network service: acl support during endorsement #1462 (#1463)

Author: adecaro

go.mod

@@ -4,20 +4,20 @@ go 1.25.7
 
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.2
-	github.com/IBM/idemix v0.0.2-0.20250313153527-832db18b9478
+	github.com/IBM/idemix v0.0.2
 	github.com/IBM/idemix/bccsp/types v0.0.0-20250313153527-832db18b9478
 	github.com/IBM/mathlib v0.0.3-0.20260204160318-5a4d1a385dfa
 	github.com/dgraph-io/ristretto/v2 v2.4.0
 	github.com/gin-gonic/gin v1.12.0
 	github.com/go-co-op/gocron/v2 v2.19.1
-	github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc
+	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936
 	github.com/hashicorp/go-uuid v1.0.3
-	github.com/hyperledger-labs/fabric-smart-client v0.9.1-0.20260401145159-193d5af7c30b
+	github.com/hyperledger-labs/fabric-smart-client v0.10.0
 	github.com/hyperledger/fabric-chaincode-go/v2 v2.3.0
 	github.com/hyperledger/fabric-lib-go v1.1.3-0.20240523144151-25edd1eaf5f5
 	github.com/hyperledger/fabric-protos-go-apiv2 v0.3.7
 	github.com/hyperledger/fabric-x-common v0.1.1-0.20260219094834-26c5a49ed548
-	github.com/jackc/pgx/v5 v5.8.0
+	github.com/jackc/pgx/v5 v5.9.1
 	github.com/jackc/pgxlisten v0.0.0-20250802141604-12b92425684c
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/onsi/ginkgo/v2 v2.28.1
@@ -39,7 +39,7 @@ require (
 	golang.org/x/sync v0.20.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v2 v2.4.0
-	modernc.org/sqlite v1.47.0
+	modernc.org/sqlite v1.48.0
 )
 
 require (

go.sum

@@ -640,8 +640,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.48.1/go.mod h1:0wEl7vrAD8mehJyohS9HZy+WyEOaQO2mJx86Cvh93kM=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.48.1 h1:8nn+rsCvTq9axyEh382S0PFLBeaFwNsT43IrPWzctRU=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.48.1/go.mod h1:viRWSEhtMZqz1rhwmOVKkWl6SwmVowfL9O2YR5gI2PE=
-github.com/IBM/idemix v0.0.2-0.20250313153527-832db18b9478 h1:SRYueX11TcTMae5PNmE517XKm4H3r7dH8P77DAYR7jw=
-github.com/IBM/idemix v0.0.2-0.20250313153527-832db18b9478/go.mod h1:oyCNerVvY3UsyBc2SugPLUcMb9aNjcWpi0XlxOSSVn4=
+github.com/IBM/idemix v0.0.2 h1:NOOoFx67MdOJePdqUTov6n0XcN79ERqywtsUy0xJx6o=
+github.com/IBM/idemix v0.0.2/go.mod h1:oyCNerVvY3UsyBc2SugPLUcMb9aNjcWpi0XlxOSSVn4=
 github.com/IBM/idemix/bccsp/schemes/aries v0.0.0-20250313153527-832db18b9478 h1:F/HXQolrPW8uoX+LgUOKS0cKMFZv/oJljIkPygSooa8=
 github.com/IBM/idemix/bccsp/schemes/aries v0.0.0-20250313153527-832db18b9478/go.mod h1:526AMO3VPT9tb7yFyNmTCGMrVHW/8T6pRfeREU3gsZo=
 github.com/IBM/idemix/bccsp/schemes/weak-bb v0.0.0-20250313153527-832db18b9478 h1:ak2QCRY64W1H8pF22txUVJlFJQlbdVXJ7eRin4E/kMk=
@@ -986,8 +986,8 @@ github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
 github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
@@ -1063,8 +1063,8 @@ github.com/huin/goupnp v1.3.0 h1:UvLUlWDNpoUdYzb2TCn+MuTWtcjXKSza2n6CBdQ0xXc=
 github.com/huin/goupnp v1.3.0/go.mod h1:gnGPsThkYa7bFi/KWmEysQRf48l2dvR5bxr2OFckNX8=
 github.com/hyperledger-labs/SmartBFT v0.0.0-20250503203013-eb005eef8866 h1:Mu/6NJsfl9g3wM15Ue7hqPq4LtgYDoABh8MO4u8aW4g=
 github.com/hyperledger-labs/SmartBFT v0.0.0-20250503203013-eb005eef8866/go.mod h1:9aNHNXsCVy/leGz2gpTC1eOL5QecxbSAGjqsLh4T1LM=
-github.com/hyperledger-labs/fabric-smart-client v0.9.1-0.20260401145159-193d5af7c30b h1:3Q91ZtPpFoee5jbJCILDc51EAbAJM5a4Zsdd3qAqXME=
-github.com/hyperledger-labs/fabric-smart-client v0.9.1-0.20260401145159-193d5af7c30b/go.mod h1:kywkl6qr9jN3HtHxP9UCHkkGhjTRs+tmutsHgCcac14=
+github.com/hyperledger-labs/fabric-smart-client v0.10.0 h1:cuPgx0+x4rDiGQsZMvmgSLB5dFMLU0TOTUP+hHIe08o=
+github.com/hyperledger-labs/fabric-smart-client v0.10.0/go.mod h1:kywkl6qr9jN3HtHxP9UCHkkGhjTRs+tmutsHgCcac14=
 github.com/hyperledger/aries-bbs-go v0.0.0-20240528084656-761671ea73bc h1:3Ykk6MtyfnlzMOQry9zkxsoLWpCWZwDPqehO/BJwArM=
 github.com/hyperledger/aries-bbs-go v0.0.0-20240528084656-761671ea73bc/go.mod h1:Kofn6A6WWea1ZM8Rys5aBW9dszwJ7Ywa0kyyYL0TPYw=
 github.com/hyperledger/fabric-amcl v0.0.0-20230602173724-9e02669dceb2 h1:B1Nt8hKb//KvgGRprk0h1t4lCnwhE9/ryb1WqfZbV+M=
@@ -1105,8 +1105,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.9.1 h1:uwrxJXBnx76nyISkhr33kQLlUqjv7et7b9FjCen/tdc=
+github.com/jackc/pgx/v5 v5.9.1/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/pgxlisten v0.0.0-20250802141604-12b92425684c h1:on93qgQJqBwjHYjUv51BuS6Q8UlALFAHhsvuR5WVaos=
 github.com/jackc/pgxlisten v0.0.0-20250802141604-12b92425684c/go.mod h1:ygR1JwoRvIb4hhLukHQxSB3u/sRQT4Laylx0rDtNEhE=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
@@ -2429,8 +2429,8 @@ modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
 modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
-modernc.org/sqlite v1.47.0 h1:R1XyaNpoW4Et9yly+I2EeX7pBza/w+pmYee/0HJDyKk=
-modernc.org/sqlite v1.47.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/sqlite v1.48.0 h1:ElZyLop3Q2mHYk5IFPPXADejZrlHu7APbpB0sF78bq4=
+modernc.org/sqlite v1.48.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=

