Type checking for authorized references

encoding/json/decode.go

@@ -111,29 +111,30 @@ func (d *Decoder) Decode() (value cadence.Value, err error) {
 }
 
 const (
-	typeKey         = "type"
-	kindKey         = "kind"
-	valueKey        = "value"
-	keyKey          = "key"
-	nameKey         = "name"
-	fieldsKey       = "fields"
-	initializersKey = "initializers"
-	idKey           = "id"
-	targetPathKey   = "targetPath"
-	borrowTypeKey   = "borrowType"
-	domainKey       = "domain"
-	identifierKey   = "identifier"
-	staticTypeKey   = "staticType"
-	addressKey      = "address"
-	pathKey         = "path"
-	authorizedKey   = "authorized"
-	sizeKey         = "size"
-	typeIDKey       = "typeID"
-	restrictionsKey = "restrictions"
-	labelKey        = "label"
-	parametersKey   = "parameters"
-	returnKey       = "return"
-	purityKey       = "purity"
+	typeKey          = "type"
+	kindKey          = "kind"
+	valueKey         = "value"
+	keyKey           = "key"
+	nameKey          = "name"
+	fieldsKey        = "fields"
+	initializersKey  = "initializers"
+	idKey            = "id"
+	targetPathKey    = "targetPath"
+	borrowTypeKey    = "borrowType"
+	domainKey        = "domain"
+	identifierKey    = "identifier"
+	staticTypeKey    = "staticType"
+	addressKey       = "address"
+	pathKey          = "path"
+	authorizationKey = "authorization"
+	entitlementsKey  = "entitlements"
+	sizeKey          = "size"
+	typeIDKey        = "typeID"
+	restrictionsKey  = "restrictions"
+	labelKey         = "label"
+	parametersKey    = "parameters"
+	returnKey        = "return"
+	purityKey        = "purity"
 )
 
 func (d *Decoder) decodeJSON(v any) cadence.Value {
@@ -917,6 +918,38 @@ func (d *Decoder) decodeFunctionType(returnValue, parametersValue, id any, purit
 	).WithID(toString(id))
 }
 
+func (d *Decoder) decodeAuthorization(authorizationJSON any) cadence.Authorization {
+	obj := toObject(authorizationJSON)
+	kind := obj.Get(kindKey)
+
+	switch kind {
+	case "Unauthorized":
+		return cadence.UnauthorizedAccess
+	case "EntitlementMapAuthorization":
+		entitlements := toSlice(obj.Get(entitlementsKey))
+		m := toString(toObject(entitlements[0]).Get("typeID"))
+		return cadence.NewEntitlementMapAuthorization(d.gauge, common.TypeID(m))
+	case "EntitlementConjunctionSet":
+		var typeIDs []common.TypeID
+		entitlements := toSlice(obj.Get(entitlementsKey))
+		for _, entitlement := range entitlements {
+			id := toString(toObject(entitlement).Get("typeID"))
+			typeIDs = append(typeIDs, common.TypeID(id))
+		}
+		return cadence.NewEntitlementSetAuthorization(d.gauge, typeIDs, cadence.Conjunction)
+	case "EntitlementDisjunctionSet":
+		var typeIDs []common.TypeID
+		entitlements := toSlice(obj.Get(entitlementsKey))
+		for _, entitlement := range entitlements {
+			id := toString(toObject(entitlement).Get("typeID"))
+			typeIDs = append(typeIDs, common.TypeID(id))
+		}
+		return cadence.NewEntitlementSetAuthorization(d.gauge, typeIDs, cadence.Disjunction)
+	}
+
+	panic(errors.NewDefaultUserError("invalid kind in authorization: %s", kind))
+}
+
 func (d *Decoder) decodeNominalType(
 	obj jsonObject,
 	kind, typeID string,
@@ -1125,10 +1158,9 @@ func (d *Decoder) decodeType(valueJSON any, results typeDecodingResults) cadence
 			d.decodeType(obj.Get(typeKey), results),
 		)
 	case "Reference":
-		auth := toBool(obj.Get(authorizedKey))
 		return cadence.NewMeteredReferenceType(
 			d.gauge,
-			auth,
+			d.decodeAuthorization(obj.Get(authorizationKey)),
 			d.decodeType(obj.Get(typeKey), results),
 		)
 	case "Any":

encoding/json/encode.go

@@ -165,10 +165,15 @@ type jsonDictionaryType struct {
 	Kind      string    `json:"kind"`
 }
 
