From b7afe48ed0bfef30836e7ca6359c2d8bb594d16e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bastian=20K=C3=B6cher?= <git@kchr.de>
Date: Fri, 27 Dec 2024 13:43:13 +0100
Subject: [PATCH] paras-registrar: Improve error reporting (#6989)

This pr improves the error reporting by paras registrar when an owner
wants to access a locked parachain.

Closes: https://github.com/paritytech/polkadot-sdk/issues/6745

---------

Co-authored-by: command-bot <>
---
 .../runtime/common/src/paras_registrar/mod.rs | 31 ++++++++++---------
 .../common/src/paras_registrar/tests.rs       |  2 +-
 prdoc/pr_6989.prdoc                           | 10 ++++++
 3 files changed, 27 insertions(+), 16 deletions(-)
 create mode 100644 prdoc/pr_6989.prdoc

diff --git a/polkadot/runtime/common/src/paras_registrar/mod.rs b/polkadot/runtime/common/src/paras_registrar/mod.rs
index 07832bba18ed..aed0729c9d51 100644
--- a/polkadot/runtime/common/src/paras_registrar/mod.rs
+++ b/polkadot/runtime/common/src/paras_registrar/mod.rs
@@ -561,15 +561,16 @@ impl<T: Config> Pallet<T> {
 		origin: <T as frame_system::Config>::RuntimeOrigin,
 		id: ParaId,
 	) -> DispatchResult {
-		ensure_signed(origin.clone())
-			.map_err(|e| e.into())
-			.and_then(|who| -> DispatchResult {
-				let para_info = Paras::<T>::get(id).ok_or(Error::<T>::NotRegistered)?;
+		if let Ok(who) = ensure_signed(origin.clone()) {
+			let para_info = Paras::<T>::get(id).ok_or(Error::<T>::NotRegistered)?;
+
+			if para_info.manager == who {
 				ensure!(!para_info.is_locked(), Error::<T>::ParaLocked);
-				ensure!(para_info.manager == who, Error::<T>::NotOwner);
-				Ok(())
-			})
-			.or_else(|_| -> DispatchResult { Self::ensure_root_or_para(origin, id) })
+				return Ok(())
+			}
+		}
+
+		Self::ensure_root_or_para(origin, id)
 	}
 
 	/// Ensure the origin is one of Root or the `para` itself.
@@ -577,14 +578,14 @@ impl<T: Config> Pallet<T> {
 		origin: <T as frame_system::Config>::RuntimeOrigin,
 		id: ParaId,
 	) -> DispatchResult {
-		if let Ok(caller_id) = ensure_parachain(<T as Config>::RuntimeOrigin::from(origin.clone()))
-		{
-			// Check if matching para id...
-			ensure!(caller_id == id, Error::<T>::NotOwner);
-		} else {
-			// Check if root...
-			ensure_root(origin.clone())?;
+		if ensure_root(origin.clone()).is_ok() {
+			return Ok(())
 		}
+
+		let caller_id = ensure_parachain(<T as Config>::RuntimeOrigin::from(origin))?;
+		// Check if matching para id...
+		ensure!(caller_id == id, Error::<T>::NotOwner);
+
 		Ok(())
 	}
 
diff --git a/polkadot/runtime/common/src/paras_registrar/tests.rs b/polkadot/runtime/common/src/paras_registrar/tests.rs
index 252de8f349da..66fef31c9afd 100644
--- a/polkadot/runtime/common/src/paras_registrar/tests.rs
+++ b/polkadot/runtime/common/src/paras_registrar/tests.rs
@@ -442,7 +442,7 @@ fn para_lock_works() {
 		// Owner cannot pass origin check when checking lock
 		assert_noop!(
 			mock::Registrar::ensure_root_para_or_owner(RuntimeOrigin::signed(1), para_id),
-			BadOrigin
+			Error::<Test>::ParaLocked,
 		);
 		// Owner cannot remove lock.
 		assert_noop!(mock::Registrar::remove_lock(RuntimeOrigin::signed(1), para_id), BadOrigin);
diff --git a/prdoc/pr_6989.prdoc b/prdoc/pr_6989.prdoc
new file mode 100644
index 000000000000..86c56698d41e
--- /dev/null
+++ b/prdoc/pr_6989.prdoc
@@ -0,0 +1,10 @@
+title: 'paras-registrar: Improve error reporting'
+doc:
+- audience: Runtime User
+  description: |-
+    This pr improves the error reporting by paras registrar when an owner wants to access a locked parachain.
+
+    Closes: https://github.com/paritytech/polkadot-sdk/issues/6745
+crates:
+- name: polkadot-runtime-common
+  bump: patch