token/services/network/fabric/endorsement/fsc/deps.go

@@ -87,10 +87,20 @@ type MSPManager interface {
 	GetVerifier(identity view.Identity) (driver.Verifier, error)
 }
 
+// ACLProvider offers ACL-related services
+//
+//go:generate counterfeiter -o mock/acl_provider.go -fake-name ACLProvider . ACLProvider
+type ACLProvider interface {
+	// CheckACL checks the ACL for the resource for the Channel using the
+	// SignedProposal from which an id can be extracted for testing against a policy
+	CheckACL(signedProp *fabric.SignedProposal) error
+}
+
 // ChannelProvider provides access to the MSP manager for a given Fabric network and channel.
 //
 //go:generate counterfeiter -o mock/channel_provider.go -fake-name ChannelProvider . ChannelProvider
 type ChannelProvider interface {
 	// GetMSPManager returns the MSP manager for the given network and channel
 	GetMSPManager(network, channel string) (MSPManager, error)
+	GetACLProvider(network, channel string) (ACLProvider, error)
 }

token/services/network/fabric/endorsement/fsc/mock/acl_provider.go

@@ -232,6 +232,14 @@ func (r *RequestApprovalResponderView) validateProposal(ctx view.Context, reques
 		return errors.Wrapf(err, "creator identity is not valid for tx [%s]", request.Anchor)
 	}
 
+	acl, err := r.channelProvider.GetACLProvider(request.TMSID.Network, request.TMSID.Channel)
+	if err != nil {
+		return errors.Wrapf(err, "failed to get ACL provider for tx [%s]", request.Anchor)
+	}
+	if err := acl.CheckACL(request.Tx.SignedProposal()); err != nil {
+		return errors.Wrapf(err, "failed to check ACL for tx [%s]", request.Anchor)
+	}
+
 	// Verify the proposal signature using the creator's verifier.
 	// This ensures the proposal was indeed signed by the claimed creator.
 	verifier, err := mspManager.GetVerifier(creator)