feat: Witnesser dispatch call filter

[syan095]

Pull Request

Closes: PRO-478

Checklist

Please conduct a thorough self-review before opening the PR.

• I am confident that the code works.
• I have updated documentation where appropriate.

Summary

Add dispatch call filter for WItnesser pallet.
This is part of the Safe Mode for the witnessed pallet.
Only calls that passes the filter are dispatched. Others are kept in the Queue until full recovery.

[linear]

PRO-478 Witnesser Safe Mode with advanced recovery

When we turn witnessing back on, it should be possible to filter against the calls we want to allow.

Not totally sure how to achieve this. Substrate has the FilterStack trait that might help here…

(Needs some research)

[codecov]

Codecov Report

Merging #4001 (cc03851) into main (178df88) will decrease coverage by 0%.
Report is 1 commits behind head on main.
The diff coverage is 64%.

@@          Coverage Diff           @@
##            main   #4001    +/-   ##
======================================
- Coverage     72%     72%    -0%     
======================================
  Files        368     369     +1     
  Lines      58484   58591   +107     
  Branches   58484   58591   +107     
======================================
+ Hits       42327   42376    +49     
- Misses     14060   14112    +52     
- Partials    2097    2103     +6     

Files Changed	Coverage Δ
...tate-chain/cf-integration-tests/src/authorities.rs	93% <ø> (ø)
state-chain/runtime/src/chainflip.rs	51% <ø> (-2%)	⬇️
state-chain/runtime/src/lib.rs	39% <ø> (ø)
state-chain/traits/src/lib.rs	51% <0%> (-1%)	⬇️
state-chain/runtime/src/safe_mode.rs	25% <25%> (ø)
state-chain/pallets/cf-witnesser/src/mock.rs	95% <87%> (-<1%)	⬇️
state-chain/pallets/cf-witnesser/src/lib.rs	80% <87%> (-2%)	⬇️
state-chain/pallets/cf-environment/src/lib.rs	75% <100%> (+1%)	⬆️
state-chain/pallets/cf-witnesser/src/tests.rs	100% <100%> (ø)

... and 4 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[dandanlen]

Thanks for getting started on this @syan095.

I think the general approach of a top-level call filter is a good one.

However we can be more specific and narrow the filter down to only the calls that can be witnessed. There are some pallets in this implementation that don't have any witness calls (for example system), and others that are missing (funding for example).

The pallets that have witness origin calls are:

Non-instantiable:

• Governance (1 Call)
• Funding (3 Calls)
• Swapping (2 Calls)

Instantiable:

• Broadcast (1 Call)
• Chain Tracking (1 Call)
• Ingress/Egress (3 Calls)
• Vaults (2 Calls)

Ideally I think we should be able to have as fine-grained control as possible.

For example, if we want to allow everything except bitcoin ingress, we should be able to configure this.

To start with, I think a per-pallet filter is enough.
Then we can add support for instantiable pallets.
Then we can add support for individual calls.

[syan095]

Ideally I think we should be able to have as fine-grained control as possible.

Cool - good to know. I didn't go into too much details, I wanted to make sure the general approach was feasible at first.
I will proceed on this.

[dandanlen]

LGTM - only minor I'd like to change is to put all the ChainflipCodeFilter code in its own module. The chainflip.rs file is already pretty crowded.

Thanks.

[dandanlen]

This doesn't seem right - it ignores the safe mode?

[dandanlen]

I think it makes sense to combine the WitnesserCallPermission and CallDispatchFilter.

If we change the trait definition to take &self, then we can impl CallDispatchFilter for WitnesserCallPermission, and we don't need to inject so many items via the witnesser config. I think this will make it a bit easier to follow.

[syan095]

I think it makes sense to combine the WitnesserCallPermission and CallDispatchFilter.

Ahh good idea!

[dandanlen]

LGTM, thanks. I just added a small refactor, decoupling the WitnesserCallPermission from safe mode.