frame-session: Introduce a proper proof of key ownership

cumulus/pallets/collator-selection/src/tests.rs

@@ -15,6 +15,7 @@
 
 use crate as collator_selection;
 use crate::{mock::*, CandidateInfo, Error};
+use codec::Encode;
 use frame_support::{
 	assert_noop, assert_ok,
 	traits::{Currency, OnInitialize},
@@ -121,7 +122,12 @@ fn invulnerable_limit_works() {
 			if ii > 5 {
 				Balances::make_free_balance_be(&ii, 100);
 				let key = MockSessionKeys { aura: UintAuthorityId(ii) };
-				Session::set_keys(RuntimeOrigin::signed(ii).into(), key, Vec::new()).unwrap();
+				Session::set_keys(
+					RuntimeOrigin::signed(ii).into(),
+					key.clone(),
+					key.create_ownership_proof(&ii.encode()).unwrap(),
+				)
+				.unwrap();
 			}
 			assert_eq!(Balances::free_balance(ii), 100);
 			if ii < 21 {

cumulus/parachain-template/runtime/src/lib.rs

@@ -608,8 +608,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/assets/asset-hub-kusama/src/lib.rs

@@ -1010,8 +1010,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/assets/asset-hub-polkadot/src/lib.rs

@@ -914,8 +914,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/assets/asset-hub-westend/src/lib.rs

@@ -977,8 +977,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/bridge-hubs/bridge-hub-kusama/src/lib.rs

@@ -537,8 +537,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/bridge-hubs/bridge-hub-polkadot/src/lib.rs

@@ -537,8 +537,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/bridge-hubs/bridge-hub-rococo/src/lib.rs

@@ -722,8 +722,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/collectives/collectives-polkadot/src/lib.rs

@@ -794,8 +794,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/contracts/contracts-rococo/src/lib.rs

@@ -481,8 +481,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/glutton/glutton-kusama/src/lib.rs

@@ -385,8 +385,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(_: Vec<u8>, _: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			sp_session::GeneratedSessionKeys { keys: Vec::new(), proof: Vec::new() }
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/starters/seedling/src/lib.rs

@@ -351,8 +351,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(_: Vec<u8>, _: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			sp_session::GeneratedSessionKeys { keys: Vec::new(), proof: Vec::new() }
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/starters/shell/src/lib.rs

@@ -383,8 +383,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(_: Vec<u8>, _: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			sp_session::GeneratedSessionKeys { keys: Vec::new(), proof: Vec::new() }
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/testing/penpal/src/lib.rs

@@ -696,8 +696,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

cumulus/parachains/runtimes/testing/rococo-parachain/src/lib.rs

@@ -727,8 +727,8 @@ impl_runtime_apis! {
 			SessionKeys::decode_into_raw_public_keys(&encoded)
 		}
 
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 	}
 

cumulus/test/runtime/src/lib.rs

@@ -454,8 +454,8 @@ impl_runtime_apis! {
 			SessionKeys::decode_into_raw_public_keys(&encoded)
 		}
 
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 	}
 

polkadot/node/service/src/fake_runtime_api.rs

@@ -356,7 +356,7 @@ sp_api::impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(_: Option<Vec<u8>>) -> Vec<u8> {
+		fn generate_session_keys(_: Vec<u8>, _: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
 			unimplemented!()
 		}
 

polkadot/runtime/kusama/src/lib.rs

@@ -2233,8 +2233,8 @@ sp_api::impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

polkadot/runtime/polkadot/src/lib.rs

@@ -2011,8 +2011,8 @@ sp_api::impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

polkadot/runtime/rococo/src/lib.rs

@@ -1861,8 +1861,8 @@ sp_api::impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

polkadot/runtime/test-runtime/src/lib.rs

@@ -1082,8 +1082,8 @@ sp_api::impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

polkadot/runtime/westend/src/lib.rs

@@ -1975,8 +1975,8 @@ sp_api::impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

substrate/bin/node-template/runtime/src/lib.rs

@@ -419,8 +419,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			opaque::SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			opaque::SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

substrate/bin/node/runtime/src/lib.rs

@@ -2653,8 +2653,8 @@ impl_runtime_apis! {
 	}
 
 	impl sp_session::SessionKeys<Block> for Runtime {
-		fn generate_session_keys(seed: Option<Vec<u8>>) -> Vec<u8> {
-			SessionKeys::generate(seed)
+		fn generate_session_keys(owner: Vec<u8>, seed: Option<Vec<u8>>) -> sp_session::GeneratedSessionKeys {
+			SessionKeys::generate(&owner, seed)
 		}
 
