Skip to content

Commit

Permalink
Oracle: Make permissions account mandatory for all privileged instruc…
Browse files Browse the repository at this point in the history 
…tions (#388)

* Return error on permission-less branch

* Fix permissions error value, adjust PythSimulator and AccountSetup

* Cargo.toml: bump to v2.25.0 for release

* tests: Add a unit test for the permissions validation routine

---------

Co-authored-by: Amin Moghaddam <[email protected]>
  • Loading branch information
@drozdziak1 @m30m
drozdziak1 and m30m authored Nov 20, 2023
1 parent a43baa9 commit aad9c00
Show file tree
Hide file tree
Showing 14 changed files with 375 additions and 124 deletions.
2 changes: 1 addition & 1 deletion Cargo.lock
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion program/rust/Cargo.toml
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "pyth-oracle"
version = "2.24.0"
version = "2.25.0"
edition = "2021"
license = "Apache 2.0"
publish = false
Expand Down
1 change: 1 addition & 0 deletions program/rust/src/tests/mod.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ mod test_add_product;
mod test_add_publisher;
mod test_aggregation;
mod test_c_code;
mod test_check_valid_signable_account_or_permissioned_funding_account;
mod test_del_price;
mod test_del_product;
mod test_del_publisher;
Expand Down
36 changes: 22 additions & 14 deletions program/rust/src/tests/pyth_simulator.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ impl PythSimulator {
rent_epoch: Epoch::default(),
};

// Add to both accounts to program test, now the program is deploy as upgradable
// Add accounts to program test, now the program is deploy as upgradable
program_test.add_account(program_key, program_account);
program_test.add_account(programdata_key, programdata_account);

Expand All @@ -193,7 +193,7 @@ impl PythSimulator {
last_blockhash,
programdata_id: programdata_key,
upgrade_authority: upgrade_authority_keypair,
genesis_keypair,
genesis_keypair: copy_keypair(&genesis_keypair),
};

// Transfer money to upgrade_authority so it can call the instructions
Expand All @@ -202,6 +202,20 @@ impl PythSimulator {
.await
.unwrap();

result
.upd_permissions(
UpdPermissionsArgs {
header: OracleCommand::UpdPermissions.into(),
master_authority: genesis_keypair.pubkey(),
data_curation_authority: genesis_keypair.pubkey(),
security_authority: genesis_keypair.pubkey(),
},
&copy_keypair(&result.upgrade_authority),
)
.await
.unwrap();


result
}

Expand Down Expand Up @@ -268,6 +282,7 @@ impl PythSimulator {
vec![
AccountMeta::new(self.genesis_keypair.pubkey(), true),
AccountMeta::new(mapping_keypair.pubkey(), true),
AccountMeta::new(self.get_permissions_pubkey(), false),
],
);

Expand Down Expand Up @@ -296,6 +311,7 @@ impl PythSimulator {
AccountMeta::new(self.genesis_keypair.pubkey(), true),
AccountMeta::new(mapping_keypair.pubkey(), true),
AccountMeta::new(product_keypair.pubkey(), true),
AccountMeta::new(self.get_permissions_pubkey(), false),
],
);

Expand All @@ -322,6 +338,7 @@ impl PythSimulator {
AccountMeta::new(self.genesis_keypair.pubkey(), true),
AccountMeta::new(mapping_keypair.pubkey(), true),
AccountMeta::new(product_keypair.pubkey(), true),
AccountMeta::new(self.get_permissions_pubkey(), false),
],
);

Expand Down Expand Up @@ -356,6 +373,7 @@ impl PythSimulator {
AccountMeta::new(self.genesis_keypair.pubkey(), true),
AccountMeta::new(product_keypair.pubkey(), true),
AccountMeta::new(price_keypair.pubkey(), true),
AccountMeta::new(self.get_permissions_pubkey(), false),
],
);

Expand Down Expand Up @@ -384,6 +402,7 @@ impl PythSimulator {
vec![
AccountMeta::new(self.genesis_keypair.pubkey(), true),
AccountMeta::new(price_keypair.pubkey(), true),
AccountMeta::new(self.get_permissions_pubkey(), false),
],
);

Expand Down Expand Up @@ -458,6 +477,7 @@ impl PythSimulator {
AccountMeta::new(self.genesis_keypair.pubkey(), true),
AccountMeta::new(product_keypair.pubkey(), true),
AccountMeta::new(price_keypair.pubkey(), true),
AccountMeta::new(self.get_permissions_pubkey(), false),
],
);

Expand Down Expand Up @@ -552,18 +572,6 @@ impl PythSimulator {
.await
.unwrap();

self.upd_permissions(
UpdPermissionsArgs {
header: OracleCommand::UpdPermissions.into(),
master_authority: self.upgrade_authority.pubkey(),
data_curation_authority: self.upgrade_authority.pubkey(),
security_authority,
},
&copy_keypair(&self.upgrade_authority),
)
.await
.unwrap();

let product_metadatas: HashMap<String, ProductMetadata> =
serde_json::from_reader(&result_file).unwrap();

