Principal namespaces slp

pact/gas-payer/gas-payer-v1.repl

@@ -7,6 +7,7 @@
 (env-data {'gas-payer-operate: ["operate"]})
 (env-keys ["operate"])
 
+(env-exec-config ['DisablePact44])
 (load "gas-payer-v1-reference.pact")
 
 (verify "user.gas-payer-v1-reference")

pact/genesis/mainnet/ns.yaml

@@ -1,4 +1,4 @@
-codeFile: ../../namespaces/ns.pact
+codeFile: ../../namespaces/v1/ns.pact
 data:
   ns-admin-keyset:
     keys:

pact/genesis/ns.yaml

@@ -1,4 +1,4 @@
-codeFile: ../namespaces/ns.pact
+codeFile: ../namespaces/v1/ns.pact
 data:
   ns-admin-keyset: ["368820f80c324bbc7c2b0610688a7da43e39f91d118732671cd9c7500ff43cca"]
   ns-operate-keyset: ["368820f80c324bbc7c2b0610688a7da43e39f91d118732671cd9c7500ff43cca"]

pact/namespaces/ns.pact

@@ -1,7 +1,3 @@
-
-(define-keyset 'ns-admin-keyset (read-keyset 'ns-admin-keyset))
-(define-keyset 'ns-operate-keyset (read-keyset 'ns-genesis-keyset))
-
 (module ns GOVERNANCE
   "Administers definition of new namespaces in Chainweb."
 
@@ -35,21 +31,26 @@
       ( ns-name:string
         ns-admin:guard
         )
-    " Manages namespace install for Chainweb. Requires active row in registry \
+    " Manages namespace install for Chainweb. \
+    \ Supports principal namespaces ('n' + hashed principal of admin guard). \
+    \ Non-principal namespaces require active row in registry \
     \ for NS-NAME with guard matching NS-ADMIN."
 
-    (validate-name ns-name)
+    (if (= (+ "n" (hash (create-principal ns-admin))) ns-name)
 
-    (with-default-read registry ns-name
-      { 'admin-guard : ns-admin
-      , 'active : false }
-      { 'admin-guard := ag
-      , 'active := is-active }
+      true ;; allow principal namespaces
+
+      (with-default-read registry ns-name       ;; otherwise enforce registry
+        { 'admin-guard : ns-admin
+        , 'active : false }
+        { 'admin-guard := ag
+        , 'active := is-active }
 
         (enforce is-active "Inactive or unregistered namespace")
         (enforce (= ns-admin ag) "Admin guard must match guard in registry")
 
-        true))
+        true)
+      ))
 
   (defun write-registry:string
       ( ns-name:string
@@ -73,20 +74,4 @@
       ( ns-name:string )
     (read registry ns-name))
 
-  )
-
-(create-table registry)
-
-(write-registry "kadena"
-  (keyset-ref-guard 'ns-operate-keyset) true)
-(write-registry "user" GUARD_FAILURE true)
-(write-registry "free" GUARD_FAILURE true)
-
-(define-namespace "kadena"
-  (keyset-ref-guard 'ns-operate-keyset)
-  (keyset-ref-guard 'ns-operate-keyset))
-
-(define-namespace "user" GUARD_SUCCESS GUARD_FAILURE)
-(define-namespace "free" GUARD_SUCCESS GUARD_FAILURE)
-;;rotate to real operate keyset
-(define-keyset 'ns-operate-keyset (read-keyset 'ns-operate-keyset))
+)

pact/namespaces/ns.repl

@@ -5,6 +5,7 @@
  , 'ns-operate-keyset: ["operate"]
  , 'ns-genesis-keyset: { "keys": [], "pred": "="} })
 
+(load "v1/ns.pact")
 (load "ns.pact")
 (commit-tx)
 
@@ -67,6 +68,7 @@
   (defcap G () (enforce false "disabled"))
   (defun foo () 4))
 (commit-tx)
+(begin-tx)
 
 (expect "kadena.mod2 works" 4 (kadena.mod2.foo))
 
