disable proxy access check by default

smartcontractkit · Oct 24, 2024 · 91ff429 · 91ff429
1 parent fd4d3c8
commit 91ff429
Show file tree

Hide file tree

Showing 6 changed files with 14 additions and 9 deletions.
diff --git a/contracts/src/access_control/access_controller.cairo b/contracts/src/access_control/access_controller.cairo
@@ -41,7 +41,7 @@ mod AccessController {
     #[constructor]
     fn constructor(ref self: ContractState, owner_address: ContractAddress) {
         self.ownable.initializer(owner_address);
-        self.access_control.initializer();
+        self.access_control.initializer(true);
     }
 
     #[abi(embed_v0)]

diff --git a/contracts/src/emergency/sequencer_uptime_feed.cairo b/contracts/src/emergency/sequencer_uptime_feed.cairo
@@ -258,7 +258,7 @@ mod SequencerUptimeFeed {
             ref self: ContractState, initial_status: u128, owner_address: ContractAddress
         ) {
             self.ownable.initializer(owner_address);
-            self.access_control.initializer();
+            self.access_control.initializer(true);
             let round_id = 1_u128;
             let timestamp = starknet::info::get_block_timestamp();
             let from_address = EthAddress {

diff --git a/contracts/src/libraries/access_control.cairo b/contracts/src/libraries/access_control.cairo
@@ -136,8 +136,8 @@ mod AccessControlComponent {
         impl Ownable: OwnableComponent::HasComponent<TContractState>,
         +Drop<TContractState>,
     > of InternalTrait<TContractState> {
-        fn initializer(ref self: ComponentState<TContractState>) {
-            self._check_enabled.write(true);
+        fn initializer(ref self: ComponentState<TContractState>, check_enabled: bool) {
+            self._check_enabled.write(check_enabled);
             self.emit(Event::AccessControlEnabled(AccessControlEnabled {}));
         }
 

diff --git a/contracts/src/ocr2/aggregator.cairo b/contracts/src/ocr2/aggregator.cairo
@@ -398,7 +398,7 @@ mod Aggregator {
         description: felt252
     ) {
         self.ownable.initializer(owner);
-        self.access_control.initializer();
+        self.access_control.initializer(true);
         self._link_token.write(link);
         self._billing_access_controller.write(billing_access_controller);
 

diff --git a/contracts/src/ocr2/aggregator_proxy.cairo b/contracts/src/ocr2/aggregator_proxy.cairo
@@ -174,7 +174,8 @@ mod AggregatorProxy {
     #[constructor]
     fn constructor(ref self: ContractState, owner: ContractAddress, address: ContractAddress) {
         self.ownable.initializer(owner);
-        self.access_control.initializer();
+        self.access_control.initializer(false);
+        self.access_control.disable_access_check();
         self._set_aggregator(address);
     }
 

diff --git a/contracts/src/tests/test_aggregator_proxy.cairo b/contracts/src/tests/test_aggregator_proxy.cairo
@@ -18,7 +18,10 @@ use chainlink::ocr2::aggregator_proxy::AggregatorProxy;
 use chainlink::ocr2::aggregator_proxy::AggregatorProxy::{
     AggregatorProxyImpl, AggregatorProxyInternal, UpgradeableImpl
 };
-use chainlink::libraries::access_control::AccessControlComponent::AccessControlImpl;
+use chainlink::libraries::access_control::{
+    IAccessControllerDispatcher, IAccessControllerDispatcherTrait,
+    AccessControlComponent::AccessControlImpl
+};
 use chainlink::ocr2::aggregator::Round;
 use chainlink::utils::split_felt;
 use chainlink::tests::test_ownable::should_implement_ownable;
@@ -89,6 +92,9 @@ fn test_access_control() {
 
     let (aggregatorProxyAddr, _) = declare("AggregatorProxy").unwrap().deploy(@calldata).unwrap();
 
+    // proxy by default disables the access check, so we re-enable for testing purposes
+    IAccessControllerDispatcher { contract_address: aggregatorProxyAddr }.enable_access_check();
+
     should_implement_access_control(aggregatorProxyAddr, account);
 }
 
@@ -124,7 +130,6 @@ fn test_query_latest_round_data() {
 }
 
 #[test]
-#[should_panic(expected: ('user does not have read access',))]
 fn test_query_latest_round_data_without_access() {
     let (owner, mockAggregatorAddr, mockAggregator, _, _) = setup();
     let mut state = STATE();
@@ -140,7 +145,6 @@ fn test_query_latest_round_data_without_access() {
 }
 
 #[test]
-#[should_panic(expected: ('user does not have read access',))]
 fn test_query_latest_answer_without_access() {
     let (owner, mockAggregatorAddr, mockAggregator, _, _) = setup();
     let mut state = STATE();