allow root to call update_shard_config

enclave-bridge/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "pallet-enclave-bridge"
 description = "The bridge between L1(integritee network) and L2(enclaves) for integritee blockchains and parachains"
-version = "0.10.0"
+version = "0.11.0"
 authors = ["Integritee AG <hello@integritee.network>"]
 homepage = "https://integritee.network/"
 repository = "https://github.com/integritee-network/pallets/"

enclave-bridge/src/lib.rs

@@ -312,28 +312,45 @@ pub mod pallet {
 			shard_config: ShardConfig<T::AccountId>,
 			enactment_delay: T::BlockNumber,
 		) -> DispatchResultWithPostInfo {
-			let sender = ensure_signed(origin)?;
-			let enclave = Teerex::<T>::get_sovereign_enclave(&sender)?;
+			let maybe_sender = ensure_signed_or_root(origin)?;
+
 			let current_block_number = <frame_system::Pallet<T>>::block_number();
 			let new_upgradable_shard_config: UpgradableShardConfig<T::AccountId, T::BlockNumber> =
 				match Self::get_maybe_updated_shard_config(shard, current_block_number, false) {
 					Some(old_config) => {
-						ensure!(
-							old_config.enclave_fingerprint == enclave.fingerprint(),
-							Error::<T>::WrongFingerprintForShard
-						);
+						if let Some(sender) = maybe_sender {
+							let enclave = Teerex::<T>::get_sovereign_enclave(&sender)?;
+							ensure!(
+								old_config.enclave_fingerprint == enclave.fingerprint(),
+								Error::<T>::WrongFingerprintForShard
+							);
+							Self::touch_shard(
+								shard,
+								&sender,
+								enclave.fingerprint(),
+								current_block_number,
+							)?;
+						}
 						UpgradableShardConfig::from(old_config).with_pending_upgrade(
 							shard_config,
 							current_block_number.saturating_add(enactment_delay),
 						)
 					},
 					None => {
-						// if shard does not exist, we allow any ShardIdentifier to be created by any registered enclave
+						// if shard does not exist, we allow any ShardIdentifier to be created by any registered enclave or root
+						if let Some(sender) = maybe_sender {
+							let enclave = Teerex::<T>::get_sovereign_enclave(&sender)?;
+							Self::touch_shard(
+								shard,
+								&sender,
+								enclave.fingerprint(),
+								current_block_number,
+							)?;
+						}
 						shard_config.into()
 					},
 				};
 
-			Self::touch_shard(shard, &sender, enclave.fingerprint(), current_block_number)?;
 			<ShardConfigRegistry<T>>::insert(shard, new_upgradable_shard_config.clone());
 
 			log::info!(

enclave-bridge/src/tests/test_shard_config.rs

@@ -77,6 +77,15 @@ fn initial_update_shard_config_on_foreign_shard_works() {
 			ShardConfig::new(enclave.fingerprint()),
 			0,
 		));
+
+		// same as root
+		let new_shard = ShardIdentifier::from([2u8; 32]);
+		assert_ok!(EnclaveBridge::update_shard_config(
+			RuntimeOrigin::root(),
+			new_shard,
+			ShardConfig::new(enclave.fingerprint()),
+			0,
+		));
 	})
 }
 
@@ -109,6 +118,26 @@ fn update_shard_config_to_new_fingerprint_works() {
 		let expected_event =
 			RuntimeEvent::EnclaveBridge(EnclaveBridgeEvent::ShardConfigUpdated(shard));
 		assert!(System::events().iter().any(|a| a.event == expected_event));
+
+		// same as root. force-authorize another enclave for existing shard
+		let new_shard = ShardIdentifier::from([2u8; 32]);
+		assert_ok!(EnclaveBridge::update_shard_config(
+			RuntimeOrigin::root(),
+			new_shard,
+			ShardConfig::new([2u8; 32].into()),
+			0,
+		));
+
+		assert_ok!(EnclaveBridge::update_shard_config(
+			RuntimeOrigin::root(),
+			shard,
+			ShardConfig::new([3u8; 32].into()),
+			10,
+		));
+
+		let expected_event =
+			RuntimeEvent::EnclaveBridge(EnclaveBridgeEvent::ShardConfigUpdated(new_shard));
+		assert!(System::events().iter().any(|a| a.event == expected_event));
 	})
 }