@@ -85,3 +87,83 @@
 (expect-failure
   "must be latin1 charset"
   (write-registry "emilyπ" GUARD_SUCCESS true))
+
+(commit-tx)
+(begin-tx)
+
+(env-exec-config [])
+(env-data
+ { 'single :
+   ["70c787fcfe6c6f4ec23d13c2e94682bc90952f7cec06c7dbac1c012b0b6678b9"]
+ , 'multi : ["a", "b"]
+ })
+
+(expect-failure
+  "Principal of other than admin keyset fails"
+  "Inactive or unregistered namespace"
+  (define-namespace
+   "nD8cqMpEfqKF_tj8I0be5VDdoYfBvb5ax_tFZMoHvXU4"
+   (read-keyset 'single)
+   (read-keyset 'multi))
+)
+
+(define-namespace
+  "nD8cqMpEfqKF_tj8I0be5VDdoYfBvb5ax_tFZMoHvXU4"
+  (read-keyset 'single)
+  (read-keyset 'single))
+
+(define-namespace
+  "ndDxw31bRij5gA0Xvl_uDUOZMvrnkMscu-Ax-H0ocJFM"
+  (read-keyset 'multi)
+  (read-keyset 'multi))
+
+(commit-tx)
+
+(begin-tx "test rotation")
+(env-keys
+  [ "70c787fcfe6c6f4ec23d13c2e94682bc90952f7cec06c7dbac1c012b0b6678b9" ])
+;; rotate to multi/multi
+(define-namespace
+  "nD8cqMpEfqKF_tj8I0be5VDdoYfBvb5ax_tFZMoHvXU4"
+  (read-keyset 'multi)
+  (read-keyset 'multi))
+;; rotate to multi/single
+(env-keys ["a","b"])
+(define-namespace
+  "nD8cqMpEfqKF_tj8I0be5VDdoYfBvb5ax_tFZMoHvXU4"
+  (read-keyset 'multi)
+  (read-keyset 'single))
+(rollback-tx)
+
+
+(begin-tx)
+(env-exec-config [])
+(env-keys
+  [ "70c787fcfe6c6f4ec23d13c2e94682bc90952f7cec06c7dbac1c012b0b6678b9"
+  , "a"
+  , "b"
+  ]
+  )
+
+(namespace "nD8cqMpEfqKF_tj8I0be5VDdoYfBvb5ax_tFZMoHvXU4")
+(module modK G
+  (defcap G () true)
+  (defun f () 1))
+
+(namespace "ndDxw31bRij5gA0Xvl_uDUOZMvrnkMscu-Ax-H0ocJFM")
+(module modW G
+  (defcap G () true)
+  (defun f () 2))
+
+(commit-tx)
+(begin-tx)
+
+(expect
+  "k: principal namespaces work"
+  1
+  (nD8cqMpEfqKF_tj8I0be5VDdoYfBvb5ax_tFZMoHvXU4.modK.f))
+
+(expect
+  "w: principal namespaces work"
+  2
+  (ndDxw31bRij5gA0Xvl_uDUOZMvrnkMscu-Ax-H0ocJFM.modW.f))

pact/namespaces/v1/ns.pact

@@ -0,0 +1,92 @@
+
+(define-keyset 'ns-admin-keyset (read-keyset 'ns-admin-keyset))
+(define-keyset 'ns-operate-keyset (read-keyset 'ns-genesis-keyset))
+
+(module ns GOVERNANCE
+  "Administers definition of new namespaces in Chainweb."
+
+  (defschema reg-entry
+    admin-guard:guard
+    active:bool)
+
+  (deftable registry:{reg-entry})
+
+  (defcap GOVERNANCE ()
+    (enforce-keyset 'ns-admin-keyset))
+
+  (defcap OPERATE ()
+    (enforce-keyset 'ns-operate-keyset))
+
+  (defconst GUARD_SUCCESS (create-user-guard (success)))
+  (defconst GUARD_FAILURE (create-user-guard (failure)))
+
+  (defun success ()
+    true)
+  (defun failure ()
+    (enforce false "Disabled"))
+
+  (defun validate-name (name)
+    (enforce (!= "" name) "Empty name not allowed")
+    (enforce (< (length name) 64) "Name must be less than 64 characters long")
+    (enforce (is-charset CHARSET_LATIN1 name)
+             "Name must be in latin1 charset"))
+
+  (defun validate:bool
+      ( ns-name:string
+        ns-admin:guard
+        )
+    " Manages namespace install for Chainweb. Requires active row in registry \
+    \ for NS-NAME with guard matching NS-ADMIN."
+
+    (validate-name ns-name)
+
+    (with-default-read registry ns-name
+      { 'admin-guard : ns-admin
+      , 'active : false }
+      { 'admin-guard := ag
+      , 'active := is-active }
+
+        (enforce is-active "Inactive or unregistered namespace")
+        (enforce (= ns-admin ag) "Admin guard must match guard in registry")
+
+        true))
+
+  (defun write-registry:string
+      ( ns-name:string
+        guard:guard
+        active:bool
+        )
+    " Write entry with GUARD and ACTIVE into registry for NAME. \
+    \ Guarded by operate keyset. "
+
+    (with-capability (OPERATE)
+
+      (validate-name ns-name)
+
+      (write registry ns-name
+        { 'admin-guard: guard
+        , 'active: active })
+
+      "Register entry written"))
+
+  (defun query:object{reg-entry}
+      ( ns-name:string )
+    (read registry ns-name))
+
+  )
+
+(create-table registry)
+
+(write-registry "kadena"
+  (keyset-ref-guard 'ns-operate-keyset) true)
+(write-registry "user" GUARD_FAILURE true)
+(write-registry "free" GUARD_FAILURE true)
+
+(define-namespace "kadena"
+  (keyset-ref-guard 'ns-operate-keyset)
+  (keyset-ref-guard 'ns-operate-keyset))
+
+(define-namespace "user" GUARD_SUCCESS GUARD_FAILURE)
+(define-namespace "free" GUARD_SUCCESS GUARD_FAILURE)
+;;rotate to real operate keyset
+(define-keyset 'ns-operate-keyset (read-keyset 'ns-operate-keyset))

