Update Adapter Access Control Logic

.github/workflows/framework-test.yml

@@ -40,6 +40,17 @@ jobs:
         if: hashFiles('Cargo.lock') == ''
         working-directory: ./framework
         run: cargo generate-lockfile
+      - name: Free up disk space on runner
+        run: |
+          df -h
+          rm -rf /usr/share/dotnet/
+          sudo apt-get remove -y 'php.*'
+          sudo apt-get remove -y '^dotnet-.*'
+          sudo apt-get remove -y azure-cli firefox powershell mono-devel
+          sudo apt-get autoremove -y
+          sudo apt-get clean
+          df -h
+        shell: bash
       - uses: Swatinem/rust-cache@v2
         with: 
           workspaces: "framework -> target"

framework/contracts/account/src/absacc/auth/mod.rs

@@ -390,11 +390,11 @@ mod test {
         for id in 0..0b10000000 {
             let (unmasked_id, admin) = AuthId::new(id, true).unwrap().cred_id();
             assert_eq!(id, unmasked_id);
-            assert_eq!(admin, true);
+            assert!(admin);
 
             let (unmasked_id, admin) = AuthId::new(id, false).unwrap().cred_id();
             assert_eq!(id, unmasked_id);
-            assert_eq!(admin, false);
+            assert!(!admin);
         }
     }
 }

framework/contracts/account/src/absacc/auth/secp256r1.rs

@@ -40,23 +40,16 @@ mod tests {
         let verifying_key_binary = Binary::from(verifying_key_bytes.to_vec());
         println!("verifying key: {}", hex::encode(verifying_key_bytes));
 
-        assert_eq!(
-            true,
-            verify(
-                &test_value.to_vec(),
-                signature_bytes.as_slice(),
-                &verifying_key_binary,
-            )
-            .unwrap()
-        );
+        assert!(verify(
+            test_value,
+            signature_bytes.as_slice(),
+            &verifying_key_binary,
+        )
+        .unwrap());
 
         // test with invalid msg
         let bad_value = "invalid starting msg".as_bytes();
-        let result = verify(
-            &bad_value.to_vec(),
-            signature_bytes.as_slice(),
-            &verifying_key_binary,
-        );
+        let result = verify(bad_value, signature_bytes.as_slice(), &verifying_key_binary);
         assert!(result.is_err())
     }
 }

framework/contracts/account/src/contract.rs

@@ -23,19 +23,19 @@ use abstract_std::{
 };
 use cosmwasm_std::{
     ensure_eq, wasm_execute, Addr, Binary, Coins, Deps, DepsMut, Env, MessageInfo, Reply, Response,
-    StdResult, SubMsgResult,
+    StdResult,
 };
 
 pub use crate::migrate::migrate;
 use crate::{
     config::{update_account_status, update_info, update_internal_config},
     error::AccountError,
     execution::{
-        add_auth_method, execute_ibc_action, execute_module_action, execute_module_action_response,
-        ica_action, remove_auth_method,
+        add_auth_method, admin_execute, admin_execute_on_module, execute_ibc_action, execute_msgs,
+        execute_msgs_with_data, execute_on_module, ica_action, remove_auth_method,
     },
     modules::{
-        _install_modules, exec_on_module, install_modules,
+        _install_modules, install_modules,
         migration::{handle_callback, upgrade_modules},
         uninstall_module, MIGRATE_CONTEXT,
     },
@@ -45,7 +45,7 @@ use crate::{
         handle_module_info_query, handle_module_versions_query, handle_sub_accounts_query,
         handle_top_level_owner_query,
     },
-    reply::{forward_response_data, register_dependencies},
+    reply::{admin_action_reply, forward_response_reply, register_dependencies},
     sub_account::{
         create_sub_account, handle_sub_account_action, maybe_update_sub_account_governance,
         remove_account_from_contracts,
@@ -59,8 +59,9 @@ pub type AccountResult<R = Response> = Result<R, AccountError>;
 
 pub const CONTRACT_VERSION: &str = env!("CARGO_PKG_VERSION");
 