 		fn decode_session_keys(

substrate/client/rpc-api/src/author/error.rs

@@ -51,6 +51,9 @@ pub enum Error {
 	/// Invalid session keys encoding.
 	#[error("Session keys are not encoded correctly")]
 	InvalidSessionKeys,
+	/// `SessionKeys` runtime api missing.
+	#[error("`SessionKeys` runtime api not present in the runtime")]
+	MissingSessionKeysApi,
 	/// Call to an unsafe RPC was denied.
 	#[error(transparent)]
 	UnsafeRpcCalled(#[from] crate::policy::UnsafeRpcError),

substrate/client/rpc/src/author/mod.rs

@@ -123,10 +123,25 @@ where
 
 		runtime_api.register_extension(KeystoreExt::from(self.keystore.clone()));
 
-		runtime_api
-			.generate_session_keys(best_block_hash, None)
-			.map(Into::into)
-			.map_err(|api_err| Error::Client(Box::new(api_err)).into())
+		let version = runtime_api
+			.api_version::<dyn SessionKeys<P::Block>>(best_block_hash)
+			.map_err(|api_err| Error::Client(Box::new(api_err)))?
+			.ok_or_else(|| Error::MissingSessionKeysApi)?;
+
+		let res = if version < 2 {
+			#[allow(deprecated)]
+			runtime_api
+				.generate_session_keys_before_version_2(best_block_hash, None)
+				.map(Into::into)
+				.map_err(|api_err| Error::Client(Box::new(api_err)))
+		} else {
+			runtime_api
+				.generate_session_keys(best_block_hash, Vec::new(), None)
+				.map(|sk| sk.keys.into())
+				.map_err(|api_err| Error::Client(Box::new(api_err)))
+		}?;
+
+		Ok(res)
 	}
 
 	fn has_session_keys(&self, session_keys: Bytes) -> RpcResult<bool> {

substrate/frame/session/src/lib.rs

@@ -588,7 +588,10 @@ pub mod pallet {
 		#[pallet::weight(T::WeightInfo::set_keys())]
 		pub fn set_keys(origin: OriginFor<T>, keys: T::Keys, proof: Vec<u8>) -> DispatchResult {
 			let who = ensure_signed(origin)?;
-			ensure!(keys.ownership_proof_is_valid(&proof), Error::<T>::InvalidProof);
+			ensure!(
+				who.using_encoded(|who| keys.ownership_proof_is_valid(who, &proof)),
+				Error::<T>::InvalidProof,
+			);
 
 			Self::do_set_keys(&who, keys)?;
 			Ok(())

substrate/frame/session/src/mock.rs

@@ -22,8 +22,11 @@ use crate as pallet_session;
 #[cfg(feature = "historical")]
 use crate::historical as pallet_session_historical;
 
-use std::collections::BTreeMap;
-
+use codec::Encode;
+use frame_support::{
+	parameter_types,
+	traits::{ConstU32, ConstU64},
+};
 use sp_core::{crypto::key_types::DUMMY, H256};
 use sp_runtime::{
 	impl_opaque_keys,
@@ -33,11 +36,7 @@ use sp_runtime::{
 };
 use sp_staking::SessionIndex;
 use sp_state_machine::BasicExternalities;
-
-use frame_support::{
-	parameter_types,
-	traits::{ConstU32, ConstU64},
-};
+use std::collections::BTreeMap;
 
 impl_opaque_keys! {
 	pub struct MockSessionKeys {
@@ -74,6 +73,10 @@ impl OpaqueKeys for PreUpgradeMockSessionKeys {
 			_ => &[],
 		}
 	}
+
+	fn ownership_proof_is_valid(&self, _: &[u8], _: &[u8]) -> bool {
+		true
+	}
 }
 
 type Block = frame_system::mocking::MockBlock<Test>;
@@ -208,6 +211,10 @@ pub fn reset_before_session_end_called() {
 	BeforeSessionEndCalled::mutate(|b| *b = false);
 }
 
+pub fn create_set_keys_proof(owner: u64, public: &UintAuthorityId) -> Vec<u8> {
+	public.sign(&owner.encode()).unwrap().encode()
+}
+
 pub fn new_test_ext() -> sp_io::TestExternalities {
 	let mut t = frame_system::GenesisConfig::<Test>::default().build_storage().unwrap();
 	let keys: Vec<_> = NextValidators::get()