authz: unable to execute authorization because it doesn't exist

[cmwaters]

Problem Definition

I am trying to grant authorization to execute a message. When I set up the authorization, I can query it and see that it is there:

❯ rook query authz grants rook132x2jwl0xzlmyz3yqpzal7c59nh4c2rk79q4n0 rook1xsz59d0scnfckttqaahruseqtje99vjmchucur                   
grants:
- authorization:
    '@type': /cosmos.authz.v1beta1.GenericAuthorization
    msg: /rook.game.MsgBuild
  expiration: "0001-01-01T00:00:00Z"
- authorization:
    '@type': /cosmos.authz.v1beta1.GenericAuthorization
    msg: /rook.game.MsgMove
  expiration: "0001-01-01T00:00:00Z"
pagination:
  next_key: null
  total: "0"

However when I send a MsgExec message I get the following error:

failed to execute message; message index: 0: authorization not found. Granter: rook132x2jwl0xzlmyz3yqpzal7c59nh4c2rk79q4n0, grantee rook1xsz59d0scnfckttqaahruseqtje99vjmchucur, msgType: /rook.game.MsgMove: unauthorized

(note, I've extended the error message to add some more context)

More so, If I run the same query with a specific message type url, I also get an error:

❯ rook query authz grants rook132x2jwl0xzlmyz3yqpzal7c59nh4c2rk79q4n0 rook1xsz59d0scnfckttqaahruseqtje99vjmchucur /rook.game.MsgMove
Error: rpc error: code = NotFound desc = rpc error: code = NotFound desc = no authorization found for /rook.game.MsgMove type: key not found

I'm guessing there's something to do with the way that the msgTypeUrl is being parsed which causes it not to recognize it.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[cmwaters]

Okay I worked out what was happening. When I was creating these authorizations, I wasn't setting an expiration date (I'm not sure if they are mandatory or not but I didn't want mine to have an expiration). So when GetCleanAuthorization was called it was fetching the grant and then realizing that it's expiration time was zero which is less than the current time so it removed the authorization. For some reason even after it had deleted the authorization it was still showing when I queried:

rook query authz grants rook132x2jwl0xzlmyz3yqpzal7c59nh4c2rk79q4n0 rook1xsz59d0scnfckttqaahruseqtje99vjmchucur

So I'm not sure if it's deleting anything. I guess this is because it is a query and not a tx. Nevertheless, some of the messages could be clearer. Took me a while to understand what's happening.

If we do want to allow authorizations without expiry then we need to also check for non-zero as well:

if !grant.Expiration.IsZero() && grant.Expiration.Before(ctx.BlockHeader().Time) {

[jhernandezb]

Expired authorizations are not pruned see #8311