ADR 030: Authorization Module

type Authorization interface {
    proto.Message

	// MsgTypeURL 返回完整限定的 Msg TypeURL（见 ADR 020），
	// 该 TypeURL 将处理请求并决定接受或拒绝。
	MsgTypeURL()

string

	// Accept 判断此授权是否允许执行给定的 sdk.Msg，
	// 如果允许，则返回升级后的授权实例。
	Accept(ctx sdk.Context, msg sdk.Msg) (AcceptResponse, error)

	// ValidateBasic 执行一个简单的校验，
	// 不需要访问任何其他信息。
	ValidateBasic()

error
}

// AcceptResponse 用于告知 authz 消息控制器该请求是否被接受，
// 以及授权是否应被更新或删除。
type AcceptResponse struct {
	// 如果 Accept=true，控制器可以接受该授权并处理更新。
	Accept bool
	// 如果 Delete=true，控制器必须删除授权对象并释放
	// 存储资源。
	Delete bool
	// 调用 Authorization.Accept 的控制器必须检查 `Updated != nil`。如果为真，
	// 则必须使用更新后的版本，并在存储层处理更新。
	Updated Authorization
}

type SendAuthorization struct {
	// SpendLimit 指定此授权最多可花费的代币数量，
	// 并会随着代币支出而更新。此字段为必填项。（可使用通用授权
	// 配合 bank msg type url 创建无额度限制的 bank 授权）。
	SpendLimit sdk.Coins
}

func (a SendAuthorization)

MsgTypeURL()

string {
    return sdk.MsgTypeURL(&MsgSend{
})
}

func (a SendAuthorization)

Accept(ctx sdk.Context, msg sdk.Msg) (authz.AcceptResponse, error) {
    mSend, ok := msg.(*MsgSend)
    if !ok {
    return authz.AcceptResponse{
}, sdkerrors.ErrInvalidType.Wrap("类型不匹配")
}

limitLeft, isNegative := a.SpendLimit.SafeSub(mSend.Amount)
    if isNegative {
    return authz.AcceptResponse{
}, sdkerrors.ErrInsufficientFunds.Wrapf("请求金额超过支出上限")
}
    if limitLeft.IsZero() {
    return authz.AcceptResponse{
    Accept: true,
    Delete: true
}, nil
}

return authz.AcceptResponse{
    Accept: true,
    Delete: false,
    Updated: &SendAuthorization{
    SpendLimit: limitLeft
}}, nil
}

service Msg {
  // Grant 将给定授权以指定过期时间授予 grantee，作用于 granter 的
  // 账户。
  rpc Grant(MsgGrant) returns (MsgGrantResponse);

  // Exec 尝试使用授予 grantee 的授权来执行提供的消息。
  // 每条消息应当只有一个签名者，并且该签名者应对应授权的 granter。
  rpc Exec(MsgExec) returns (MsgExecResponse);

  // Revoke 撤销 granter 账户授予 grantee 的、与给定方法名对应的
  // 任意授权。
  rpc Revoke(MsgRevoke) returns (MsgRevokeResponse);
}

// Grant 赋予在指定过期时间内执行
// 所提供方法的权限。
message Grant {
  google.protobuf.Any       authorization = 1 [(cosmos_proto.accepts_interface) = "cosmos.authz.v1beta1.Authorization"];
  google.protobuf.Timestamp expiration    = 2 [(gogoproto.stdtime) = true, (gogoproto.nullable) = false];
}

message MsgGrant {
  string granter = 1;
  string grantee = 2;

  Grant grant = 3 [(gogoproto.nullable) = false];
}

message MsgExecResponse {
  cosmos.base.abci.v1beta1.Result result = 1;
}

message MsgExec {
  string   grantee                  = 1;
  // 需要执行的授权消息。每个 msg 都必须实现 Authorization 接口
  repeated google.protobuf.Any msgs = 2 [(cosmos_proto.accepts_interface) = "cosmos.base.v1beta1.Msg"];;
}

type Authorization interface {
    proto.Message

	// MsgTypeURL returns the fully-qualified Msg TypeURL (as described in ADR 020),
	// which will process and accept or reject a request.
	MsgTypeURL()

string

	// Accept determines whether this grant permits the provided sdk.Msg to be performed, and if
	// so provides an upgraded authorization instance.
	Accept(ctx sdk.Context, msg sdk.Msg) (AcceptResponse, error)

	// ValidateBasic does a simple validation check that
	// doesn't require access to any other information.
	ValidateBasic()

error
}

// AcceptResponse instruments the controller of an authz message if the request is accepted
// and if it should be updated or deleted.
type AcceptResponse struct {
	// If Accept=true, the controller can accept and authorization and handle the update.
	Accept bool
	// If Delete=true, the controller must delete the authorization object and release
	// storage resources.
	Delete bool
	// Controller, who is calling Authorization.Accept must check if `Updated != nil`. If yes,
	// it must use the updated version and handle the update on the storage level.
	Updated Authorization
}

type SendAuthorization struct {
	// SpendLimit specifies the maximum amount of tokens that can be spent
	// by this authorization and will be updated as tokens are spent. This field is required. (Generic authorization 
	// can be used with bank msg type url to create limit less bank authorization).
	SpendLimit sdk.Coins
}

func (a SendAuthorization)

MsgTypeURL()

string {
    return sdk.MsgTypeURL(&MsgSend{
})
}

func (a SendAuthorization)

Accept(ctx sdk.Context, msg sdk.Msg) (authz.AcceptResponse, error) {
    mSend, ok := msg.(*MsgSend)
    if !ok {
    return authz.AcceptResponse{
}, sdkerrors.ErrInvalidType.Wrap("type mismatch")
}

limitLeft, isNegative := a.SpendLimit.SafeSub(mSend.Amount)
    if isNegative {
    return authz.AcceptResponse{
}, sdkerrors.ErrInsufficientFunds.Wrapf("requested amount is more than spend limit")
}
    if limitLeft.IsZero() {
    return authz.AcceptResponse{
    Accept: true,
    Delete: true
}, nil
}

return authz.AcceptResponse{
    Accept: true,
    Delete: false,
    Updated: &SendAuthorization{
    SpendLimit: limitLeft
}}, nil
}

service Msg {
  // Grant grants the provided authorization to the grantee on the granter's
  // account with the provided expiration time.
  rpc Grant(MsgGrant) returns (MsgGrantResponse);

  // Exec attempts to execute the provided messages using
  // authorizations granted to the grantee. Each message should have only
  // one signer corresponding to the granter of the authorization.
  rpc Exec(MsgExec) returns (MsgExecResponse);

  // Revoke revokes any authorization corresponding to the provided method name on the
  // granter's account that has been granted to the grantee.
  rpc Revoke(MsgRevoke) returns (MsgRevokeResponse);
}

// Grant gives permissions to execute
// the provided method with expiration time.
message Grant {
  google.protobuf.Any       authorization = 1 [(cosmos_proto.accepts_interface) = "cosmos.authz.v1beta1.Authorization"];
  google.protobuf.Timestamp expiration    = 2 [(gogoproto.stdtime) = true, (gogoproto.nullable) = false];
}

message MsgGrant {
  string granter = 1;
  string grantee = 2;

  Grant grant = 3 [(gogoproto.nullable) = false];
}

message MsgExecResponse {
  cosmos.base.abci.v1beta1.Result result = 1;
}

message MsgExec {
  string   grantee                  = 1;
  // Authorization Msg requests to execute. Each msg must implement Authorization interface
  repeated google.protobuf.Any msgs = 2 [(cosmos_proto.accepts_interface) = "cosmos.base.v1beta1.Msg"];;
}