Module `0x1::DiemTransactionPublishingOption`

This module defines a struct storing the publishing policies for the VM.

Struct DiemTransactionPublishingOption
Resource HaltAllTransactions
Constants
Function initialize
Function is_script_allowed
Function is_module_allowed
Function set_open_script
Function set_open_module
Function halt_all_transactions
Function resume_transactions
Function transactions_halted
Module Specification

<pre><code>use <a href="CoreAddresses.md#0x1_CoreAddresses">0x1::CoreAddresses</a>; use <a href="DiemConfig.md#0x1_DiemConfig">0x1::DiemConfig</a>; use <a href="DiemTimestamp.md#0x1_DiemTimestamp">0x1::DiemTimestamp</a>; use <a href="../../../../../../move-stdlib/docs/Errors.md#0x1_Errors">0x1::Errors</a>; use <a href="Roles.md#0x1_Roles">0x1::Roles</a>; use <a href="../../../../../../move-stdlib/docs/Signer.md#0x1_Signer">0x1::Signer</a>; use <a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector">0x1::Vector</a>; </code></pre>

Struct `DiemTransactionPublishingOption`

Defines and holds the publishing policies for the VM. There are three possible configurations:

No module publishing, only allow-listed scripts are allowed.
No module publishing, custom scripts are allowed.
Both module publishing and custom scripts are allowed. We represent these as the following resource.

<pre><code>struct <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a> </code></pre> <details> <summary>Fields</summary> <dl> <dt> <code>script_allow_list: vector<vector<u8>></code> </dt> <dd> Only script hashes in the following list can be executed by the network. If the vector is empty, no limitation would be enforced. </dd> <dt> <code>module_publishing_allowed: bool</code> </dt> <dd> Anyone can publish new module if this flag is set to true. </dd> </dl> </details>

Resource `HaltAllTransactions`

If published, halts transactions from all accounts except DiemRoot

<pre><code>resource struct <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a> </code></pre> <details> <summary>Fields</summary> <dl> <dt> <code>dummy_field: bool</code> </dt> <dd> </dd> </dl> </details>

Constants

The script hash already exists in the allowlist

<pre><code>const <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_EALLOWLIST_ALREADY_CONTAINS_SCRIPT">EALLOWLIST_ALREADY_CONTAINS_SCRIPT</a>: u64 = 1; </code></pre>

Attempting to publish/unpublish a HaltAllTransactions resource that does not exist.

<pre><code>const <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_EHALT_ALL_TRANSACTIONS">EHALT_ALL_TRANSACTIONS</a>: u64 = 2; </code></pre>

The script hash has an invalid length

<pre><code>const <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_EINVALID_SCRIPT_HASH">EINVALID_SCRIPT_HASH</a>: u64 = 0; </code></pre>

<pre><code>const <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_SCRIPT_HASH_LENGTH">SCRIPT_HASH_LENGTH</a>: u64 = 32; </code></pre>

Function `initialize`

<pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_initialize">initialize</a>(dr_account: &signer, script_allow_list: vector<vector<u8>>, module_publishing_allowed: bool) </code></pre> <details> <summary>Implementation</summary> <pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_initialize">initialize</a>( dr_account: &signer, script_allow_list: vector<vector<u8>>, module_publishing_allowed: bool, ) { <a href="DiemTimestamp.md#0x1_DiemTimestamp_assert_genesis">DiemTimestamp::assert_genesis</a>(); <a href="Roles.md#0x1_Roles_assert_diem_root">Roles::assert_diem_root</a>(dr_account); <a href="DiemConfig.md#0x1_DiemConfig_publish_new_config">DiemConfig::publish_new_config</a>( dr_account, <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a> { script_allow_list, module_publishing_allowed } ); } </code></pre> </details> <details> <summary>Specification</summary>

Must abort if the signer does not have the DiemRoot role [H11].