+type jsonAuthorization struct {
+	Kind         string            `json:"kind"`
+	Entitlements []jsonNominalType `json:"entitlements"`
+}
+
 type jsonReferenceType struct {
-	Type       jsonValue `json:"type"`
-	Kind       string    `json:"kind"`
-	Authorized bool      `json:"authorized"`
+	Type          jsonValue         `json:"type"`
+	Kind          string            `json:"kind"`
+	Authorization jsonAuthorization `json:"authorization"`
 }
 
 type jsonRestrictedType struct {
@@ -593,6 +598,40 @@ func prepareComposite(kind, id string, fieldTypes []cadence.Field, fields []cade
 	}
 }
 
+func prepareAuthorization(auth cadence.Authorization) jsonAuthorization {
+	var kind string
+	var entitlements []jsonNominalType
+	switch auth := auth.(type) {
+	case cadence.Unauthorized:
+		kind = "Unauthorized"
+	case cadence.EntitlementMapAuthorization:
+		kind = "EntitlementMapAuthorization"
+		entitlements = []jsonNominalType{
+			{
+				Kind:   "EntitlementMap",
+				TypeID: string(auth.TypeID),
+			},
+		}
+	case cadence.EntitlementSetAuthorization:
+		for _, entitlement := range auth.Entitlements {
+			entitlements = append(entitlements, jsonNominalType{
+				Kind:   "Entitlement",
+				TypeID: string(entitlement),
+			})
+		}
+		switch auth.Kind {
+		case cadence.Conjunction:
+			kind = "EntitlementConjunctionSet"
+		case cadence.Disjunction:
+			kind = "EntitlementDisjunctionSet"
+		}
+	}
+	return jsonAuthorization{
+		Kind:         kind,
+		Entitlements: entitlements,
+	}
+}
+
 func preparePath(x cadence.Path) jsonValue {
 	return jsonValueObject{
 		Type: pathTypeStr,
@@ -810,9 +849,9 @@ func prepareType(typ cadence.Type, results typePreparationResults) jsonValue {
 		return typeJson
 	case *cadence.ReferenceType:
 		return jsonReferenceType{
-			Kind:       "Reference",
-			Authorized: typ.Authorized,
-			Type:       prepareType(typ.Type, results),
+			Kind:          "Reference",
+			Authorization: prepareAuthorization(typ.Authorization),
+			Type:          prepareType(typ.Type, results),
 		}
 	case *cadence.RestrictedType:
 		restrictions := make([]jsonValue, 0)

encoding/json/encoding_test.go

@@ -29,6 +29,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/cadence/runtime"
+	"github.com/onflow/cadence/runtime/common"
 	"github.com/onflow/cadence/runtime/interpreter"
 	"github.com/onflow/cadence/runtime/tests/checker"
 
@@ -2326,8 +2327,8 @@ func TestEncodeType(t *testing.T) {
 			t,
 			cadence.TypeValue{
 				StaticType: &cadence.ReferenceType{
-					Authorized: false,
-					Type:       cadence.IntType{},
+					Authorization: cadence.UnauthorizedAccess,
+					Type:          cadence.IntType{},
 				},
 			},
 			// language=json
@@ -2340,13 +2341,154 @@ func TestEncodeType(t *testing.T) {
                     "type": {
                       "kind": "Int"
                     },
-                    "authorized": false
+                    "authorization": {
+						"kind": "Unauthorized",
+						"entitlements": null
+					}
                   }
                 }
               }
             `,
 		)
+	})
+
+	t.Run("with static auth(foo) &int", func(t *testing.T) {
 