Expand Down
62 changes: 35 additions & 27 deletions program/rust/src/tests/test_add_price.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ use {
accounts::{
clear_account,
MappingAccount,
PermissionAccount,
PriceAccount,
ProductAccount,
PythAccount,
Expand Down Expand Up @@ -53,17 +54,29 @@ fn test_add_price() {
let product_account = product_setup.as_account_info();

let mut price_setup = AccountSetup::new::<PriceAccount>(&program_id);
let mut price_account = price_setup.as_account_info();
let price_account = price_setup.as_account_info();

let mut price_setup_2 = AccountSetup::new::<PriceAccount>(&program_id);
let price_account_2 = price_setup_2.as_account_info();

let mut permissions_setup = AccountSetup::new_permission(&program_id);
let permissions_account = permissions_setup.as_account_info();

{
let mut permissions_account_data =
PermissionAccount::initialize(&permissions_account, PC_VERSION).unwrap();
permissions_account_data.master_authority = *funding_account.key;
permissions_account_data.data_curation_authority = *funding_account.key;
permissions_account_data.security_authority = *funding_account.key;
}

assert!(process_instruction(
&program_id,
&[
funding_account.clone(),
mapping_account.clone(),
product_account.clone()
product_account.clone(),
permissions_account.clone(),
],
instruction_data_add_product
)
Expand All @@ -74,7 +87,8 @@ fn test_add_price() {
&[
funding_account.clone(),
product_account.clone(),
price_account.clone()
price_account.clone(),
permissions_account.clone(),
],
instruction_data_add_price
)
Expand All @@ -96,7 +110,8 @@ fn test_add_price() {
&[
funding_account.clone(),
product_account.clone(),
price_account_2.clone()
price_account_2.clone(),
permissions_account.clone(),
],
instruction_data_add_price
)
Expand All @@ -117,7 +132,13 @@ fn test_add_price() {
assert_eq!(
process_instruction(
&program_id,
&[funding_account.clone(), product_account.clone()],
&[
funding_account.clone(),
product_account.clone(),
price_account.clone(),
permissions_account.clone(),
permissions_account.clone(),
],
instruction_data_add_price
),
Err(OracleError::InvalidNumberOfAccounts.into())
Expand All @@ -130,7 +151,8 @@ fn test_add_price() {
&[
funding_account.clone(),
product_account.clone(),
price_account.clone()
price_account.clone(),
permissions_account.clone(),
],
instruction_data_add_price
),
Expand All @@ -153,47 +175,33 @@ fn test_add_price() {
&[
funding_account.clone(),
product_account.clone(),
price_account.clone()
price_account.clone(),
permissions_account.clone(),
],
instruction_data_add_price
),
Err(ProgramError::InvalidArgument)
);

// Price not signing
// Fresh product account
clear_account(&product_account).unwrap();

hdr_add_price = AddPriceArgs {
header: OracleCommand::AddPrice.into(),
exponent: 6,
price_type: 1,
};

instruction_data_add_price = bytes_of::<AddPriceArgs>(&hdr_add_price);
price_account.is_signer = false;

assert_eq!(
process_instruction(
&program_id,
&[
funding_account.clone(),
product_account.clone(),
price_account.clone()
],
instruction_data_add_price
),
Err(OracleError::InvalidSignableAccount.into())
);

// Fresh product account
price_account.is_signer = true;
clear_account(&product_account).unwrap();

assert_eq!(
process_instruction(
&program_id,
&[
funding_account.clone(),
product_account.clone(),
price_account.clone()
price_account.clone(),
permissions_account.clone(),
],
instruction_data_add_price
),
Expand Down
27 changes: 22 additions & 5 deletions program/rust/src/tests/test_add_product.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ use {
clear_account,
create_pc_str_t,
MappingAccount,
PermissionAccount,
ProductAccount,
PythAccount,
},
Expand Down Expand Up @@ -57,13 +58,25 @@ fn test_add_product() {
let mut product_setup_2 = AccountSetup::new::<ProductAccount>(&program_id);
let product_account_2 = product_setup_2.as_account_info();

let mut permissions_setup = AccountSetup::new_permission(&program_id);
let permissions_account = permissions_setup.as_account_info();

{
let mut permissions_account_data =
PermissionAccount::initialize(&permissions_account, PC_VERSION).unwrap();
permissions_account_data.master_authority = *funding_account.key;
permissions_account_data.data_curation_authority = *funding_account.key;
permissions_account_data.security_authority = *funding_account.key;
}

let mut size = populate_instruction(&mut instruction_data, &[]);
assert!(process_instruction(
&program_id,
&[
funding_account.clone(),
mapping_account.clone(),
product_account.clone()
product_account.clone(),
permissions_account.clone()
],
&instruction_data[..size]
)
Expand Down Expand Up @@ -93,7 +106,8 @@ fn test_add_product() {
&[
funding_account.clone(),
mapping_account.clone(),
product_account_2.clone()
product_account_2.clone(),
permissions_account.clone()
],
&instruction_data[..size]
)
Expand Down Expand Up @@ -131,7 +145,8 @@ fn test_add_product() {
&[
funding_account.clone(),
mapping_account.clone(),
product_account_3.clone()
product_account_3.clone(),
permissions_account.clone()
],
&instruction_data[..size]
),
Expand All @@ -151,7 +166,8 @@ fn test_add_product() {
&[
funding_account.clone(),
mapping_account.clone(),
product_account.clone()
product_account.clone(),
permissions_account.clone()
],
&instruction_data[..size]
)
Expand All @@ -173,7 +189,8 @@ fn test_add_product() {
&[
funding_account.clone(),
mapping_account.clone(),
product_account.clone()
product_account.clone(),
permissions_account.clone()
],
&instruction_data[..size]
),
Expand Down
Loading

0 comments on commit aad9c00

Please sign in to comment.