refactor(permissions): define default permission set

Signed-off-by: Marin Veršić <[email protected]>

crates/iroha/tests/integration/asset.rs

@@ -12,7 +12,7 @@ use iroha::{
     },
 };
 use iroha_config::parameters::actual::Root as Config;
-use iroha_executor_data_model::permission::asset::CanTransferUserAsset;
+use iroha_executor_data_model::permission::asset::CanModifyAsset;
 use iroha_test_network::*;
 use iroha_test_samples::{gen_account_in, ALICE_ID, BOB_ID};
 
@@ -328,7 +328,7 @@ fn find_rate_and_make_exchange_isi_should_succeed() {
 
     let alice_id = ALICE_ID.clone();
     let alice_can_transfer_asset = |asset_id: AssetId, owner_key_pair: KeyPair| {
-        let permission = CanTransferUserAsset {
+        let permission = CanModifyAsset {
             asset: asset_id.clone(),
         };
         let instruction = Grant::account_permission(permission, alice_id.clone());

crates/iroha/tests/integration/events/data.rs

@@ -2,8 +2,8 @@ use std::{fmt::Write as _, sync::mpsc, thread};
 
 use eyre::Result;
 use iroha::data_model::{prelude::*, transaction::WasmSmartContract};
-use iroha_executor_data_model::permission::account::{
-    CanRemoveKeyValueInAccount, CanSetKeyValueInAccount,
+use iroha_executor_data_model::permission::{
+    account::CanModifyAccountMetadata, domain::CanModifyDomainMetadata,
 };
 use iroha_test_network::*;
 use iroha_test_samples::{ALICE_ID, BOB_ID};
@@ -201,21 +201,20 @@ fn produce_multiple_events() -> Result<()> {
     // Registering role
     let alice_id = ALICE_ID.clone();
     let role_id = "TEST_ROLE".parse::<RoleId>()?;
-    let permission_1 = CanRemoveKeyValueInAccount {
+    let permission_1 = CanModifyAccountMetadata {
         account: alice_id.clone(),
     };
-    let permission_2 = CanSetKeyValueInAccount { account: alice_id };
-    let role = iroha::data_model::role::Role::new(role_id.clone())
+    let permission_2 = CanModifyDomainMetadata {
+        domain: alice_id.domain().clone(),
+    };
+
+    let bob_id = BOB_ID.clone();
+    let role = iroha::data_model::role::Role::new(role_id.clone(), bob_id.clone())
         .add_permission(permission_1.clone())
         .add_permission(permission_2.clone());
     let instructions = [Register::role(role.clone())];
     client.submit_all_blocking(instructions)?;
 
-    // Grants role to Bob
-    let bob_id = BOB_ID.clone();
-    let grant_role = Grant::role(role_id.clone(), bob_id.clone());
-    client.submit_blocking(grant_role)?;
-
     // Unregister role
     let unregister_role = Unregister::role(role_id.clone());
     client.submit_blocking(unregister_role)?;
@@ -241,7 +240,7 @@ fn produce_multiple_events() -> Result<()> {
     {
         assert_eq!(*event.account(), bob_id);
         assert_eq!(
-            CanRemoveKeyValueInAccount::try_from(event.permission()).unwrap(),
+            CanModifyAccountMetadata::try_from(event.permission()).unwrap(),
             permission_1
         );
     } else {
@@ -252,7 +251,7 @@ fn produce_multiple_events() -> Result<()> {
     {
         assert_eq!(*event.account(), bob_id);
         assert_eq!(
-            CanSetKeyValueInAccount::try_from(event.permission()).unwrap(),
+            CanModifyDomainMetadata::try_from(event.permission()).unwrap(),
             permission_2
         );
     } else {
@@ -272,7 +271,7 @@ fn produce_multiple_events() -> Result<()> {
     {
         assert_eq!(*event.account(), bob_id);
         assert_eq!(
-            CanRemoveKeyValueInAccount::try_from(event.permission()).unwrap(),
+            CanModifyAccountMetadata::try_from(event.permission()).unwrap(),
             permission_1
         );
     } else {
@@ -283,7 +282,7 @@ fn produce_multiple_events() -> Result<()> {
     {
         assert_eq!(*event.account(), bob_id);
         assert_eq!(
-            CanSetKeyValueInAccount::try_from(event.permission()).unwrap(),
+            CanModifyDomainMetadata::try_from(event.permission()).unwrap(),
             permission_2
         );
     } else {