-pub const RESPONSE_REPLY_ID: u64 = 1;
-pub const REGISTER_MODULES_DEPENDENCIES_REPLY_ID: u64 = 2;
+pub const FORWARD_RESPONSE_REPLY_ID: u64 = 1;
+pub const ADMIN_ACTION_REPLY_ID: u64 = 2;
+pub const REGISTER_MODULES_DEPENDENCIES_REPLY_ID: u64 = 3;
 
 #[cfg_attr(feature = "export", cosmwasm_std::entry_point)]
 pub fn instantiate(
@@ -258,13 +259,39 @@ pub fn execute(mut deps: DepsMut, env: Env, info: MessageInfo, msg: ExecuteMsg)
             is_suspended: suspension_status,
         } => update_account_status(deps, info, suspension_status).map_err(AccountError::from),
         msg => {
-            // Block actions if user is not subscribed
+            // Block actions if account is suspended
             let is_suspended = SUSPENSION_STATUS.load(deps.storage)?;
             if is_suspended {
                 return Err(AccountError::AccountSuspended {});
             }
 
             match msg {
+                // ## Execution ##
+                ExecuteMsg::Execute { msgs } => {
+                    execute_msgs(deps, &info.sender, msgs).map_err(AccountError::from)
+                }
+                ExecuteMsg::AdminExecute { addr, msg } => {
+                    let addr = deps.api.addr_validate(&addr)?;
+                    admin_execute(deps, info, addr, msg)
+                }
+                ExecuteMsg::ExecuteWithData { msg } => {
+                    execute_msgs_with_data(deps, &info.sender, msg).map_err(AccountError::from)
+                }
+                ExecuteMsg::ExecuteOnModule {
+                    module_id,
+                    exec_msg,
+                } => execute_on_module(deps, info, module_id, exec_msg).map_err(AccountError::from),
+                ExecuteMsg::AdminExecuteOnModule { module_id, msg } => {
+                    admin_execute_on_module(deps, info, module_id, msg)
+                }
+                ExecuteMsg::IbcAction { msg } => {
+                    execute_ibc_action(deps, info, msg).map_err(AccountError::from)
+                }
+                ExecuteMsg::IcaAction { action_query_msg } => {
+                    ica_action(deps, info, action_query_msg).map_err(AccountError::from)
+                }
+
+                // ## Configuration ##
                 ExecuteMsg::UpdateInternalConfig(config) => {
                     update_internal_config(deps, info, config).map_err(AccountError::from)
                 }
@@ -274,29 +301,6 @@ pub fn execute(mut deps: DepsMut, env: Env, info: MessageInfo, msg: ExecuteMsg)
                 ExecuteMsg::UninstallModule { module_id } => {
                     uninstall_module(deps, info, module_id).map_err(AccountError::from)
                 }
-                ExecuteMsg::ExecOnModule {
-                    module_id,
-                    exec_msg,
-                } => exec_on_module(deps, info, module_id, exec_msg).map_err(AccountError::from),
-                ExecuteMsg::CreateSubAccount {
-                    name,
-                    description,
-                    link,
-                    namespace,
-                    install_modules,
-                    account_id,
-                } => create_sub_account(
-                    deps,
-                    info,
-                    env,
-                    name,
-                    description,
-                    link,
-                    namespace,
-                    install_modules,
-                    account_id,
-                )
-                .map_err(AccountError::from),
                 ExecuteMsg::Upgrade { modules } => {
                     upgrade_modules(deps, env, info, modules).map_err(AccountError::from)
                 }
@@ -305,12 +309,6 @@ pub fn execute(mut deps: DepsMut, env: Env, info: MessageInfo, msg: ExecuteMsg)
                     description,
                     link,
                 } => update_info(deps, info, name, description, link).map_err(AccountError::from),
-                ExecuteMsg::UpdateSubAccount(action) => {
-                    handle_sub_account_action(deps, info, action).map_err(AccountError::from)
-                }
-                // TODO: Update module migrate logic to not use callback!
-                // ExecuteMsg::Callback(CallbackMsg {}) => handle_callback(deps, env, info),
-                // Used to claim or renounce an ownership change.
                 ExecuteMsg::UpdateOwnership(action) => {
                     // If sub-account related it may require some messages to be constructed beforehand
                     let msgs = match &action {
@@ -337,18 +335,33 @@ pub fn execute(mut deps: DepsMut, env: Env, info: MessageInfo, msg: ExecuteMsg)
                             .add_messages(msgs),
                     )
                 }
-                ExecuteMsg::ModuleAction { msgs } => {
-                    execute_module_action(deps, info, msgs).map_err(AccountError::from)
-                }
-                ExecuteMsg::ModuleActionWithData { msg } => {
-                    execute_module_action_response(deps, info, msg).map_err(AccountError::from)
-                }
-                ExecuteMsg::IbcAction { msg } => {
-                    execute_ibc_action(deps, info, msg).map_err(AccountError::from)
-                }
-                ExecuteMsg::IcaAction { action_query_msg } => {
-                    ica_action(deps, info, action_query_msg).map_err(AccountError::from)
+
+                // ## Sub-Accounts ##
+                ExecuteMsg::CreateSubAccount {
+                    name,
+                    description,
+                    link,
+                    namespace,
+                    install_modules,
+                    account_id,
+                } => create_sub_account(
+                    deps,
+                    info,
+                    env,
+                    name,
+                    description,
+                    link,
+                    namespace,
+                    install_modules,
+                    account_id,
+                )
+                .map_err(AccountError::from),
+                ExecuteMsg::UpdateSubAccount(action) => {
+                    handle_sub_account_action(deps, info, action).map_err(AccountError::from)
                 }
+
+                // ## Other ##
+                // TODO: Update module migrate logic to not use callback!
                 ExecuteMsg::UpdateStatus { is_suspended: _ } => {
                     unreachable!("Update status case is reached above")
                 }
@@ -365,17 +378,11 @@ pub fn execute(mut deps: DepsMut, env: Env, info: MessageInfo, msg: ExecuteMsg)
 
