sysio::chain::authorization_manager Class Reference

#include <authorization_manager.hpp>

Public Types
using	permission_id_type = permission_object::id_type

Public Member Functions
	authorization_manager (controller &c, chainbase::database &d)
void	add_indices ()
void	initialize_database ()
void	add_to_snapshot (const snapshot_writer_ptr &snapshot) const
void	read_from_snapshot (const snapshot_reader_ptr &snapshot)
const permission_object &	create_permission (account_name account, permission_name name, permission_id_type parent, const authority &auth, time_point initial_creation_time=time_point())
const permission_object &	create_permission (account_name account, permission_name name, permission_id_type parent, authority &&auth, time_point initial_creation_time=time_point())
void	modify_permission (const permission_object &permission, const authority &auth)
void	remove_permission (const permission_object &permission)
void	update_permission_usage (const permission_object &permission)
fc::time_point	get_permission_last_used (const permission_object &permission) const
const permission_object *	find_permission (const permission_level &level) const
const permission_object &	get_permission (const permission_level &level) const
std::optional< permission_name >	lookup_minimum_permission (account_name authorizer_account, scope_name code_account, action_name type) const
	Find the lowest authority level required for authorizer_account to authorize a message of the specified type.
void	check_authorization (const vector< action > &actions, const flat_set< public_key_type > &provided_keys, const flat_set< permission_level > &provided_permissions=flat_set< permission_level >(), fc::microseconds provided_delay=fc::microseconds(0), const std::function< void()> &checktime=std::function< void()>(), bool allow_unused_keys=false, bool check_but_dont_fail=false, const flat_set< permission_level > &satisfied_authorizations=flat_set< permission_level >()) const
	Check authorizations of a vector of actions with provided keys, permission levels, and delay.
void	check_authorization (account_name account, permission_name permission, const flat_set< public_key_type > &provided_keys, const flat_set< permission_level > &provided_permissions=flat_set< permission_level >(), fc::microseconds provided_delay=fc::microseconds(0), const std::function< void()> &checktime=std::function< void()>(), bool allow_unused_keys=false) const
	Check authorizations of a permission with provided keys, permission levels, and delay.
flat_set< public_key_type >	get_required_keys (const transaction &trx, const flat_set< public_key_type > &candidate_keys, fc::microseconds provided_delay=fc::microseconds(0)) const

Static Public Attributes
static std::function< void()>	_noop_checktime {&noop_checktime}

Detailed Description

Definition at line 19 of file authorization_manager.hpp.

Member Typedef Documentation

permission_id_type

using sysio::chain::authorization_manager::permission_id_type = permission_object::id_type

Definition at line 21 of file authorization_manager.hpp.

Constructor & Destructor Documentation

authorization_manager()

sysio::chain::authorization_manager::authorization_manager ( controller & c, chainbase::database & d )

explicit

Definition at line 24 of file authorization_manager.cpp.

   :_control(c),_db(d){}

Member Function Documentation

add_indices()

void sysio::chain::authorization_manager::add_indices

(

)

Definition at line 27 of file authorization_manager.cpp.

                                           {
      authorization_index_set::add_indices(_db);
   }

Here is the caller graph for this function:

add_to_snapshot()

void sysio::chain::authorization_manager::add_to_snapshot

(

const snapshot_writer_ptr &

snapshot

)

const

Definition at line 96 of file authorization_manager.cpp.

                                                                                          {
      authorization_index_set::walk_indices([this, &snapshot]( auto utils ){
         using section_t = typename decltype(utils)::index_t::value_type;
 
         // skip the permission_usage_index as its inlined with permission_index
         if (std::is_same<section_t, permission_usage_object>::value) {
            return;
         }
 
         snapshot->write_section<section_t>([this]( auto& section ){
            decltype(utils)::walk(_db, [this, &section]( const auto &row ) {
               section.add_row(row, _db);
            });
         });
      });
   }

Here is the caller graph for this function:

check_authorization() [1/2]

void sysio::chain::authorization_manager::check_authorization	(	account_name	account,
		permission_name	permission,
		const flat_set< public_key_type > &	provided_keys,
		const flat_set< permission_level > &	provided_permissions = flat_set<permission_level>(),
		fc::microseconds	provided_delay = fc::microseconds(0),
		const std::function< void()> &	checktime = std::function<void()>(),
		bool	allow_unused_keys = false ) const

Parameters

account	- the account owner of the permission
permission	- the permission name to check for authorization
provided_keys	- a set of public keys
provided_permissions	- the set of permissions which can be considered satisfied (empty permission name acts as wildcard)
provided_delay	- the delay considered to be satisfied for the authorization check
checktime	- the function that can be called to track CPU usage and time during the process of checking authorization
allow_unused_keys	- true if method does not require all keys to be used

Definition at line 575 of file authorization_manager.cpp.