pact/namespaces/v1/ns.repl

@@ -0,0 +1,87 @@
+(env-exec-config ["DisablePact44"])
+(begin-tx)
+(env-data
+ { 'ns-admin-keyset: ["admin"]
+ , 'ns-operate-keyset: ["operate"]
+ , 'ns-genesis-keyset: { "keys": [], "pred": "="} })
+
+(load "ns.pact")
+(commit-tx)
+
+(env-namespace-policy false (ns.validate))
+
+(begin-tx)
+(namespace 'user)
+(env-keys [])
+
+(module mod G
+  (defcap G () (enforce false "disabled"))
+  (defun foo () 1))
+
+(namespace 'free)
+
+(module mod G
+  (defcap G () (enforce false "disabled"))
+  (defun foo () 2))
+
+(expect-failure
+  "Cannot bring kadena ns into scope w/o operate admin"
+  (namespace 'kadena))
+
+(env-keys ["operate"])
+
+(namespace 'kadena)
+
+(module mod G
+  (defcap G () (enforce false "disabled"))
+  (defun foo () 3))
+
+(commit-tx)
+
+(expect "user.mod works" 1 (user.mod.foo))
+(expect "free.mod works" 2 (free.mod.foo))
+(expect "kadena.mod works" 3 (kadena.mod.foo))
+
+(begin-tx)
+(env-keys ["operate"])
+(env-data
+ { 'ns-admin-keyset: ["admin"]
+ , 'ns-operate-keyset: ["operate"] })
+
+(expect-failure "cannot redefine user"
+  (define-namespace 'user ns.GUARD_FAILURE ns.GUARD_FAILURE))
+(expect-failure "cannot redefine free"
+  (define-namespace 'free ns.GUARD_FAILURE ns.GUARD_FAILURE))
+(expect "can redefine kadena"
+  "Namespace defined: kadena"
+  (define-namespace 'kadena ns.GUARD_SUCCESS ns.GUARD_FAILURE))
+
+(commit-tx)
+
+(begin-tx)
+(env-keys [])
+
+(namespace 'kadena)
+
+(module mod2 G
+  (defcap G () (enforce false "disabled"))
+  (defun foo () 4))
+(commit-tx)
+
+(expect "kadena.mod2 works" 4 (kadena.mod2.foo))
+
+(use ns)
+(env-keys ["operate"])
+(expect-failure
+  "cannot register empty name"
+  (write-registry "" GUARD_SUCCESS true))
+
+(expect-failure
+  "cannot register >64 length name"
+  (write-registry
+    "1234567890123456789012345678901234567890123456789012345678901234567890"
+    GUARD_SUCCESS true))
+
+(expect-failure
+  "must be latin1 charset"
+  (write-registry "emilyπ" GUARD_SUCCESS true))

pact/namespaces/yaml/ns-v2.yaml

@@ -0,0 +1,5 @@
+codeFile: ../ns.pact
+nonce: load-ns-v2-mainnet
+signers:
+  - public: 56ff9e5c1b5ec3e98172a76aa3cdc03d3ec664f147267fd99eee4dd09763c853
+  - public: a241430816f0112add2179e3e3939ebab5336ab024be990960e684e38eb87d80

test/Chainweb/Test/Pact/TransactionTests.hs

@@ -79,6 +79,12 @@ coinReplV4 = "pact/coin-contract/v4/coin-v4.repl"
 coinReplV5 :: FilePath
 coinReplV5 = "pact/coin-contract/v5/coin-v5.repl"
 
+nsReplV1 :: FilePath
+nsReplV1 = "pact/namespaces/v1/ns.repl"
+
+nsReplV2 :: FilePath
+nsReplV2 = "pact/namespaces/ns.repl"
+
 logger :: Logger
 #if DEBUG_TEST
 logger = newLogger alwaysLog ""
@@ -102,7 +108,10 @@ tests = testGroup "Chainweb.Test.Pact.TransactionTests"
       , testCase "v4" (ccReplTests coinReplV4)
       , testCase "v5" (ccReplTests coinReplV5)
       ]
-    , testCase "Ns Repl Tests" (ccReplTests "pact/namespaces/ns.repl")
+    , testGroup "Namespace repl unit tests"
+      [ testCase "Ns-v1 repl tests" $ ccReplTests nsReplV1
+      , testCase "Ns-v2 repl tests" $ ccReplTests nsReplV2
+      ]
     , testCase "Payer Repl Tests" (ccReplTests "pact/gas-payer/gas-payer-v1.repl")
     ]
   , testGroup "Precompiled Statements Tests"