feat: add expiration and limit size for policy

e2e/core/basesuite.go

@@ -1,6 +1,8 @@
 package core
 
 import (
+	"strings"
+
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	"github.com/cosmos/cosmos-sdk/types/tx"
 	banktypes "github.com/cosmos/cosmos-sdk/x/bank/types"
@@ -69,6 +71,18 @@ func (s *BaseSuite) SendTxBlock(msg sdk.Msg, from keys.KeyManager) (txRes *sdk.T
 	return response.TxResponse
 }
 
+func (s *BaseSuite) SendTxBlockWithExpectErrorString(msg sdk.Msg, from keys.KeyManager, expectErrorString string) {
+	mode := tx.BroadcastMode_BROADCAST_MODE_BLOCK
+	txOpt := &types.TxOption{
+		Mode: &mode,
+		Memo: "",
+	}
+	s.Client.SetKeyManager(from)
+	_, err := s.Client.BroadcastTx([]sdk.Msg{msg}, txOpt)
+	s.Require().Error(err)
+	s.Require().True(strings.Contains(err.Error(), expectErrorString))
+}
+
 func (s *BaseSuite) GenAndChargeAccounts(n int, balance int64) (accounts []keys.KeyManager) {
 	var outputs []banktypes.Output
 	denom := s.Config.Denom

e2e/tests/storage_test.go

@@ -215,8 +215,7 @@ func (s *StorageTestSuite) TestCreateGroup() {
 	}
 	queryHeadGroupMemberResp, err := s.Client.HeadGroupMember(ctx, &queryHeadGroupMemberReq)
 	s.Require().NoError(err)
-	s.Require().Equal(queryHeadGroupMemberResp.GroupInfo.GroupName, groupName)
-	s.Require().Equal(queryHeadGroupMemberResp.GroupInfo.Owner, owner.GetAddr().String())
+	s.Require().Equal(queryHeadGroupMemberResp.GroupId, queryHeadGroupResp.GroupInfo.Id.String())
 
 	// 4. UpdateGroupMember
 	member2 := s.GenAndChargeAccounts(1, 1000000)[0]
@@ -241,8 +240,7 @@ func (s *StorageTestSuite) TestCreateGroup() {
 	}
 	queryHeadGroupMemberRespAdd, err := s.Client.HeadGroupMember(ctx, &queryHeadGroupMemberReqAdd)
 	s.Require().NoError(err)
-	s.Require().Equal(queryHeadGroupMemberRespAdd.GroupInfo.GroupName, groupName)
-	s.Require().Equal(queryHeadGroupMemberRespAdd.GroupInfo.Owner, owner.GetAddr().String())
+	s.Require().Equal(queryHeadGroupMemberRespAdd.GroupId, queryHeadGroupResp.GroupInfo.Id.String())
 }
 
 func (s *StorageTestSuite) TestDeleteBucket() {

proto/greenfield/common/wrapper.proto

@@ -0,0 +1,77 @@
+syntax = "proto3";
+
+package bnbchain.greenfield.common;
+
+option go_package = "github.com/bnb-chain/greenfield/types/common";
+
+// Wrapper message for `double`.
+//
+// The JSON representation for `DoubleValue` is JSON number.
+message DoubleValue {
+  // The double value.
+  double value = 1;
+}
+
+// Wrapper message for `float`.
+//
+// The JSON representation for `FloatValue` is JSON number.
+message FloatValue {
+  // The float value.
+  float value = 1;
+}
+
+// Wrapper message for `int64`.
+//
+// The JSON representation for `Int64Value` is JSON string.
+message Int64Value {
+  // The int64 value.
+  int64 value = 1;
+}
+
+// Wrapper message for `uint64`.
+//
+// The JSON representation for `UInt64Value` is JSON string.
+message UInt64Value {
+  // The uint64 value.
+  uint64 value = 1;
+}
+
+// Wrapper message for `int32`.
+//
+// The JSON representation for `Int32Value` is JSON number.
+message Int32Value {
+  // The int32 value.
+  int32 value = 1;
+}
+
+// Wrapper message for `uint32`.
+//
+// The JSON representation for `UInt32Value` is JSON number.
+message UInt32Value {
+  // The uint32 value.
+  uint32 value = 1;
+}
+
+// Wrapper message for `bool`.
+//
+// The JSON representation for `BoolValue` is JSON `true` and `false`.
+message BoolValue {
+  // The bool value.
+  bool value = 1;
+}
+
+// Wrapper message for `string`.
+//
+// The JSON representation for `StringValue` is JSON string.
+message StringValue {
+  // The string value.
+  string value = 1;
+}
+
+// Wrapper message for `bytes`.
+//
+// The JSON representation for `BytesValue` is JSON string.
+message BytesValue {
+  // The bytes value.
+  bytes value = 1;
+}

proto/greenfield/permission/common.proto

@@ -3,6 +3,8 @@ package bnbchain.greenfield.permission;
 
 import "cosmos_proto/cosmos.proto";
 import "gogoproto/gogo.proto";
+import "google/protobuf/timestamp.proto";
+import "greenfield/common/wrapper.proto";
 
 option go_package = "github.com/bnb-chain/greenfield/x/permission/types";
 
