Permission rly v2 per client (#8172)

* define params v2 type

* add validation tests

* set in keeper per clientID

* simplify msg

* permission params to authority and client creator

* consistency on string check

* use bech32 consistently

* add permissioning to updateClient and v2 rly msgs

* updateclient test

* test permissioning

* lint

* add queries

* prevent re-registerCounterparty

* change params to config

* cleanup and lint

* permission rly cli + delete creator msg (#8174)

* add cli commands for client params and creator

* add queries to parent cmd

* add delete client creator msg

* add tests

* fix after merge

* fix client config cli

---------

Co-authored-by: Gjermund Garaba <[email protected]>

Author: AdityaSripal

modules/apps/transfer/types/packet.pb.go

@@ -29,6 +29,9 @@ func GetQueryCmd() *cobra.Command {
 		GetCmdQueryHeader(),
 		GetCmdSelfConsensusState(),
 		GetCmdClientParams(),
+		GetCmdClientParams(),
+		GetCmdQueryClientCreator(),
+		GetCmdQueryClientConfig(),
 	)
 
 	return queryCmd
@@ -52,6 +55,8 @@ func NewTxCmd() *cobra.Command {
 		newUpgradeClientCmd(),
 		newSubmitRecoverClientProposalCmd(),
 		newScheduleIBCUpgradeProposalCmd(),
+		newUpdateClientConfigCmd(),
+		newDeleteClientCreatorCmd(),
 	)
 
 	return txCmd

modules/core/02-client/client/cli/cli.go

@@ -59,6 +59,7 @@ func GetCmdQueryClientStates() *cobra.Command {
 	return cmd
 }
 
+// GetCmdQueryCounterpartyInfo defines the command to query the counterparty chain
 func GetCmdQueryCounterpartyInfo() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "counterparty-info [client-id]",
@@ -91,6 +92,72 @@ func GetCmdQueryCounterpartyInfo() *cobra.Command {
 	return cmd
 }
 
+// GetCmdQueryClientCreator defines the command to query the creator of a client
+func GetCmdQueryClientCreator() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "creator [client-id]",
+		Short:   "Query a client's creator",
+		Long:    "Query a client's creator",
+		Example: fmt.Sprintf("%s query %s %s creator 08-wasm-0", version.AppName, ibcexported.ModuleName, types.SubModuleName),
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			clientCtx, err := client.GetClientQueryContext(cmd)
+			if err != nil {
+				return err
+			}
+			clientID := args[0]
+
+			queryClient := types.NewQueryClient(clientCtx)
+			req := &types.QueryClientCreatorRequest{
+				ClientId: clientID,
+			}
+			paramsResp, err := queryClient.ClientCreator(cmd.Context(), req)
+			if err != nil {
+				return err
+			}
+
+			return clientCtx.PrintProto(paramsResp)
+		},
+	}
+
+	flags.AddQueryFlagsToCmd(cmd)
+
+	return cmd
+}
+
+// GetCmdQueryClientConfig defines the command to query a client's configuration
+func GetCmdQueryClientConfig() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "config [client-id]",
+		Short:   "Query a client's config",
+		Long:    "Query a client's config",
+		Example: fmt.Sprintf("%s query %s %s params 08-wasm-0", version.AppName, ibcexported.ModuleName, types.SubModuleName),
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			clientCtx, err := client.GetClientQueryContext(cmd)
+			if err != nil {
+				return err
+			}
+			clientID := args[0]
+
+			queryClient := clienttypesv2.NewQueryClient(clientCtx)
+			req := &clienttypesv2.QueryConfigRequest{
+				ClientId: clientID,
+			}
+			paramsResp, err := queryClient.Config(cmd.Context(), req)
+			if err != nil {
+				return err
+			}
+
+			return clientCtx.PrintProto(paramsResp)
+		},
+	}
+
+	flags.AddQueryFlagsToCmd(cmd)
+
+	return cmd
+}
+
 // GetCmdQueryClientState defines the command to query the state of a client with
 // a given id as defined in https://github.com/cosmos/ibc/tree/master/spec/core/ics-002-client-semantics#query
 func GetCmdQueryClientState() *cobra.Command {

modules/core/02-client/client/cli/query.go

@@ -123,6 +123,64 @@ func newAddCounterpartyCmd() *cobra.Command {
 	return cmd
 }
 
