v0 source pure

NewRestrictedContractAuthority creates a contract authority whose proposer REPLACES the contract-identity gate.

This is the escape hatch, not a second lock. `proposer` becomes the ONLY authorization decision: contractAddr is not consulted on this path, so `path` degrades to a label that appears in String() and asserts nothing. NewRestrictedContractAuthority(p, h, NewAutoAcceptAuthority()) is exactly the old default behaviour ("anyone can propose"), stated explicitly rather than reached by default.

In particular NewRestrictedContractAuthority("gno.land/r/gov/dao", h, NewMemberAuthority(alice)) does NOT mean "GovDAO and alice". It means "alice, and not GovDAO".

SECURITY:

• `handler` is the same Class-4 captured-callback risk as NewContractAuthority — runs synchronously inside Authorize with the consumer's authority. Register only trusted handler functions.
• `proposer` is an open-interface input (Class-3 impl-substitution). A hostile proposer Authority can always-approve creation of any proposal, defeating the restriction. Pass canonical impls only. String() renders a non-canonical proposer wrapped as custom_authority[...] so such a substitution is at least visible.

NewWithAuthority creates a new Authorizer with a specific authority.

SECURITY: `authority` is an open-interface input — any value satisfying Authority is accepted. A malicious impl can always-approve (privilege escalation) or always-deny (DoS). Prefer canonical impls from this package (NewMemberAuthority, NewContractAuthority, NewAutoAcceptAuthority, NewDroppedAuthority) unless you specifically need a foreign impl.

NewWithMembers creates a new Authorizer whose authority is a MemberAuthority containing the given addresses. Callers express authority intent at the call site:

 1// "auth realm is the authority"
 2a := authz.NewWithMembers(cur.Address())
 3
 4// "previous realm is the authority" (from a crossing function)
 5a := authz.NewWithMembers(cur.Previous().Address())
 6
 7// "EOA caller is the authority" (from init(cur realm))
 8if !cur.Previous().IsUserCall() {
 9    panic("realm must be initialized by EOA")
10}
11a := authz.NewWithMembers(cur.Previous().Address())

This replaces the previous NewWithCurrent / NewWithPrevious / NewWithOrigin sugar — those baked runtime.{Current,Previous,Origin} reads into the constructor, which (a) prevented use from package- level var initializers, (b) made the EOA-origin check inside NewWithOrigin an indirect address comparison rather than the straightforward IsUserCall predicate, and (c) coupled the constructor to the runtime walks the rest of the migration is moving away from.

NewContractAuthority makes the contract at `path` its OWN authority: the default proposer accepts only chain.PackageAddress(path), so a privileged action proceeds only when driven from that contract's own frame.

NewRestrictedContractAuthority does NOT widen this — it REPLACES it. See its godoc; with an explicit proposer, `path` is a label and contractAddr is never consulted.

The `caller` compared against that address is established upstream by Authorizer.DoByCurrent / DoByPrevious / Transfer under rlm.IsCurrent(), so an external realm cannot present the contract address.

BREAKING: the default proposer used to be NewAutoAcceptAuthority ("anyone can propose"). Consumers that relied on arbitrary callers driving a plain ContractAuthority will start getting "unauthorized"; that is the fix, not a regression. Pass an explicit proposer to NewRestrictedContractAuthority to opt back in.

SECURITY — the gate binds the contract's IDENTITY, not its intent. Inside any crossing frame of the contract, rlm.Address() is unconditionally PackageAddress(path), so `DoByCurrent` from within the contract is a tautology; only DoByPrevious and Transfer gain a real check. Consequently ANY exported function of the contract that returns a crossing closure (or anything else carrying its frame) hands this authority to its caller. Keep privileged closures unexported.

So DO NOT write NewContractAuthority(ownPath) + DoByCurrent. It reads like "only I may do this" and compiles to "anyone may do this". Point `path` at the principal you actually want to assert — usually the governance realm that will drive the action — and use DoByPrevious, so the comparison is against whoever crossed in:

1// in r/gnops/valopers/init.gno
2auth = authz.NewWithAuthority(
3    authz.NewContractAuthority("gno.land/r/gov/dao", handler),
4)
5// in the privileged write
6auth.DoByPrevious(0, rlm, "update-instructions", action)

Own-path is right only when something OTHER than the contract's own frame supplies the caller — i.e. you drive it via DoByPrevious from a realm you have deliberately let call in, or via Transfer.

