Type checking for authorized references

encoding/json/decode.go

@@ -126,7 +126,8 @@ const (
 	staticTypeKey     = "staticType"
 	addressKey        = "address"
 	pathKey           = "path"
-	authorizedKey     = "authorized"
+	authorizationKey  = "authorization"
+	entitlementsKey   = "entitlements"
 	sizeKey           = "size"
 	typeIDKey         = "typeID"
 	restrictionsKey   = "restrictions"
@@ -943,6 +944,38 @@ func (d *Decoder) decodeFunctionType(typeParametersValue, parametersValue, retur
 	)
 }
 
+func (d *Decoder) decodeAuthorization(authorizationJSON any) cadence.Authorization {
+	obj := toObject(authorizationJSON)
+	kind := obj.Get(kindKey)
+
+	switch kind {
+	case "Unauthorized":
+		return cadence.UnauthorizedAccess
+	case "EntitlementMapAuthorization":
+		entitlements := toSlice(obj.Get(entitlementsKey))
+		m := toString(toObject(entitlements[0]).Get("typeID"))
+		return cadence.NewEntitlementMapAuthorization(d.gauge, common.TypeID(m))
+	case "EntitlementConjunctionSet":
+		var typeIDs []common.TypeID
+		entitlements := toSlice(obj.Get(entitlementsKey))
+		for _, entitlement := range entitlements {
+			id := toString(toObject(entitlement).Get("typeID"))
+			typeIDs = append(typeIDs, common.TypeID(id))
+		}
+		return cadence.NewEntitlementSetAuthorization(d.gauge, typeIDs, cadence.Conjunction)
+	case "EntitlementDisjunctionSet":
+		var typeIDs []common.TypeID
+		entitlements := toSlice(obj.Get(entitlementsKey))
+		for _, entitlement := range entitlements {
+			id := toString(toObject(entitlement).Get("typeID"))
+			typeIDs = append(typeIDs, common.TypeID(id))
+		}
+		return cadence.NewEntitlementSetAuthorization(d.gauge, typeIDs, cadence.Disjunction)
+	}
+
+	panic(errors.NewDefaultUserError("invalid kind in authorization: %s", kind))
+}
+
 func (d *Decoder) decodeNominalType(
 	obj jsonObject,
 	kind, typeID string,
@@ -1148,10 +1181,9 @@ func (d *Decoder) decodeType(valueJSON any, results typeDecodingResults) cadence
 			d.decodeType(obj.Get(typeKey), results),
 		)
 	case "Reference":
-		auth := toBool(obj.Get(authorizedKey))
 		return cadence.NewMeteredReferenceType(
 			d.gauge,
-			auth,
+			d.decodeAuthorization(obj.Get(authorizationKey)),
 			d.decodeType(obj.Get(typeKey), results),
 		)
 	case "Any":

encoding/json/encode.go

@@ -170,10 +170,15 @@ type jsonDictionaryType struct {
 	Kind      string    `json:"kind"`
 }
 
+type jsonAuthorization struct {
+	Kind         string            `json:"kind"`
+	Entitlements []jsonNominalType `json:"entitlements"`
+}
+
 type jsonReferenceType struct {
-	Type       jsonValue `json:"type"`
-	Kind       string    `json:"kind"`
-	Authorized bool      `json:"authorized"`
+	Type          jsonValue         `json:"type"`
+	Kind          string            `json:"kind"`
+	Authorization jsonAuthorization `json:"authorization"`
 }
 
 type jsonRestrictedType struct {
@@ -608,6 +613,40 @@ func prepareComposite(kind, id string, fieldTypes []cadence.Field, fields []cade
 	}
 }
 
+func prepareAuthorization(auth cadence.Authorization) jsonAuthorization {
+	var kind string
+	var entitlements []jsonNominalType
+	switch auth := auth.(type) {
+	case cadence.Unauthorized:
+		kind = "Unauthorized"
+	case cadence.EntitlementMapAuthorization:
+		kind = "EntitlementMapAuthorization"
+		entitlements = []jsonNominalType{
+			{
+				Kind:   "EntitlementMap",
+				TypeID: string(auth.TypeID),
+			},
+		}
+	case cadence.EntitlementSetAuthorization:
+		for _, entitlement := range auth.Entitlements {
+			entitlements = append(entitlements, jsonNominalType{
+				Kind:   "Entitlement",
+				TypeID: string(entitlement),
+			})
+		}
+		switch auth.Kind {
+		case cadence.Conjunction:
+			kind = "EntitlementConjunctionSet"
+		case cadence.Disjunction:
+			kind = "EntitlementDisjunctionSet"
+		}
+	}
+	return jsonAuthorization{
+		Kind:         kind,
+		Entitlements: entitlements,
+	}
+}
+
 func preparePathLink(x cadence.PathLink) jsonValue {
 	return jsonValueObject{
 		Type: linkTypeStr,
@@ -861,9 +900,9 @@ func prepareType(typ cadence.Type, results typePreparationResults) jsonValue {
 		return typeJson
 	case *cadence.ReferenceType:
 		return jsonReferenceType{
-			Kind:       "Reference",
-			Authorized: typ.Authorized,
-			Type:       prepareType(typ.Type, results),
+			Kind:          "Reference",
+			Authorization: prepareAuthorization(typ.Authorization),
+			Type:          prepareType(typ.Type, results),
 		}
 	case *cadence.RestrictedType:
 		restrictions := make([]jsonValue, len(typ.Restrictions))