<pre><code>include <a href="Roles.md#0x1_Roles_AbortsIfNotDiemRoot">Roles::AbortsIfNotDiemRoot</a>{account: dr_account}; include <a href="DiemTimestamp.md#0x1_DiemTimestamp_AbortsIfNotGenesis">DiemTimestamp::AbortsIfNotGenesis</a>; include <a href="DiemConfig.md#0x1_DiemConfig_PublishNewConfigAbortsIf">DiemConfig::PublishNewConfigAbortsIf</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>; include <a href="DiemConfig.md#0x1_DiemConfig_PublishNewConfigEnsures">DiemConfig::PublishNewConfigEnsures</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>> { payload: <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a> { script_allow_list, module_publishing_allowed }}; </code></pre> </details>

Function `is_script_allowed`

Check if sender can execute script with <code>hash</code>

<pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_is_script_allowed">is_script_allowed</a>(account: &signer, hash: &vector<u8>): bool </code></pre> <details> <summary>Implementation</summary> <pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_is_script_allowed">is_script_allowed</a>(account: &signer, hash: &vector<u8>): bool { // DiemRoot can send any script if (<a href="Roles.md#0x1_Roles_has_diem_root_role">Roles::has_diem_root_role</a>(account)) return true; // No one except DiemRoot can send scripts when transactions are halted if (<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_transactions_halted">transactions_halted</a>()) return false; // The adapter passes an empty hash for script functions. All script functions are allowed if (<a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_is_empty">Vector::is_empty</a>(hash)) return true; let publish_option = <a href="DiemConfig.md#0x1_DiemConfig_get">DiemConfig::get</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(); // allowlist empty = open publishing, anyone can send txes <a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_is_empty">Vector::is_empty</a>(&publish_option.script_allow_list) // fixed allowlist. check inclusion || <a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_contains">Vector::contains</a>(&publish_option.script_allow_list, hash) } </code></pre> </details> <details> <summary>Specification</summary> <pre><code>include !<a href="Roles.md#0x1_Roles_has_diem_root_role">Roles::has_diem_root_role</a>(account) && !<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_transactions_halted">transactions_halted</a>() && !<a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_is_empty">Vector::is_empty</a>(hash) ==> <a href="DiemConfig.md#0x1_DiemConfig_AbortsIfNotPublished">DiemConfig::AbortsIfNotPublished</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>{}; </code></pre>

<pre><code>schema <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_AbortsIfNoTransactionPublishingOption">AbortsIfNoTransactionPublishingOption</a> { include <a href="DiemTimestamp.md#0x1_DiemTimestamp_is_genesis">DiemTimestamp::is_genesis</a>() ==> <a href="DiemConfig.md#0x1_DiemConfig_AbortsIfNotPublished">DiemConfig::AbortsIfNotPublished</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>{}; } </code></pre> </details>

Function `is_module_allowed`

Check if a sender can publish a module

<pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_is_module_allowed">is_module_allowed</a>(account: &signer): bool </code></pre> <details> <summary>Implementation</summary> <pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_is_module_allowed">is_module_allowed</a>(account: &signer): bool { let publish_option = <a href="DiemConfig.md#0x1_DiemConfig_get">DiemConfig::get</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(); publish_option.module_publishing_allowed || <a href="Roles.md#0x1_Roles_has_diem_root_role">Roles::has_diem_root_role</a>(account) } </code></pre> </details> <details> <summary>Specification</summary> <pre><code>include <a href="DiemConfig.md#0x1_DiemConfig_AbortsIfNotPublished">DiemConfig::AbortsIfNotPublished</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>{}; </code></pre> </details>

Function `set_open_script`

Allow the execution of arbitrary script or not.

<pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_set_open_script">set_open_script</a>(dr_account: &signer) </code></pre> <details> <summary>Implementation</summary> <pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_set_open_script">set_open_script</a>(dr_account: &signer) { <a href="Roles.md#0x1_Roles_assert_diem_root">Roles::assert_diem_root</a>(dr_account); let publish_option = <a href="DiemConfig.md#0x1_DiemConfig_get">DiemConfig::get</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(); publish_option.script_allow_list = <a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_empty">Vector::empty</a>(); <a href="DiemConfig.md#0x1_DiemConfig_set">DiemConfig::set</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(dr_account, publish_option); } </code></pre> </details> <details> <summary>Specification</summary>

Must abort if the signer does not have the DiemRoot role [H11].

