Allow finalized marker manager to modify grants (#549)

* Allow manager to adjust grants on finalized marker

* changelog

CHANGELOG.md

@@ -47,6 +47,7 @@ Ref: https://keepachangelog.com/en/1.0.0/
 ### Bug Fixes
 
 * When deleting a scope, require the same permissions as when updating it [#473](https://github.com/provenance-io/provenance/issues/473)
+* Allow manager to adjust grants on finalized markers [#545](https://github.com/provenance-io/provenance/issues/545)
 
 ## [v1.7.5](https://github.com/provenance-io/provenance/releases/tag/v1.7.5) - 2021-10-22
 

x/marker/keeper/keeper_test.go

@@ -228,13 +228,15 @@ func TestAccountKeeperManageAccess(t *testing.T) {
 	_, err = app.MarkerKeeper.GetMarker(ctx, addr)
 	require.NoError(t, err)
 
-	// Grant access and check (fails on a Finalized marker without Admin grant)
-	require.Error(t, app.MarkerKeeper.AddAccess(ctx, user1, "testcoin",
-		types.NewAccessGrant(user2, []types.Access{types.Access_Mint})))
-	// Remove access fails for Finalized Marker without Admin grant
-	require.Error(t, app.MarkerKeeper.RemoveAccess(ctx, user1, "testcoin", user2))
+	// Manager can make changes to grants for finalized markers
+	require.NoError(t, app.MarkerKeeper.RemoveAccess(ctx, user1, "testcoin", user1))
+	require.NoError(t, app.MarkerKeeper.AddAccess(ctx, user1, "testcoin",
+		types.NewAccessGrant(user1, []types.Access{types.Access_Burn})))
 
-	// Admin can make changes to grants for active markers
+	// Unauthorized user can not manipulate finalized marker grants
+	require.Error(t, app.MarkerKeeper.RemoveAccess(ctx, user2, "testcoin", user1))
+
+	// Admin can make changes to grants for finalized markers
 	require.NoError(t, app.MarkerKeeper.AddAccess(ctx, admin, "testcoin",
 		types.NewAccessGrant(user2, []types.Access{types.Access_Mint, types.Access_Delete})))
 	_, err = app.MarkerKeeper.GetMarker(ctx, addr)

x/marker/keeper/marker.go

@@ -108,8 +108,10 @@ func (k Keeper) AddAccess(
 	switch m.GetStatus() {
 	// marker is fixed/active, assert permission to make changes by checking for Grant Permission
 	case types.StatusFinalized, types.StatusActive:
-		if !m.AddressHasAccess(caller, types.Access_Admin) && !k.accountControlsAllSupply(ctx, caller, m) {
-			return fmt.Errorf("%s is not authorized to make access list changes against active %s marker",
+		if !(caller.Equals(m.GetManager()) && m.GetStatus() == types.StatusFinalized) &&
+			!m.AddressHasAccess(caller, types.Access_Admin) &&
+			!k.accountControlsAllSupply(ctx, caller, m) {
+			return fmt.Errorf("%s is not authorized to make access list changes against finalized/active %s marker",
 				caller, m.GetDenom())
 		}
 		fallthrough
@@ -151,8 +153,10 @@ func (k Keeper) RemoveAccess(ctx sdk.Context, caller sdk.AccAddress, denom strin
 	switch m.GetStatus() {
 	// marker is fixed/active, assert permission to make changes by checking for Grant Permission
 	case types.StatusFinalized, types.StatusActive:
-		if !m.AddressHasAccess(caller, types.Access_Admin) && !k.accountControlsAllSupply(ctx, caller, m) {
-			return fmt.Errorf("%s is not authorized to make access list changes against active %s marker",
+		if !(caller.Equals(m.GetManager()) && m.GetStatus() == types.StatusFinalized) &&
+			!m.AddressHasAccess(caller, types.Access_Admin) &&
+			!k.accountControlsAllSupply(ctx, caller, m) {
+			return fmt.Errorf("%s is not authorized to make access list changes against finalized/active %s marker",
 				caller, m.GetDenom())
 		}
 		fallthrough