encoding/json/encoding_test.go

@@ -2375,8 +2375,8 @@ func TestEncodeType(t *testing.T) {
 			t,
 			cadence.TypeValue{
 				StaticType: &cadence.ReferenceType{
-					Authorized: false,
-					Type:       cadence.IntType{},
+					Authorization: cadence.UnauthorizedAccess,
+					Type:          cadence.IntType{},
 				},
 			},
 			// language=json
@@ -2389,13 +2389,154 @@ func TestEncodeType(t *testing.T) {
                     "type": {
                       "kind": "Int"
                     },
-                    "authorized": false
+                    "authorization": {
+						"kind": "Unauthorized",
+						"entitlements": null
+					}
                   }
                 }
               }
             `,
 		)
+	})
+
+	t.Run("with static auth(foo) &int", func(t *testing.T) {
 
+		testEncodeAndDecode(
+			t,
+			cadence.TypeValue{
+				StaticType: &cadence.ReferenceType{
+					Authorization: cadence.EntitlementMapAuthorization{
+						TypeID: "foo",
+					},
+					Type: cadence.IntType{},
+				},
+			},
+			// language=json
+			`
+              {
+                "type": "Type",
+                "value": {
+                  "staticType": {
+                    "kind": "Reference",
+                    "type": {
+                      "kind": "Int"
+                    },
+                    "authorization": {
+						"kind": "EntitlementMapAuthorization",
+						"entitlements": [
+							{
+								"kind": "EntitlementMap",
+								"typeID": "foo",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							}
+						]
+					}
+                  }
+                }
+              }
+            `,
+		)
+	})
+
+	t.Run("with static auth(X, Y) &int", func(t *testing.T) {
+
+		testEncodeAndDecode(
+			t,
+			cadence.TypeValue{
+				StaticType: &cadence.ReferenceType{
+					Authorization: cadence.EntitlementSetAuthorization{
+						Kind:         cadence.Conjunction,
+						Entitlements: []common.TypeID{"X", "Y"},
+					},
+					Type: cadence.IntType{},
+				},
+			},
+			// language=json
+			`
+              {
+                "type": "Type",
+                "value": {
+                  "staticType": {
+                    "kind": "Reference",
+                    "type": {
+                      "kind": "Int"
+                    },
+                    "authorization": {
+						"kind": "EntitlementConjunctionSet",
+						"entitlements": [
+							{
+								"kind": "Entitlement",
+								"typeID": "X",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							},
+							{
+								"kind": "Entitlement",
+								"typeID": "Y",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							}
+						]
+					}
+                  }
+                }
+              }
+            `,
+		)
+	})
+
+	t.Run("with static auth(X | Y) &int", func(t *testing.T) {
+
+		testEncodeAndDecode(
+			t,
+			cadence.TypeValue{
+				StaticType: &cadence.ReferenceType{
+					Authorization: cadence.EntitlementSetAuthorization{
+						Kind:         cadence.Disjunction,
+						Entitlements: []common.TypeID{"X", "Y"},
+					},
+					Type: cadence.IntType{},
+				},
+			},
+			// language=json
+			`
+              {
+                "type": "Type",
+                "value": {
+                  "staticType": {
+                    "kind": "Reference",
+                    "type": {
+                      "kind": "Int"
+                    },
+                    "authorization": {
+						"kind": "EntitlementDisjunctionSet",
+						"entitlements": [
+							{
+								"kind": "Entitlement",
+								"typeID": "X",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							},
+							{
+								"kind": "Entitlement",
+								"typeID": "Y",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							}
+						]
+					}
+                  }
+                }
+              }
+            `,
+		)
 	})
 
 	t.Run("with static function", func(t *testing.T) {

runtime/common/memorykind.go

@@ -71,6 +71,9 @@ const (
 	MemoryKindDictionaryStaticType
 	MemoryKindOptionalStaticType
 	MemoryKindRestrictedStaticType
+	MemoryKindUnauthorizedStaticAccess
+	MemoryKindEntitlementSetStaticAccess
+	MemoryKindEntitlementMapStaticAccess
 	MemoryKindReferenceStaticType
 	MemoryKindCapabilityStaticType
 	MemoryKindFunctionStaticType
@@ -124,6 +127,8 @@ const (
 	MemoryKindCadenceResourceInterfaceType
 	MemoryKindCadenceContractInterfaceType
 	MemoryKindCadenceFunctionType
+	MemoryKindCadenceEntitlementSetAccess
+	MemoryKindCadenceEntitlementMapAccess
 	MemoryKindCadenceReferenceType
 	MemoryKindCadenceRestrictedType
 	MemoryKindCadenceCapabilityType