<pre><code>include <a href="Roles.md#0x1_Roles_AbortsIfNotDiemRoot">Roles::AbortsIfNotDiemRoot</a>{account: dr_account}; include <a href="DiemConfig.md#0x1_DiemConfig_AbortsIfNotPublished">DiemConfig::AbortsIfNotPublished</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>; include <a href="DiemConfig.md#0x1_DiemConfig_SetAbortsIf">DiemConfig::SetAbortsIf</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>{account: dr_account}; </code></pre> </details>

Function `set_open_module`

Allow module publishing from arbitrary sender or not.

<pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_set_open_module">set_open_module</a>(dr_account: &signer, open_module: bool) </code></pre> <details> <summary>Implementation</summary> <pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_set_open_module">set_open_module</a>(dr_account: &signer, open_module: bool) { <a href="Roles.md#0x1_Roles_assert_diem_root">Roles::assert_diem_root</a>(dr_account); let publish_option = <a href="DiemConfig.md#0x1_DiemConfig_get">DiemConfig::get</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(); publish_option.module_publishing_allowed = open_module; <a href="DiemConfig.md#0x1_DiemConfig_set">DiemConfig::set</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(dr_account, publish_option); } </code></pre> </details> <details> <summary>Specification</summary>

Must abort if the signer does not have the DiemRoot role [H11].

<pre><code>include <a href="Roles.md#0x1_Roles_AbortsIfNotDiemRoot">Roles::AbortsIfNotDiemRoot</a>{account: dr_account}; include <a href="DiemConfig.md#0x1_DiemConfig_AbortsIfNotPublished">DiemConfig::AbortsIfNotPublished</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>; include <a href="DiemConfig.md#0x1_DiemConfig_SetAbortsIf">DiemConfig::SetAbortsIf</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>{account: dr_account}; </code></pre> </details>

Function `halt_all_transactions`

If called, transactions cannot be sent from any account except DiemRoot

<pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_halt_all_transactions">halt_all_transactions</a>(dr_account: &signer) </code></pre> <details> <summary>Implementation</summary> <pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_halt_all_transactions">halt_all_transactions</a>(dr_account: &signer) { <a href="Roles.md#0x1_Roles_assert_diem_root">Roles::assert_diem_root</a>(dr_account); assert( !exists<<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a>>(<a href="../../../../../../move-stdlib/docs/Signer.md#0x1_Signer_address_of">Signer::address_of</a>(dr_account)), <a href="../../../../../../move-stdlib/docs/Errors.md#0x1_Errors_already_published">Errors::already_published</a>(<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_EHALT_ALL_TRANSACTIONS">EHALT_ALL_TRANSACTIONS</a>), ); move_to(dr_account, <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a> {}); } </code></pre> </details>

Function `resume_transactions`

If called, transactions can be sent from any account once again

<pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_resume_transactions">resume_transactions</a>(dr_account: &signer) </code></pre> <details> <summary>Implementation</summary> <pre><code>public fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_resume_transactions">resume_transactions</a>(dr_account: &signer) acquires <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a> { <a href="Roles.md#0x1_Roles_assert_diem_root">Roles::assert_diem_root</a>(dr_account); let dr_address = <a href="../../../../../../move-stdlib/docs/Signer.md#0x1_Signer_address_of">Signer::address_of</a>(dr_account); assert( exists<<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a>>(dr_address), <a href="../../../../../../move-stdlib/docs/Errors.md#0x1_Errors_already_published">Errors::already_published</a>(<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_EHALT_ALL_TRANSACTIONS">EHALT_ALL_TRANSACTIONS</a>), ); let <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a> {} = move_from<<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a>>(dr_address); } </code></pre> </details>