+		testEncodeAndDecode(
+			t,
+			cadence.TypeValue{
+				StaticType: &cadence.ReferenceType{
+					Authorization: cadence.EntitlementMapAuthorization{
+						TypeID: "foo",
+					},
+					Type: cadence.IntType{},
+				},
+			},
+			// language=json
+			`
+              {
+                "type": "Type",
+                "value": {
+                  "staticType": {
+                    "kind": "Reference",
+                    "type": {
+                      "kind": "Int"
+                    },
+                    "authorization": {
+						"kind": "EntitlementMapAuthorization",
+						"entitlements": [
+							{
+								"kind": "EntitlementMap",
+								"typeID": "foo",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							}
+						]
+					}
+                  }
+                }
+              }
+            `,
+		)
+	})
+
+	t.Run("with static auth(X, Y) &int", func(t *testing.T) {
+
+		testEncodeAndDecode(
+			t,
+			cadence.TypeValue{
+				StaticType: &cadence.ReferenceType{
+					Authorization: cadence.EntitlementSetAuthorization{
+						Kind:         cadence.Conjunction,
+						Entitlements: []common.TypeID{"X", "Y"},
+					},
+					Type: cadence.IntType{},
+				},
+			},
+			// language=json
+			`
+              {
+                "type": "Type",
+                "value": {
+                  "staticType": {
+                    "kind": "Reference",
+                    "type": {
+                      "kind": "Int"
+                    },
+                    "authorization": {
+						"kind": "EntitlementConjunctionSet",
+						"entitlements": [
+							{
+								"kind": "Entitlement",
+								"typeID": "X",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							},
+							{
+								"kind": "Entitlement",
+								"typeID": "Y",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							}
+						]
+					}
+                  }
+                }
+              }
+            `,
+		)
+	})
+
+	t.Run("with static auth(X | Y) &int", func(t *testing.T) {
+
+		testEncodeAndDecode(
+			t,
+			cadence.TypeValue{
+				StaticType: &cadence.ReferenceType{
+					Authorization: cadence.EntitlementSetAuthorization{
+						Kind:         cadence.Disjunction,
+						Entitlements: []common.TypeID{"X", "Y"},
+					},
+					Type: cadence.IntType{},
+				},
+			},
+			// language=json
+			`
+              {
+                "type": "Type",
+                "value": {
+                  "staticType": {
+                    "kind": "Reference",
+                    "type": {
+                      "kind": "Int"
+                    },
+                    "authorization": {
+						"kind": "EntitlementDisjunctionSet",
+						"entitlements": [
+							{
+								"kind": "Entitlement",
+								"typeID": "X",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							},
+							{
+								"kind": "Entitlement",
+								"typeID": "Y",
+								"type": null,
+								"fields": null, 
+								"initializers": null
+							}
+						]
+					}
+                  }
+                }
+              }
+            `,
+		)
 	})
 
 	t.Run("with static function", func(t *testing.T) {

runtime/common/memorykind.go

@@ -71,6 +71,9 @@ const (
 	MemoryKindDictionaryStaticType
 	MemoryKindOptionalStaticType
 	MemoryKindRestrictedStaticType
+	MemoryKindUnauthorizedStaticAccess
+	MemoryKindEntitlementSetStaticAccess
+	MemoryKindEntitlementMapStaticAccess
 	MemoryKindReferenceStaticType
 	MemoryKindCapabilityStaticType
 	MemoryKindFunctionStaticType
@@ -122,6 +125,8 @@ const (
 	MemoryKindCadenceResourceInterfaceType
 	MemoryKindCadenceContractInterfaceType
 	MemoryKindCadenceFunctionType
+	MemoryKindCadenceEntitlementSetAccess
+	MemoryKindCadenceEntitlementMapAccess
 	MemoryKindCadenceReferenceType
 	MemoryKindCadenceRestrictedType
 	MemoryKindCadenceCapabilityType