crates/iroha/tests/integration/multisig.rs

@@ -12,11 +12,14 @@ use iroha::{
         transaction::{TransactionBuilder, WasmSmartContract},
     },
 };
+use iroha_data_model::asset::{AssetDefinition, AssetDefinitionId};
+use iroha_executor_data_model::permission::asset_definition::CanRegisterAssetDefinition;
 use iroha_test_network::*;
 use iroha_test_samples::{gen_account_in, ALICE_ID};
 use nonzero_ext::nonzero;
 
 #[test]
+#[expect(clippy::too_many_lines)]
 fn mutlisig() -> Result<()> {
     let (_rt, _peer, test_client) = <PeerBuilder>::new().with_port(11_400).start_with_runtime();
     wait_for_genesis_committed(&vec![test_client.clone()], 0);
@@ -85,14 +88,15 @@ fn mutlisig() -> Result<()> {
     test_client.submit_blocking(call_trigger)?;
 
     // Check that multisig account exist
-    let account = test_client
-        .query(client::account::all())
-        .filter_with(|account| account.id.eq(multisig_account_id.clone()))
-        .execute_single()
+    test_client
+        .submit_blocking(Grant::account_permission(
+            CanRegisterAssetDefinition {
+                domain: "wonderland".parse().unwrap(),
+            },
+            multisig_account_id.clone(),
+        ))
         .expect("multisig account should be created after the call to register multisig trigger");
 
-    assert_eq!(account.id(), &multisig_account_id);
-
     // Check that multisig trigger exist
     let trigger = test_client
         .query(FindTriggers::new())
@@ -102,8 +106,14 @@ fn mutlisig() -> Result<()> {
 
     assert_eq!(trigger.id(), &multisig_trigger_id);
 
-    let domain_id: DomainId = "domain_controlled_by_multisig".parse().unwrap();
-    let isi = vec![Register::domain(Domain::new(domain_id.clone())).into()];
+    let asset_definition_id = "asset_definition_controlled_by_multisig#wonderland"
+        .parse::<AssetDefinitionId>()
+        .unwrap();
+    let isi =
+        vec![
+            Register::asset_definition(AssetDefinition::numeric(asset_definition_id.clone()))
+                .into(),
+        ];
     let isi_hash = HashOf::new(&isi);
 
     let mut signatories_iter = signatories.into_iter();
@@ -118,12 +128,12 @@ fn mutlisig() -> Result<()> {
         )?;
     }
 
-    // Check that domain isn't created yet
+    // Check that asset definition isn't created yet
     let err = test_client
-        .query(client::domain::all())
-        .filter_with(|domain| domain.id.eq(domain_id.clone()))
+        .query(client::asset::all_definitions())
+        .filter_with(|asset_definition| asset_definition.id.eq(asset_definition_id.clone()))
         .execute_single()
-        .expect_err("domain shouldn't be created before enough votes are collected");
+        .expect_err("asset definition shouldn't be created before enough votes are collected");
     assert!(matches!(err, SingleQueryError::ExpectedOneGotNone));
 
     for (signatory, key_pair) in signatories_iter {
@@ -136,14 +146,14 @@ fn mutlisig() -> Result<()> {
         )?;
     }
 
-    // Check that new domain was created and multisig account is owner
-    let domain = test_client
-        .query(client::domain::all())
-        .filter_with(|domain| domain.id.eq(domain_id.clone()))
+    // Check that new asset definition was created and multisig account is owner
+    let asset_definition = test_client
+        .query(client::asset::all_definitions())
+        .filter_with(|asset_definition| asset_definition.id.eq(asset_definition_id.clone()))
         .execute_single()
-        .expect("domain should be created after enough votes are collected");
+        .expect("asset definition should be created after enough votes are collected");
 