Function `transactions_halted`

Return true if all non-administrative transactions are currently halted

<pre><code>fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_transactions_halted">transactions_halted</a>(): bool </code></pre> <details> <summary>Implementation</summary> <pre><code>fun <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_transactions_halted">transactions_halted</a>(): bool { exists<<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_HaltAllTransactions">HaltAllTransactions</a>>(<a href="CoreAddresses.md#0x1_CoreAddresses_DIEM_ROOT_ADDRESS">CoreAddresses::DIEM_ROOT_ADDRESS</a>()) } </code></pre> </details>

Module Specification

Initialization

<pre><code>invariant [global] <a href="DiemTimestamp.md#0x1_DiemTimestamp_is_operating">DiemTimestamp::is_operating</a>() ==> <a href="DiemConfig.md#0x1_DiemConfig_spec_is_published">DiemConfig::spec_is_published</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(); </code></pre>

Access Control

Only <code>set_open_script</code>, and <code>set_open_module</code> can modify the DiemTransactionPublishingOption config [H11]

<pre><code>schema <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_DiemVersionRemainsSame">DiemVersionRemainsSame</a> { ensures old(<a href="DiemConfig.md#0x1_DiemConfig_spec_is_published">DiemConfig::spec_is_published</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>()) ==> global<<a href="DiemConfig.md#0x1_DiemConfig">DiemConfig</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>>(<a href="CoreAddresses.md#0x1_CoreAddresses_DIEM_ROOT_ADDRESS">CoreAddresses::DIEM_ROOT_ADDRESS</a>()) == old(global<<a href="DiemConfig.md#0x1_DiemConfig">DiemConfig</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>>(<a href="CoreAddresses.md#0x1_CoreAddresses_DIEM_ROOT_ADDRESS">CoreAddresses::DIEM_ROOT_ADDRESS</a>())); } </code></pre> <pre><code>apply <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_DiemVersionRemainsSame">DiemVersionRemainsSame</a> to * except set_open_script, set_open_module; </code></pre>

Helper Functions

<pre><code>define <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_spec_is_script_allowed">spec_is_script_allowed</a>(account: signer, hash: vector<u8>): bool { let publish_option = <a href="DiemConfig.md#0x1_DiemConfig_spec_get_config">DiemConfig::spec_get_config</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(); <a href="Roles.md#0x1_Roles_has_diem_root_role">Roles::has_diem_root_role</a>(account) || (!<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_transactions_halted">transactions_halted</a>() && ( <a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_is_empty">Vector::is_empty</a>(hash) || (<a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_is_empty">Vector::is_empty</a>(publish_option.script_allow_list) || <a href="../../../../../../move-stdlib/docs/Vector.md#0x1_Vector_spec_contains">Vector::spec_contains</a>(publish_option.script_allow_list, hash)) )) } <a name="0x1_DiemTransactionPublishingOption_spec_is_module_allowed"></a> define <a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption_spec_is_module_allowed">spec_is_module_allowed</a>(account: signer): bool { let publish_option = <a href="DiemConfig.md#0x1_DiemConfig_spec_get_config">DiemConfig::spec_get_config</a><<a href="DiemTransactionPublishingOption.md#0x1_DiemTransactionPublishingOption">DiemTransactionPublishingOption</a>>(); publish_option.module_publishing_allowed || <a href="Roles.md#0x1_Roles_has_diem_root_role">Roles::has_diem_root_role</a>(account) } </code></pre>

Module `0x1::DiemTransactionPublishingOption`

Module 0x1::DiemTransactionPublishingOption

Struct DiemTransactionPublishingOption

Resource HaltAllTransactions

Constants

Function initialize

Function is_script_allowed

Function is_module_allowed

Function set_open_script

Function set_open_module

Function halt_all_transactions

Function resume_transactions

Function transactions_halted

Module Specification

Initialization

Access Control

Helper Functions

Module `0x1::DiemTransactionPublishingOption`

Struct `DiemTransactionPublishingOption`

Resource `HaltAllTransactions`

Function `initialize`

Function `is_script_allowed`

Function `is_module_allowed`

Function `set_open_script`

Function `set_open_module`

Function `halt_all_transactions`

Function `resume_transactions`

Function `transactions_halted`