   {
      const auto& checktime = ( static_cast<bool>(_checktime) ? _checktime : _noop_checktime );
 
      auto delay_max_limit = fc::seconds( _control.get_global_properties().configuration.max_transaction_delay );
 
      auto checker = make_auth_checker( [&](const permission_level& p){ return get_permission(p).auth; },
                                        _control.get_global_properties().configuration.max_authority_depth,
                                        provided_keys,
                                        provided_permissions,
                                        ( provided_delay >= delay_max_limit ) ? fc::microseconds::maximum() : provided_delay,
                                        checktime
                                      );
 
      SYS_ASSERT( checker.satisfied({account, permission}), unsatisfied_authorization,
                  "permission '${auth}' was not satisfied under a provided delay of ${provided_delay} ms, "
                  "provided permissions ${provided_permissions}, provided keys ${provided_keys}, "
                  "and a delay max limit of ${delay_max_limit_ms} ms",
                  ("auth", permission_level{account, permission})
                  ("provided_delay", provided_delay.count()/1000)
                  ("provided_permissions", provided_permissions)
                  ("provided_keys", provided_keys)
                  ("delay_max_limit_ms", delay_max_limit.count()/1000)
                );
 
      if( !allow_unused_keys ) {
         SYS_ASSERT( checker.all_keys_used(), tx_irrelevant_sig,
                     "irrelevant keys provided: ${keys}",
                     ("keys", checker.unused_keys()) );
      }
   }

Here is the call graph for this function:

check_authorization() [2/2]

void sysio::chain::authorization_manager::check_authorization	(	const vector< action > &	actions,
		const flat_set< public_key_type > &	provided_keys,
		const flat_set< permission_level > &	provided_permissions = flat_set<permission_level>(),
		fc::microseconds	provided_delay = fc::microseconds(0),
		const std::function< void()> &	checktime = std::function<void()>(),
		bool	allow_unused_keys = false,
		bool	check_but_dont_fail = false,
		const flat_set< permission_level > &	satisfied_authorizations = flat_set<permission_level>() ) const

Parameters

actions	- the actions to check authorization across
provided_keys	- the set of public keys which have authorized the transaction
provided_permissions	- the set of permissions which have authorized the transaction (empty permission name acts as wildcard)
provided_delay	- the delay satisfied by the transaction
checktime	- the function that can be called to track CPU usage and time during the process of checking authorization
allow_unused_keys	- true if method should not assert on unused keys

Definition at line 471 of file authorization_manager.cpp.

   {
      const auto& checktime = ( static_cast<bool>(_checktime) ? _checktime : _noop_checktime );
 
      auto delay_max_limit = fc::seconds( _control.get_global_properties().configuration.max_transaction_delay );
 
      auto effective_provided_delay =  (provided_delay >= delay_max_limit) ? fc::microseconds::maximum() : provided_delay;
 
      auto checker = make_auth_checker( [&](const permission_level& p){ return get_permission(p).auth; },
                                        _control.get_global_properties().configuration.max_authority_depth,
                                        provided_keys,
                                        provided_permissions,
                                        effective_provided_delay,
                                        checktime
                                      );
 
      map<permission_level, fc::microseconds> permissions_to_satisfy;
 
      for( const auto& act : actions ) {
         bool special_case = false;
         fc::microseconds delay = effective_provided_delay;
 
         if( act.account == config::system_account_name ) {
            special_case = true;
 
            if( act.name == updateauth::get_name() ) {
               check_updateauth_authorization( act.data_as<updateauth>(), act.authorization );
            } else if( act.name == deleteauth::get_name() ) {
               check_deleteauth_authorization( act.data_as<deleteauth>(), act.authorization );
            } else if( act.name == linkauth::get_name() ) {
               check_linkauth_authorization( act.data_as<linkauth>(), act.authorization );
            } else if( act.name == unlinkauth::get_name() ) {
               check_unlinkauth_authorization( act.data_as<unlinkauth>(), act.authorization );
            } else if( act.name ==  canceldelay::get_name() ) {
               delay = std::max( delay, check_canceldelay_authorization(act.data_as<canceldelay>(), act.authorization) );
            } else {
               special_case = false;
            }
         }
 
