Implement access control for AccountStore members #3204
Conversation
silva-fj
force-pushed
the
p-1240-implement-access-control-for-accountstore-members-in-the
branch
from
d9a4b41 to
8cabe70
Compare
| return Err(Error::<T>::NoPermission); | ||
| } | ||
| }, | ||
| _ => return Ok(()), |
There was a problem hiding this comment.
Just wondering: is it better to return error here?
There was a problem hiding this comment.
Returning Err means the member account does not have permissions, but that's not the case if it reaches this point.
The permissions for the call are checked at the beginning of the method, the extra checks for add_account and set_permissions are to make sure the caller cannot set permissions or add an account with more permissions than it (the caller) has. For all the other calls the permissions have already been checked.
There was a problem hiding this comment.
The reason I ask is: ensure_permission is only called by add_account and set_permissions.
There was a problem hiding this comment.
ensure_permissions is called on dispatch_as_signed and dispatch_as_omni_account (in this case the call to dispatch could be add_account or set_permissions for example)
…ore-members-in-the
As topic, this PR introduces an access control mechanism for the OmniAccount (AccountStore) members.