-    assert_eq!(domain.owned_by(), &multisig_account_id);
+    assert_eq!(asset_definition.owned_by(), &multisig_account_id);
 
     Ok(())
 }

crates/iroha/tests/integration/permissions.rs

@@ -10,8 +10,8 @@ use iroha::{
     },
 };
 use iroha_executor_data_model::permission::{
-    asset::{CanSetKeyValueInUserAsset, CanTransferUserAsset},
-    domain::CanSetKeyValueInDomain,
+    asset::{CanModifyAsset, CanModifyAssetMetadata},
+    domain::CanModifyDomainMetadata,
 };
 use iroha_genesis::GenesisBlock;
 use iroha_test_network::{PeerBuilder, *};
@@ -243,7 +243,7 @@ fn permissions_differ_not_only_by_names() {
 
     // Granting permission to Alice to modify metadata in Mouse's hats
     let mouse_hat_id = AssetId::new(hat_definition_id, mouse_id.clone());
-    let mouse_hat_permission = CanSetKeyValueInUserAsset {
+    let mouse_hat_permission = CanModifyAssetMetadata {
         asset: mouse_hat_id.clone(),
     };
     let allow_alice_to_set_key_value_in_hats =
@@ -276,7 +276,7 @@ fn permissions_differ_not_only_by_names() {
         .submit_blocking(set_shoes_color.clone())
         .expect_err("Expected Alice to fail to modify Mouse's shoes");
 
-    let mouse_shoes_permission = CanSetKeyValueInUserAsset {
+    let mouse_shoes_permission = CanModifyAssetMetadata {
         asset: mouse_shoes_id,
     };
     let allow_alice_to_set_key_value_in_shoes =
@@ -326,7 +326,7 @@ fn stored_vs_granted_permission_payload() -> Result<()> {
 
     let mouse_asset = AssetId::new(asset_definition_id, mouse_id.clone());
     let allow_alice_to_set_key_value_in_mouse_asset = Grant::account_permission(
-        Permission::new("CanSetKeyValueInUserAsset".parse().unwrap(), value_json),
+        Permission::new("CanModifyAssetMetadata".parse().unwrap(), value_json),
         alice_id,
     );
 
@@ -359,12 +359,12 @@ fn permissions_are_unified() {
     // Given
     let alice_id = ALICE_ID.clone();
 
-    let permission1 = CanTransferUserAsset {
+    let permission1 = CanModifyAsset {
         asset: format!("rose#wonderland#{alice_id}").parse().unwrap(),
     };
     let allow_alice_to_transfer_rose_1 = Grant::account_permission(permission1, alice_id.clone());
 
-    let permission2 = CanTransferUserAsset {
+    let permission2 = CanModifyAsset {
         asset: format!("rose##{alice_id}").parse().unwrap(),
     };
     let allow_alice_to_transfer_rose_2 = Grant::account_permission(permission2, alice_id);
@@ -389,7 +389,7 @@ fn associated_permissions_removed_on_unregister() {
 
     // register kingdom and give bob permissions in this domain
     let register_domain = Register::domain(kingdom);
-    let bob_to_set_kv_in_domain = CanSetKeyValueInDomain {
+    let bob_to_set_kv_in_domain = CanModifyDomainMetadata {
         domain: kingdom_id.clone(),
     };
     let allow_bob_to_set_kv_in_domain =
@@ -409,7 +409,7 @@ fn associated_permissions_removed_on_unregister() {
         .expect("failed to get permissions for bob")
         .into_iter()
         .any(|permission| {
-            CanSetKeyValueInDomain::try_from(&permission)
+            CanModifyDomainMetadata::try_from(&permission)
                 .is_ok_and(|permission| permission == bob_to_set_kv_in_domain)
         }));
 
@@ -425,7 +425,7 @@ fn associated_permissions_removed_on_unregister() {
         .expect("failed to get permissions for bob")
         .into_iter()
         .any(|permission| {
-            CanSetKeyValueInDomain::try_from(&permission)
+            CanModifyDomainMetadata::try_from(&permission)
                 .is_ok_and(|permission| permission == bob_to_set_kv_in_domain)
         }));
 }
@@ -441,11 +441,12 @@ fn associated_permissions_removed_from_role_on_unregister() {
 