         for( const auto& declared_auth : act.authorization ) {
 
            checktime();
 
            if( !special_case ) {
               auto min_permission_name = lookup_minimum_permission(declared_auth.actor, act.account, act.name);
               if( min_permission_name ) { // since special cases were already handled, it should only be false if the permission is sysio.any
                  const auto& min_permission = get_permission({declared_auth.actor, *min_permission_name});
                  SYS_ASSERT( get_permission(declared_auth).satisfies( min_permission,
                                                                       _db.get_index<permission_index>().indices() ),
                              irrelevant_auth_exception,
                              "action declares irrelevant authority '${auth}'; minimum authority is ${min}",
                              ("auth", declared_auth)("min", permission_level{min_permission.owner, min_permission.name}) );
               }
            }
 
            if( satisfied_authorizations.find( declared_auth ) == satisfied_authorizations.end() ) {
               auto res = permissions_to_satisfy.emplace( declared_auth, delay );
               if( !res.second && res.first->second > delay) { // if the declared_auth was already in the map and with a higher delay
                  res.first->second = delay;
               }
            }
         }
      }
 
      // Now verify that all the declared authorizations are satisfied:
 
      // Although this can be made parallel (especially for input transactions) with the optimistic assumption that the
      // CPU limit is not reached, because of the CPU limit the protocol must officially specify a sequential algorithm
      // for checking the set of declared authorizations.
      // The permission_levels are traversed in ascending order, which is:
      // ascending order of the actor name with ties broken by ascending order of the permission name.
      for( const auto& p : permissions_to_satisfy ) {
         checktime(); // TODO: this should eventually move into authority_checker instead
         SYS_ASSERT( checker.satisfied( p.first, p.second ) || check_but_dont_fail, unsatisfied_authorization,
                     "transaction declares authority '${auth}', "
                     "but does not have signatures for it under a provided delay of ${provided_delay} ms, "
                     "provided permissions ${provided_permissions}, provided keys ${provided_keys}, "
                     "and a delay max limit of ${delay_max_limit_ms} ms",
                     ("auth", p.first)
                     ("provided_delay", provided_delay.count()/1000)
                     ("provided_permissions", provided_permissions)
                     ("provided_keys", provided_keys)
                     ("delay_max_limit_ms", delay_max_limit.count()/1000)
                   );
 
      }
 
      if( !allow_unused_keys  || check_but_dont_fail) {
         SYS_ASSERT( checker.all_keys_used(), tx_irrelevant_sig,
                     "transaction bears irrelevant signatures from these keys: ${keys}",
                     ("keys", checker.unused_keys()) );
      }
   }

Here is the call graph for this function:

Here is the caller graph for this function:

create_permission() [1/2]

const permission_object & sysio::chain::authorization_manager::create_permission	(	account_name	account,
		permission_name	name,
		permission_id_type	parent,
		authority &&	auth,
		time_point	initial_creation_time = time_point() )

Definition at line 168 of file authorization_manager.cpp.

   {
      for(const key_weight& k: auth.keys)
         SYS_ASSERT(k.key.which() < _db.get<protocol_state_object>().num_supported_key_types, unactivated_key_type,
           "Unactivated key type used when creating permission");
 
      auto creation_time = initial_creation_time;
      if( creation_time == time_point() ) {
         creation_time = _control.pending_block_time();
      }
 
      const auto& perm_usage = _db.create<permission_usage_object>([&](auto& p) {
         p.last_used = creation_time;
      });
 
      const auto& perm = _db.create<permission_object>([&](auto& p) {
         p.usage_id     = perm_usage.id;
         p.parent       = parent;
         p.owner        = account;
         p.name         = name;
         p.last_updated = creation_time;
         p.auth         = std::move(auth);
 
         if (auto dm_logger = _control.get_deep_mind_logger()) {
            dm_logger->on_create_permission(p);
         }
      });
      return perm;
   }

Here is the call graph for this function:

create_permission() [2/2]

const permission_object & sysio::chain::authorization_manager::create_permission	(	account_name	account,
		permission_name	name,
		permission_id_type	parent,
		const authority &	auth,
		time_point	initial_creation_time = time_point() )

Definition at line 133 of file authorization_manager.cpp.

