover(); r == nil {
+			t.Fatalf("expected panic when non-admin tries to revoke role")
+		}
+	}()
+	roleData.RevokeRole(user1)
+}
+
+// Testing the RenounceRole method with Invalid Confirmation
+func TestRenounceRole(t *testing.T) {
+	adminRole := testutils.TestAddress("admin-address")
+	roleData := NewRoleData("ExampleRole", adminRole)
+	account := testutils.TestAddress("user-address")
+	// Simulate the administrator as the current caller
+	std.TestSetOrigCaller(adminRole)
+	// Grant role to the account
+	roleData.GrantRole(account)
+	// Simulate the account as the current caller
+	std.TestSetOrigCaller(account)
+	// Renounce the role
+	err := roleData.RenounceRole(account)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+	// Check if the account still has the role
+	hasRole := roleData.HasRole(account)
+	if hasRole {
+		t.Fatalf("expected account not to have role after renouncing")
+	}
+}
+
+// Testing the SetRoleAdmin method with a New Administrator Address
+func TestSetRoleAdmin(t *testing.T) {
+	admin := testutils.TestAddress("admin")
+	newAdmin := testutils.TestAddress("newAdmin")
+	user := testutils.TestAddress("user")
+
+	// Create role data with the administrator
+	roleData := NewRoleData("admin", admin)
+
+	// Check that the initial administrator is correct
+	if roleData.AdminRole != admin {
+		t.Fatalf("expected initial admin to be %s, got %s", admin.String(), roleData.AdminRole.String())
+	}
+
+	// Simulate admin as current caller
+	std.TestSetOrigCaller(admin)
+
+	// Change administrator
+	roleData.SetRoleAdmin(newAdmin)
+
+	std.TestSetOrigCaller(newAdmin)
+
+	// Check that the new administrator is correct
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("expected no panic, got %v", r)
+		}
+	}()
+	roleData.AssertOrigCallerIsAdmin()
+
+	// Simulate newAdmin as the current caller
+	std.TestSetOrigCaller(newAdmin)
+	roleData.AssertOrigCallerIsAdmin() // Should not panic
+
+	// Add a role to a user
+	roleData.GrantRole(user)
+	if !roleData.HasRole(user) {
+		t.Fatalf("expected user to have role")
+	}
+
+	// Simulate initial admin as current caller
+	std.TestSetOrigCaller(admin)
+
+	// Attempting to revoke a user's role by the former administrator should cause panic
+	defer func() {
+		if r := recover(); r == nil {
+			t.Fatalf("expected panic when former admin tries to revoke role")
+		}
+	}()
+	roleData.RevokeRole(user)
+}

examples/gno.land/p/demo/accesscontrol/gno.mod

@@ -0,0 +1,6 @@
+module gno.land/p/demo/accesscontrol
+
+require (
+	gno.land/p/demo/avl v0.0.0-latest
+	gno.land/p/demo/testutils v0.0.0-latest
+)

examples/gno.land/p/demo/timelock/gno.mod

@@ -0,0 +1,8 @@
+module gno.land/p/demo/timelock
+
+require (
+	gno.land/p/demo/accesscontrol v0.0.0-latest
+	gno.land/p/demo/avl v0.0.0-latest
+	gno.land/p/demo/seqid v0.0.0-latest
+	gno.land/p/demo/ufmt v0.0.0-latest
+)