+// newDeleteClientCreatorCmd defines the command to delete the client creator for a given client.
+func newDeleteClientCreatorCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "delete-client-creator [client-id]",
+		Short:   "delete the client creator",
+		Example: fmt.Sprintf("%s tx ibc %s delete-client-creator 07-tendermint-0", version.AppName, types.SubModuleName),
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			clientCtx, err := client.GetClientTxContext(cmd)
+			if err != nil {
+				return err
+			}
+
+			clientID := args[0]
+
+			msg := types.NewMsgDeleteClientCreator(clientID, clientCtx.GetFromAddress().String())
+
+			return tx.GenerateOrBroadcastTxCLI(clientCtx, cmd.Flags(), msg)
+		},
+	}
+
+	flags.AddTxFlagsToCmd(cmd)
+	return cmd
+}
+
+// newUpdateClientConfigCmd defines the command to update the client config (allowed relayers) for a given client.
+func newUpdateClientConfigCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "update-client-config client-id [allowed-relayer-addresses...]",
+		Short:   "update allowed relayers for a client (replaces existing list, and no addresses means empty list and permissionless relaying)",
+		Example: fmt.Sprintf("%s tx ibc %s update-client-params 08-wasm-0 cosmos123... cosmos456...", version.AppName, types.SubModuleName),
+		Args:    cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			clientCtx, err := client.GetClientTxContext(cmd)
+			if err != nil {
+				return err
+			}
+
+			clientID := args[0]
+
+			// NOTE: Make sure all fields are gathered from the user for the config objects, as it replaces the entire existing config.
+			// In other words, if we add a new field to the config object, we need to make sure it is gathered here
+			var allowedRelayers []string
+			for _, relayerAddress := range args[1:] {
+				_ = sdk.MustAccAddressFromBech32(relayerAddress)
+				allowedRelayers = append(allowedRelayers, relayerAddress)
+			}
+
+			msg := clienttypesv2.NewMsgUpdateClientConfig(clientID, clientCtx.GetFromAddress().String(), clienttypesv2.NewConfig(allowedRelayers...))
+
+			return tx.GenerateOrBroadcastTxCLI(clientCtx, cmd.Flags(), msg)
+		},
+	}
+
+	flags.AddTxFlagsToCmd(cmd)
+	return cmd
+}
+
 // newUpdateClientCmd defines the command to update an IBC client.
 func newUpdateClientCmd() *cobra.Command {
 	cmd := &cobra.Command{

modules/core/02-client/client/cli/tx.go

@@ -261,6 +261,24 @@ func (q *queryServer) ClientStatus(goCtx context.Context, req *types.QueryClient
 	}, nil
 }
 
+// ClientCreator implements the Query/ClientCreator gRPC method
+func (q *queryServer) ClientCreator(goCtx context.Context, req *types.QueryClientCreatorRequest) (*types.QueryClientCreatorResponse, error) {
+	if req == nil {
+		return nil, status.Error(codes.InvalidArgument, "empty request")
+	}
+
+	if err := host.ClientIdentifierValidator(req.ClientId); err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	ctx := sdk.UnwrapSDKContext(goCtx)
+	creator := q.GetClientCreator(ctx, req.ClientId)
+
+	return &types.QueryClientCreatorResponse{
+		Creator: creator.String(),
+	}, nil
+}
+
 // ClientParams implements the Query/ClientParams gRPC method
 func (q *queryServer) ClientParams(goCtx context.Context, _ *types.QueryClientParamsRequest) (*types.QueryClientParamsResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)

modules/core/02-client/keeper/grpc_query.go

@@ -780,6 +780,83 @@ func (suite *KeeperTestSuite) TestQueryUpgradedConsensusStates() {
 	}
 }
 