   {
      for(const key_weight& k: auth.keys)
         SYS_ASSERT(k.key.which() < _db.get<protocol_state_object>().num_supported_key_types, unactivated_key_type,
           "Unactivated key type used when creating permission");
 
      auto creation_time = initial_creation_time;
      if( creation_time == time_point() ) {
         creation_time = _control.pending_block_time();
      }
 
      const auto& perm_usage = _db.create<permission_usage_object>([&](auto& p) {
         p.last_used = creation_time;
      });
 
      const auto& perm = _db.create<permission_object>([&](auto& p) {
         p.usage_id     = perm_usage.id;
         p.parent       = parent;
         p.owner        = account;
         p.name         = name;
         p.last_updated = creation_time;
         p.auth         = auth;
 
         if (auto dm_logger = _control.get_deep_mind_logger()) {
            dm_logger->on_create_permission(p);
         }
      });
      return perm;
   }

Here is the call graph for this function:

Here is the caller graph for this function:

find_permission()

const permission_object * sysio::chain::authorization_manager::find_permission

(

const permission_level &

level

)

const

Definition at line 251 of file authorization_manager.cpp.

   { try {
      SYS_ASSERT( !level.actor.empty() && !level.permission.empty(), invalid_permission, "Invalid permission" );
      return _db.find<permission_object, by_owner>( boost::make_tuple(level.actor,level.permission) );
   } SYS_RETHROW_EXCEPTIONS( chain::permission_query_exception, "Failed to retrieve permission: ${level}", ("level", level) ) }

Here is the call graph for this function:

Here is the caller graph for this function:

get_permission()

const permission_object & sysio::chain::authorization_manager::get_permission

(

const permission_level &

level

)

const

Definition at line 257 of file authorization_manager.cpp.

   { try {
      SYS_ASSERT( !level.actor.empty() && !level.permission.empty(), invalid_permission, "Invalid permission" );
      return _db.get<permission_object, by_owner>( boost::make_tuple(level.actor,level.permission) );
   } SYS_RETHROW_EXCEPTIONS( chain::permission_query_exception, "Failed to retrieve permission: ${level}", ("level", level) ) }

Here is the call graph for this function:

Here is the caller graph for this function:

get_permission_last_used()

fc::time_point sysio::chain::authorization_manager::get_permission_last_used

(

const permission_object &

permission

)

const

Definition at line 247 of file authorization_manager.cpp.

                                                                                                          {
      return _db.get<permission_usage_object, by_id>( permission.usage_id ).last_used;
   }

Here is the call graph for this function:

get_required_keys()

flat_set< public_key_type > sysio::chain::authorization_manager::get_required_keys	(	const transaction &	trx,
		const flat_set< public_key_type > &	candidate_keys,
		fc::microseconds	provided_delay = fc::microseconds(0) ) const

Definition at line 614 of file authorization_manager.cpp.

   {
      auto checker = make_auth_checker( [&](const permission_level& p){ return get_permission(p).auth; },
                                        _control.get_global_properties().configuration.max_authority_depth,
                                        candidate_keys,
                                        {},
                                        provided_delay,
                                        _noop_checktime
                                      );
 
      for (const auto& act : trx.actions ) {
         for (const auto& declared_auth : act.authorization) {
            SYS_ASSERT( checker.satisfied(declared_auth), unsatisfied_authorization,
                        "transaction declares authority '${auth}', but does not have signatures for it.",
                        ("auth", declared_auth) );
         }
      }
 
      return checker.used_keys();
   }

Here is the call graph for this function:

initialize_database()

void sysio::chain::authorization_manager::initialize_database

(

)

reserve perm 0 (used else where)

Definition at line 31 of file authorization_manager.cpp.

                                                   {
      _db.create<permission_object>([](auto&){}); 
   }

Here is the call graph for this function:

Here is the caller graph for this function:

lookup_minimum_permission()

std::optional< permission_name > sysio::chain::authorization_manager::lookup_minimum_permission	(	account_name	authorizer_account,
		scope_name	code_account,
		action_name	type ) const

Parameters

authorizer_account	The account authorizing the message
code_account	The account which publishes the contract that handles the message
type	The type of message

Definition at line 286 of file authorization_manager.cpp.

