Skip to content
This repository has been archived by the owner on Sep 9, 2024. It is now read-only.

Blanket authorization #51

Merged
merged 5 commits into from
Dec 7, 2022
Merged

Blanket authorization #51

merged 5 commits into from
Dec 7, 2022

Conversation

bbenligiray
Copy link
Member

Closes #47

The current implementation of RequesterAuthorizers allow endpoint with ID 0 to be whitelisted to support api3dao/airnode#1527 However, during our research, we realized that using the endpoint with ID 0 for this purpose is not appropriate and that should be a proper endpoint with an ID. Then, instead of removing the endpoint-specific authorization functionality, I used authorizations with endpoint ID 0 as a blanket authorization across all endpoints of the Airnode.

Although the current ERC20-based monetization contracts can be updated according to this, I didn't bother because they have gone obsolete #45

@bbenligiray bbenligiray self-assigned this Nov 26, 2022
@bbenligiray bbenligiray changed the base branch from main to endpoint-or-template-id November 26, 2022 10:00
Copy link
Contributor

@acenolaza acenolaza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code changes look good for current solution but since endpointId is basically the hash of oisTitle + endpointName, wouldn't it be semantically more correct to use the hash of just oisTitle instead of bytes32(0) to allow all endpoints for a specific OIS?

@bbenligiray
Copy link
Member Author

That's also an option but then the Airnode would have to check authorization for two endpoints IDs (hash(OIS title+endpoint name) and hash(OIS title)), though this is not a very strong argument against it.
I mainly added this for the monetization story and there the authorization is designed to happen for all endpoints of an Airnode (rather than an OIS). That's because it is the API provider's brand value that is being monetized rather than a specific set of endpoints, so they buyer will expect to get access to all future endpoints too (and the API provider can always create a new mnemonic/address if they really want to work around this).

@Ashar2shahid
Copy link

I like the OIS approach that @acenolaza suggested, but I think using 0 for system wide access makes sense and also help to verify easily onchain if someone gets verified because they don't have to deal with endpointIds.

Base automatically changed from endpoint-or-template-id to dev December 7, 2022 12:28
@bbenligiray bbenligiray merged commit f887036 into dev Dec 7, 2022
@bbenligiray bbenligiray deleted the blanket-authorization branch December 7, 2022 12:32
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Have RequesterAuthorizer not care about the endpoint
3 participants