SECURITY — a gate is only as good as the principal it names. Pointing `path` at a realm whose frame ANY caller can mint buys nothing. Check, for whatever principal you choose, that nothing exported by that realm hands out its frame identity:

• `gno.land/r/gov/dao` is safe to assert ONLY because SimpleExecutor.Execute rejects invocation from outside the proxy (r/gov/dao/types.gno). Before that gate existed, dao's exported NewSimpleExecutor + Execute let any realm mint a frame whose Previous() was r/gov/dao, so this whole pairing authenticated nothing. Do not assume a governance path is unforgeable; verify it.
• Whatever the principal, an exported function of YOUR realm whose signature is assignable to a callback type the principal invokes (for r/gov/dao: `func(realm) error`) is itself the leak — the principal will happily call it for an attacker. Keep privileged entrypoints out of that shape, or take extra parameters.

Neither shape defends against re-exporting the privileged closure: its holder picks the Previous() they present by wrapping it in an executor of their own. Unexported closures remain the load-bearing rule.

A syntactically valid but WRONG `path` is a permanent brick, not an error: the authority accepts nobody, and Transfer routes through the same gate, so it cannot be rotated out either. Construction rejects malformed paths, but it cannot tell a wrong path from a right one — e.g. "gno.land/r/gov/dao/impl/v0" (the path r/gov/dao's own allowedDAOs list holds) is well-formed and permanently dead, because an executor's Previous() is the PROXY path, never the impl. Give the consumer a governance-gated rotation entrypoint before deploying; see r/gnops/valopers/admin.gno's NewAuthorityRotationProposalRequest.

SECURITY (Class-4 captured callback): `handler` is a caller-supplied closure that runs SYNCHRONOUSLY inside Authorize, with the consumer's authority. A hostile handler can swallow actions, log the caller, or execute arbitrary code under the consumer's frame. The package-internal wrappedAction enforces at-most-once invocation and NOTHING ELSE — in particular it does not check the caller, and the handler may call it however it likes (multiple times, never, out of order). Register only trusted handler functions; treat handler registration as the trust boundary.

Panics if `path` is empty or malformed, or if `handler` is nil.

Authority represents an entity that can authorize privileged actions. It is implemented by MemberAuthority, ContractAuthority, AutoAcceptAuthority, and DroppedAuthority.

Authority is the canonical safe shape for cross-package authority interfaces: methods are address-typed (no realm/cur crosses the interface boundary), and consumers correctly derive `caller` from `cur.Previous().Address()` under `rlm.IsCurrent()` before invoking Authorize. No cur-leak (class 1) is possible through this interface.

However, two RESIDUAL RISKS apply:

• Class-3 impl-substitution: NewWithAuthority and Authorizer.Transfer accept any Authority impl. A malicious Authority can always-approve (silent privilege escalation) or always-deny (denial-of-service). Consumers should pass canonical impls from this package (MemberAuthority, ContractAuthority, AutoAcceptAuthority, DroppedAuthority) unless they have explicit reason to register a foreign impl. We do not expose an IsCanonicalAuthority allowlist because the package is intentionally extensible — third-party impls are the design intent.

• Class-4 closed-over-authority: NewContractAuthority and NewRestrictedContractAuthority capture a caller-supplied PrivilegedActionHandler closure. The handler runs synchronously inside Authorize with the consumer's authority. A hostile handler can swallow actions, log the caller, or execute arbitrary code under the consumer's frame. Register only trusted handler functions. See r/gnops/valopers/init.gno for the realistic registration shape.

• Caller- and title-forgery on the RAW interface: Authorize takes `caller` and `title` as ARGUMENTS, not from the frame. A consumer that exposes a bare Authority (rather than the *Authorizer that wraps it) therefore lets any holder present any caller and any title. Caller-forgery is contained — the only authority-mutating closure lives inside Authorizer.Transfer, so a forged caller on a raw Authorize runs the caller's own inert closure and cannot transfer; TestForgedCallerCannotTransfer pins that boundary. Title-forgery is NOT contained: the title is passed straight to the contractHandler, so a handler that branches on it (routing, quotas, audit trails) must not treat it as trusted. Keep the Authority unexported and hand out only what callers need; see r/gnops/valopers/admin.gno, which exports a description string.

We do NOT seal Authority via an unexported marker method — that pattern is bypassable via embedding in Gno; see p/test/seal/filetests/z_seal_*_filetest.gno for the four bypass tests.

Authorizer is the main wrapper object that handles authority management. It is configured with a replaceable Authority implementation.

AutoAcceptAuthority implements an authority that accepts all actions AutoAcceptAuthority is a simple authority that automatically accepts all actions. It can be used as a proposer authority to allow anyone to create proposals.

ContractAuthority implements async contract-based authority

MemberAuthority is the default implementation using addrset for member management.

PrivilegedAction defines a function that performs a privileged action.

PrivilegedActionHandler is called by contract-based authorities to handle privileged actions.