 #[cfg_attr(feature = "export", cosmwasm_std::entry_point)]
 pub fn reply(deps: DepsMut, _env: Env, msg: Reply) -> AccountResult {
-    match msg {
-        Reply {
-            id: RESPONSE_REPLY_ID,
-            result: SubMsgResult::Ok(_),
-            ..
-        } => forward_response_data(msg),
-        Reply {
-            id: REGISTER_MODULES_DEPENDENCIES_REPLY_ID,
-            result: SubMsgResult::Ok(_),
-            ..
-        } => register_dependencies(deps),
+    match msg.id {
+        FORWARD_RESPONSE_REPLY_ID => forward_response_reply(msg),
+        ADMIN_ACTION_REPLY_ID => admin_action_reply(deps),
+        REGISTER_MODULES_DEPENDENCIES_REPLY_ID => register_dependencies(deps),
+
         _ => Err(AccountError::UnexpectedReply {}),
     }
 }

framework/contracts/account/src/execution.rs

@@ -1,15 +1,20 @@
 use abstract_sdk::std::{
     account::state::WHITELISTED_MODULES, ibc_client::ExecuteMsg as IbcClientMsg, IBC_CLIENT,
 };
-use abstract_std::{account::state::ACCOUNT_MODULES, objects::ownership, ICA_CLIENT};
+use abstract_std::{
+    account::state::{ACCOUNT_MODULES, CALLING_TO_AS_ADMIN},
+    objects::ownership,
+    ICA_CLIENT,
+};
 use cosmwasm_std::{
     wasm_execute, Addr, Binary, CosmosMsg, DepsMut, Empty, Env, MessageInfo, StdError, SubMsg,
-    WasmQuery,
+    WasmMsg, WasmQuery,
 };
 
 use crate::{
-    contract::{AccountResponse, AccountResult, RESPONSE_REPLY_ID},
+    contract::{AccountResponse, AccountResult, ADMIN_ACTION_REPLY_ID, FORWARD_RESPONSE_REPLY_ID},
     error::AccountError,
+    modules::load_module_addr,
 };
 