@@ -37,16 +39,24 @@ enum Effect {
   EFFECT_PASS = 2;
 }
 
-// TODO: add expiration time.
 message Statement {
   // effect define the impact of permissions, which can be Allow/Deny
   Effect effect = 1;
   // action_type define the operation type you can act. greenfield defines a set of permission
   // that you can specify in a permissionInfo. see ActionType enum for detail.
   repeated ActionType actions = 2;
-  // resources define the resource list you can operate.
   // CAN ONLY USED IN bucket level. Support fuzzy match and limit to 5
+  // If no sub-resource is specified in a statement, then all objects in the bucket are accessible by the principal.
+  // However, if the sub-resource is defined as 'bucket/test_*,' in the statement, then only objects with a 'test_'
+  // prefix can be accessed by the principal.
   repeated string resources = 3;
+  // expiration_time defines how long the permission is valid
+  google.protobuf.Timestamp expiration_time = 4 [
+    (gogoproto.stdtime) = true,
+    (gogoproto.nullable) = true
+  ];
+  // limit_size defines the total data size that is allowed to operate
+  common.UInt64Value limit_size = 5 [(gogoproto.nullable) = true];
 }
 
 enum PrincipalType {

proto/greenfield/permission/types.proto

@@ -3,28 +3,44 @@ package bnbchain.greenfield.permission;
 
 import "cosmos_proto/cosmos.proto";
 import "gogoproto/gogo.proto";
+import "google/protobuf/timestamp.proto";
 import "greenfield/permission/common.proto";
 import "greenfield/resource/types.proto";
 
 option go_package = "github.com/bnb-chain/greenfield/x/permission/types";
 
 message Policy {
+  // id is an unique u256 sequence for each policy. It also be used as NFT tokenID
   string id = 1 [
     (cosmos_proto.scalar) = "cosmos.Uint",
     (gogoproto.customtype) = "Uint",
     (gogoproto.nullable) = false
   ];
+  // principal defines the accounts/group which the permission grants to
   permission.Principal principal = 2;
+  // resource_type defines the type of resource that grants permission for
   resource.ResourceType resource_type = 3;
+  // resource_id defines the bucket/object/group id of the resource that grants permission for
   string resource_id = 4 [
     (cosmos_proto.scalar) = "cosmos.Uint",
     (gogoproto.customtype) = "Uint",
     (gogoproto.nullable) = false
   ];
+  // statements defines the details content of the permission, including effect/actions/sub-resources
   repeated permission.Statement statements = 5;
-  permission.Statement member_statement = 6;
+  // expiration_time defines the whole expiration time of all the statements.
+  // Notices: Its priority is higher than the expiration time inside the Statement
+  google.protobuf.Timestamp expiration_time = 6 [
+    (gogoproto.stdtime) = true,
+    (gogoproto.nullable) = true
+  ];
+  // member_statement defines a special policy which indicates that the principal is a member of the group
+  permission.Statement member_statement = 7;
 }
 
+// PolicyGroup refers to a group of policies which grant permission to Group, which is limited to MaxGroupNum (default 10).
+// This means that a single resource can only grant permission to 10 groups. The reason for
+// this is to enable on-chain determination of whether an operator has permission within a limited time.
 message PolicyGroup {
   message Item {
     string policy_id = 1 [
@@ -38,5 +54,6 @@ message PolicyGroup {
       (gogoproto.nullable) = false
     ];
   }
+  // items define a pair of policy_id and group_id. Each resource can only grant its own permissions to a limited number of groups
   repeated Item items = 1;
 }

proto/greenfield/storage/common.proto

@@ -17,8 +17,8 @@ enum SourceType {
 enum RedundancyType {
   option (gogoproto.goproto_enum_prefix) = false;
 
-  REDUNDANCY_REPLICA_TYPE = 0;
-  REDUNDANCY_EC_TYPE = 1;
+  REDUNDANCY_EC_TYPE = 0;
+  REDUNDANCY_REPLICA_TYPE = 1;
 }
 
 enum ObjectStatus {

proto/greenfield/storage/query.proto

@@ -226,7 +226,7 @@ message QueryHeadGroupMemberRequest {
 }
 
 message QueryHeadGroupMemberResponse {
-  GroupInfo group_info = 1;
+  string group_id = 1;
 }
 
 message QueryPolicyForGroupRequest {