x/authz module spec is not up-to-date with implementation

[dalmirel]

Summary of Bug

During the specification and code inspection of authz module (as a part of audit process that includes model-based testing) I have found that several specification markdown files are out of date or missing (in my opinion) some important info on authorization feature and implementation itself.
The following are just recommendations, so please if I'm missing some context needed for better understanding of authz module, feel free to tell me so.

01_concepts.md:

• I think it would be useful to note the version of Cosmos SDK version that introduced Authz module.
• Gas handling: 20 Gas is incurred also when removing grantQueueKey from Grant Queue, as I saw here: consider adding this info here in the spec.
• Staking Authorizations: additional explanation for allow and deny lists would be helpful here.
  -I have found an explanation on issue Authorization logic of staking module: denyList never used? #11391 reported: “If deny list is provided, it should be possible to use any validator not on the deny list” and I think adding this to spec would explain the idea.
  -Also, consider changing and to or in: "Msg takes an AllowList and a DenyList " since it is not possible to create staking authorization with both lists.

02_state.md:

• Grant Queue - second index in the store is not documented and explained in spec. I believe info on usage in Begin blocker would be useful to add and a code snippet.
• Grant Code snippets references old code, where expiration was required, now we have: (gogoproto.nullable) = true with optional expirations feature implemented.

03_messages.md

• Optional expiration time for grants: recommendation to add info here about expiration time for grant and block time, since grant will not be created if time is in the “past”, but will be created if no expiration time is provided (optional expiration time)

ADR30:

• SpendLimit is explained here in a way, that one can conclude that is possible to have Send Authorization with no spending limits defined, even though the actual implementation is that SpendLimit in Send Authorizations can not be nil and limit must be defined.

Version

master (commit: 8800d2e)
auditing is performed for tag: v0.46.0-alpha4 (commit: 354faa8)

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[atheeshp]

SpendLimit is explained here in a way, that one can conclude that is possible to have Send Authorization with no spending limits defined, even though the actual implementation is that SpendLimit in Send Authorizations can not be nil and limit must be defined.

I think this should be implemented in a way that SpendLimit is optional as mentioned in the ADR, if not provided it should be limit less but the logic is not as documented.
cc: @anilcse @AmauryM @robert-zaremba

[atheeshp]

I think this should be implemented in a way that SpendLimit is optional as mentioned in the ADR, if not provided it should be limit less but the logic is not as documented. cc: @anilcse @AmauryM @robert-zaremba

after having a small discussion with @aleem1314 & @AmauryM we just need to modify the ADR here, if we need limit less bank authz we can use generic authz.