   {
      // Special case native actions cannot be linked to a minimum permission, so there is no need to check.
      if( scope == config::system_account_name ) {
          SYS_ASSERT( act_name != updateauth::get_name() &&
                     act_name != deleteauth::get_name() &&
                     act_name != linkauth::get_name() &&
                     act_name != unlinkauth::get_name() &&
                     act_name != canceldelay::get_name(),
                     unlinkable_min_permission_action,
                     "cannot call lookup_minimum_permission on native actions that are not allowed to be linked to minimum permissions" );
      }
 
      try {
         std::optional<permission_name> linked_permission = lookup_linked_permission(authorizer_account, scope, act_name);
         if( !linked_permission )
            return config::active_name;
 
         if( *linked_permission == config::sysio_any_name )
            return std::optional<permission_name>();
 
         return linked_permission;
      } FC_CAPTURE_AND_RETHROW((authorizer_account)(scope)(act_name))
   }

Here is the call graph for this function:

Here is the caller graph for this function:

modify_permission()

void sysio::chain::authorization_manager::modify_permission	(	const permission_object &	permission,
		const authority &	auth )

Definition at line 203 of file authorization_manager.cpp.

                                                                                                             {
      for(const key_weight& k: auth.keys)
         SYS_ASSERT(k.key.which() < _db.get<protocol_state_object>().num_supported_key_types, unactivated_key_type,
           "Unactivated key type used when modifying permission");
 
      _db.modify( permission, [&](permission_object& po) {
         auto dm_logger = _control.get_deep_mind_logger();
 
         std::optional<permission_object> old_permission;
         if (dm_logger) {
            old_permission = po;
         }
 
         po.auth = auth;
         po.last_updated = _control.pending_block_time();
 
         if (auto dm_logger = _control.get_deep_mind_logger()) {
            dm_logger->on_modify_permission(*old_permission, po);
         }
      });
   }

Here is the call graph for this function:

read_from_snapshot()

void sysio::chain::authorization_manager::read_from_snapshot

(

const snapshot_reader_ptr &

snapshot

)

Definition at line 113 of file authorization_manager.cpp.

                                                                                       {
      authorization_index_set::walk_indices([this, &snapshot]( auto utils ){
         using section_t = typename decltype(utils)::index_t::value_type;
 
         // skip the permission_usage_index as its inlined with permission_index
         if (std::is_same<section_t, permission_usage_object>::value) {
            return;
         }
 
         snapshot->read_section<section_t>([this]( auto& section ) {
            bool more = !section.empty();
            while(more) {
               decltype(utils)::create(_db, [this, &section, &more]( auto &row ) {
                  more = section.read_row(row, _db);
               });
            }
         });
      });
   }

Here is the caller graph for this function:

remove_permission()

void sysio::chain::authorization_manager::remove_permission

(

const permission_object &

permission

)

Definition at line 225 of file authorization_manager.cpp.

                                                                                      {
      const auto& index = _db.template get_index<permission_index, by_parent>();
      auto range = index.equal_range(permission.id);
      SYS_ASSERT( range.first == range.second, action_validate_exception,
                  "Cannot remove a permission which has children. Remove the children first.");
 
      _db.get_mutable_index<permission_usage_index>().remove_object( permission.usage_id._id );
 
      if (auto dm_logger = _control.get_deep_mind_logger()) {
         dm_logger->on_remove_permission(permission);
      }
 
      _db.remove( permission );
   }

Here is the call graph for this function:

update_permission_usage()

void sysio::chain::authorization_manager::update_permission_usage

(

const permission_object &

permission

)

Definition at line 240 of file authorization_manager.cpp.

                                                                                            {
      const auto& puo = _db.get<permission_usage_object, by_id>( permission.usage_id );
      _db.modify( puo, [&](permission_usage_object& p) {
         p.last_used = _control.pending_block_time();
      });
   }

Here is the call graph for this function:

Member Data Documentation

_noop_checktime

std::function< void()> sysio::chain::authorization_manager::_noop_checktime {&noop_checktime}

static

Definition at line 116 of file authorization_manager.hpp.

---

The documentation for this class was generated from the following files:

• libraries/chain/include/sysio/chain/authorization_manager.hpp
• libraries/chain/authorization_manager.cpp