     // register kingdom and give bob permissions in this domain
     let register_domain = Register::domain(kingdom);
-    let set_kv_in_domain = CanSetKeyValueInDomain {
+    let set_kv_in_domain = CanModifyDomainMetadata {
         domain: kingdom_id.clone(),
     };
-    let role = Role::new(role_id.clone()).add_permission(set_kv_in_domain.clone());
-    let register_role = Register::role(role);
+    let register_role = Register::role(
+        Role::new(role_id.clone(), ALICE_ID.clone()).add_permission(set_kv_in_domain.clone()),
+    );
 
     iroha
         .submit_all_blocking::<InstructionBox>([register_domain.into(), register_role.into()])
@@ -459,7 +460,7 @@ fn associated_permissions_removed_from_role_on_unregister() {
         .expect("failed to get role")
         .permissions()
         .any(|permission| {
-            CanSetKeyValueInDomain::try_from(permission)
+            CanModifyDomainMetadata::try_from(permission)
                 .is_ok_and(|permission| permission == set_kv_in_domain)
         }));
 
@@ -476,7 +477,7 @@ fn associated_permissions_removed_from_role_on_unregister() {
         .expect("failed to get role")
         .permissions()
         .any(|permission| {
-            CanSetKeyValueInDomain::try_from(permission)
+            CanModifyDomainMetadata::try_from(permission)
                 .is_ok_and(|permission| permission == set_kv_in_domain)
         }));
 }

crates/iroha/tests/integration/queries/role.rs

@@ -5,7 +5,7 @@ use iroha::{
     client,
     data_model::{prelude::*, query::builder::SingleQueryError},
 };
-use iroha_executor_data_model::permission::account::CanSetKeyValueInAccount;
+use iroha_executor_data_model::permission::account::CanModifyAccountMetadata;
 use iroha_test_network::*;
 use iroha_test_samples::ALICE_ID;
 
@@ -30,7 +30,7 @@ fn find_roles() -> Result<()> {
     let register_roles = role_ids
         .iter()
         .cloned()
-        .map(|role_id| Register::role(Role::new(role_id)))
+        .map(|role_id| Register::role(Role::new(role_id, ALICE_ID.clone())))
         .collect::<Vec<_>>();
     test_client.submit_all_blocking(register_roles)?;
 
@@ -62,7 +62,7 @@ fn find_role_ids() -> Result<()> {
     let register_roles = role_ids
         .iter()
         .cloned()
-        .map(|role_id| Register::role(Role::new(role_id)))
+        .map(|role_id| Register::role(Role::new(role_id, ALICE_ID.clone())))
         .collect::<Vec<_>>();
     test_client.submit_all_blocking(register_roles)?;
 
@@ -83,7 +83,7 @@ fn find_role_by_id() -> Result<()> {
     wait_for_genesis_committed(&[test_client.clone()], 0);
 
     let role_id: RoleId = "root".parse().expect("Valid");
-    let new_role = Role::new(role_id.clone());
+    let new_role = Role::new(role_id.clone(), ALICE_ID.clone());
 
     // Registering role
     let register_role = Register::role(new_role.clone());
@@ -133,21 +133,15 @@ fn find_roles_by_account_id() -> Result<()> {
         .iter()
         .cloned()
         .map(|role_id| {
-            Register::role(Role::new(role_id).add_permission(CanSetKeyValueInAccount {
-                account: alice_id.clone(),
-            }))
+            Register::role(Role::new(role_id, alice_id.clone()).add_permission(
+                CanModifyAccountMetadata {
+                    account: alice_id.clone(),
+                },
+            ))
         })
         .collect::<Vec<_>>();
     test_client.submit_all_blocking(register_roles)?;
 
-    // Granting roles to account
-    let grant_roles = role_ids
-        .iter()
-        .cloned()
-        .map(|role_id| Grant::role(role_id, alice_id.clone()))
-        .collect::<Vec<_>>();
-    test_client.submit_all_blocking(grant_roles)?;
-
     let role_ids = HashSet::from(role_ids);
 
     // Checking results