+func (suite *KeeperTestSuite) TestQueryCreator() {
+	var (
+		req    *types.QueryClientCreatorRequest
+		expRes *types.QueryClientCreatorResponse
+		path   *ibctesting.Path
+	)
+
+	testCases := []struct {
+		name     string
+		malleate func()
+		expError error
+	}{
+		{
+			"req is nil",
+			func() {
+				req = nil
+			},
+			status.Error(codes.InvalidArgument, "empty request"),
+		},
+		{
+			"invalid clientID",
+			func() {
+				req = &types.QueryClientCreatorRequest{}
+			},
+			status.Error(codes.InvalidArgument, "identifier cannot be blank: invalid identifier"),
+		},
+		{
+			"client not found",
+			func() {
+				req = &types.QueryClientCreatorRequest{
+					ClientId: ibctesting.FirstClientID,
+				}
+				expRes = &types.QueryClientCreatorResponse{
+					Creator: "",
+				}
+			},
+			nil,
+		},
+		{
+			"success",
+			func() {
+				path.SetupClients()
+				req = &types.QueryClientCreatorRequest{
+					ClientId: path.EndpointA.ClientID,
+				}
+				expRes = &types.QueryClientCreatorResponse{
+					Creator: suite.chainA.SenderAccount.GetAddress().String(),
+				}
+			},
+			nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+
+		suite.Run(fmt.Sprintf("Case %s", tc.name), func() {
+			suite.SetupTest() // reset
+			path = ibctesting.NewPath(suite.chainA, suite.chainB)
+
+			tc.malleate()
+			ctx := suite.chainA.GetContext()
+			queryServer := keeper.NewQueryServer(suite.chainA.GetSimApp().IBCKeeper.ClientKeeper)
+			res, err := queryServer.ClientCreator(ctx, req)
+
+			if tc.expError == nil {
+				suite.Require().NoError(err)
+				suite.Require().NotNil(res)
+				suite.Require().Equal(expRes, res)
+			} else {
+				suite.Require().Error(err)
+				suite.Require().ErrorIs(err, tc.expError)
+			}
+		})
+	}
+}
+
 func (suite *KeeperTestSuite) TestQueryClientParams() {
 	ctx := suite.chainA.GetContext()
 	expParams := types.DefaultParams()

modules/core/02-client/keeper/grpc_query_test.go

@@ -20,6 +20,7 @@ var (
 	_ sdk.Msg = (*MsgUpdateParams)(nil)
 	_ sdk.Msg = (*MsgIBCSoftwareUpgrade)(nil)
 	_ sdk.Msg = (*MsgRecoverClient)(nil)
+	_ sdk.Msg = (*MsgDeleteClientCreator)(nil)
 
 	_ sdk.HasValidateBasic = (*MsgCreateClient)(nil)
 	_ sdk.HasValidateBasic = (*MsgUpdateClient)(nil)
@@ -28,6 +29,7 @@ var (
 	_ sdk.HasValidateBasic = (*MsgUpdateParams)(nil)
 	_ sdk.HasValidateBasic = (*MsgIBCSoftwareUpgrade)(nil)
 	_ sdk.HasValidateBasic = (*MsgRecoverClient)(nil)
+	_ sdk.HasValidateBasic = (*MsgDeleteClientCreator)(nil)
 
 	_ codectypes.UnpackInterfacesMessage = (*MsgCreateClient)(nil)
 	_ codectypes.UnpackInterfacesMessage = (*MsgUpdateClient)(nil)
@@ -318,3 +320,25 @@ func (msg *MsgUpdateParams) ValidateBasic() error {
 	}
 	return msg.Params.Validate()
 }
+
+// NewMsgDeleteClientCreator creates a new instance of MsgDeleteClientCreator.
+func NewMsgDeleteClientCreator(clientID string, signer string) *MsgDeleteClientCreator {
+	return &MsgDeleteClientCreator{
+		ClientId: clientID,
+		Signer:   signer,
+	}
+}
+
+// ValidateBasic performs basic validation of the MsgDeleteClientCreator fields.
+func (msg *MsgDeleteClientCreator) ValidateBasic() error {
+	if _, err := sdk.AccAddressFromBech32(msg.Signer); err != nil {
+		return errorsmod.Wrapf(ibcerrors.ErrInvalidAddress, "string could not be parsed as address: %v", err)
+	}
+	if err := host.ClientIdentifierValidator(msg.ClientId); err != nil {
+		return err
+	}
+	if !IsValidClientID(msg.ClientId) {
+		return errorsmod.Wrapf(host.ErrInvalidID, "client ID %s must be in valid format: {string}-{number}", msg.ClientId)
+	}
+	return nil
+}