 /// Check that sender either whitelisted or governance
@@ -36,30 +41,82 @@ pub(crate) fn assert_whitelisted_or_owner(deps: &mut DepsMut, sender: &Addr) ->
 
 /// Executes `Vec<CosmosMsg>` on the proxy.
 /// Permission: Module
-pub fn execute_module_action(
+pub fn execute_msgs(
     mut deps: DepsMut,
-    msg_info: MessageInfo,
+    msg_sender: &Addr,
     msgs: Vec<CosmosMsg<Empty>>,
 ) -> AccountResult {
-    assert_whitelisted_or_owner(&mut deps, &msg_info.sender)?;
+    assert_whitelisted_or_owner(&mut deps, msg_sender)?;
 
     Ok(AccountResponse::action("execute_module_action").add_messages(msgs))
 }
 
 /// Executes `CosmosMsg` on the proxy and forwards its response.
 /// Permission: Module
-pub fn execute_module_action_response(
+pub fn execute_msgs_with_data(
     mut deps: DepsMut,
-    msg_info: MessageInfo,
+    msg_sender: &Addr,
     msg: CosmosMsg<Empty>,
 ) -> AccountResult {
-    assert_whitelisted_or_owner(&mut deps, &msg_info.sender)?;
+    assert_whitelisted_or_owner(&mut deps, msg_sender)?;
 
-    let submsg = SubMsg::reply_on_success(msg, RESPONSE_REPLY_ID);
+    let submsg = SubMsg::reply_on_success(msg, FORWARD_RESPONSE_REPLY_ID);
 
     Ok(AccountResponse::action("execute_module_action_response").add_submessage(submsg))
 }
 
+/// Execute the [`exec_msg`] on the provided [`module_id`],
+/// This is a simple wrapper around [`ExecuteMsg::Execute`](abstract_std::account::ExecuteMsg::Execute).
+pub fn execute_on_module(
+    deps: DepsMut,
+    info: MessageInfo,
+    module_id: String,
+    exec_msg: Binary,
+) -> AccountResult {
+    let module_addr = load_module_addr(deps.storage, &module_id)?;
+    execute_msgs(
+        deps,
+        &info.sender,
+        vec![CosmosMsg::Wasm(WasmMsg::Execute {
+            contract_addr: module_addr.into(),
+            msg: exec_msg,
+            funds: info.funds,
+        })],
+    )
+}
+
+pub fn admin_execute(
+    deps: DepsMut,
+    info: MessageInfo,
+    addr: Addr,
+    exec_msg: Binary,
+) -> AccountResult {
+    ownership::assert_nested_owner(deps.storage, &deps.querier, &info.sender)?;
+
+    CALLING_TO_AS_ADMIN.save(deps.storage, &addr)?;
+
+    let msg = SubMsg::reply_on_success(
+        WasmMsg::Execute {
+            contract_addr: addr.to_string(),
+            msg: exec_msg,
+            funds: info.funds,
+        },
+        ADMIN_ACTION_REPLY_ID,
+    );
+
+    Ok(AccountResponse::action("admin_execute").add_submessage(msg))
+}
+
+pub fn admin_execute_on_module(
+    deps: DepsMut,
+    info: MessageInfo,
+    module_id: String,
+    exec_msg: Binary,
+) -> AccountResult {
+    let module_addr = load_module_addr(deps.storage, &module_id)?;
+    admin_execute(deps, info, module_addr, exec_msg)
+}
+
 /// Executes IBC actions on the IBC client.
 /// Permission: Module
 pub fn execute_ibc_action(
@@ -165,7 +222,7 @@ mod test {
             let mut deps = mock_dependencies();
             mock_init(&mut deps)?;
 
-            let msg = ExecuteMsg::ModuleAction { msgs: vec![] };
+            let msg = ExecuteMsg::Execute { msgs: vec![] };
 
             let info = message_info(&deps.api.addr_make("not_whitelisted"), &[]);
 
@@ -198,7 +255,7 @@ mod test {
             )?
             .into();
 
-            let msg = ExecuteMsg::ModuleAction {
+            let msg = ExecuteMsg::Execute {
                 msgs: vec![action.clone()],
             };