refactor: add state query filter

runtime/devnet/src/extensions/mod.rs

@@ -1,10 +1,8 @@
 mod v0;
 
 use crate::{
-	config::assets::TrustBackedAssetsInstance,
-	fungibles::{self, FungiblesKey},
-	state_keys::RuntimeStateKeys,
-	AccountId, AllowedApiCalls, RuntimeCall, RuntimeOrigin,
+	config::assets::TrustBackedAssetsInstance, fungibles, AccountId, AllowedApiCalls, RuntimeCall,
+	RuntimeOrigin, RuntimeStateKeys,
 };
 use codec::{Decode, Encode};
 use frame_support::{
@@ -175,8 +173,11 @@ where
 	// Charge weight for doing one storage read.
 	env.charge_weight(T::DbWeight::get().reads(1_u64))?;
 	let result = match key {
-		VersionedStateRead::V0(key) => match key {
-			RuntimeStateKeys::Fungibles(key) => fungibles::Pallet::<T>::read_state(key),
+		VersionedStateRead::V0(key) => {
+			ensure!(AllowedApiCalls::contains(&key), DispatchError::Other("UnknownCall"));
+			match key {
+				RuntimeStateKeys::Fungibles(key) => fungibles::Pallet::<T>::read_state(key),
+			}
 		},
 	};
 	log::trace!(
@@ -213,10 +214,10 @@ enum VersionedDispatch {
 // - `error`: The `DispatchError` encountered during contract execution.
 // - `version`: The version of the chain extension, used to determine the known errors.
 pub(crate) fn convert_to_status_code(error: DispatchError, version: u8) -> u32 {
-	// "UnknownFunctionId" and "DecodingFailed" are mapped to specific errors in the API and will
+	// "UnknownCall" and "DecodingFailed" are mapped to specific errors in the API and will
 	// never change.
 	let mut encoded_error = match error {
-		DispatchError::Other("UnknownFunctionId") => Vec::from([254u8, 0, 0, 0]),
+		DispatchError::Other("UnknownCall") => Vec::from([254u8, 0, 0, 0]),
 		DispatchError::Other("DecodingFailed") => Vec::from([255u8, 0, 0, 0]),
 		_ => error.encode(),
 	};

runtime/devnet/src/lib.rs

@@ -11,6 +11,7 @@ mod weights;
 // Public due to integration tests crate.
 pub mod config;
 
+use codec::{Decode, Encode, MaxEncodedLen};
 use cumulus_pallet_parachain_system::RelayNumberMonotonicallyIncreases;
 use polkadot_runtime_common::xcm_sender::NoPriceForMessageDelivery;
 use smallvec::smallvec;
@@ -252,17 +253,39 @@ impl Contains<RuntimeCall> for FilteredCalls {
 	}
 }
 
-/// A type to identify allowed calls to the Runtime from contracts. Used by Pop API
+/// A type to identify allowed calls to the Runtime from the API.
 pub struct AllowedApiCalls;
+
 impl Contains<RuntimeCall> for AllowedApiCalls {
+	/// Allowed runtime calls from the API.
 	fn contains(c: &RuntimeCall) -> bool {
-		use fungibles::Call as FungiblesCall;
+		use fungibles::Call::*;
 		matches!(
 			c,
-			RuntimeCall::Fungibles(
-				FungiblesCall::transfer { .. }
-					| FungiblesCall::approve { .. }
-					| FungiblesCall::increase_allowance { .. }
+			RuntimeCall::Fungibles(transfer { .. } | approve { .. } | increase_allowance { .. })
+		)
+	}
+}
+
+/// State queries that can be made in the API.
+#[derive(Encode, Decode, Debug, MaxEncodedLen)]
+#[repr(u8)]
+pub enum RuntimeStateKeys<T: fungibles::Config> {
+	#[codec(index = 150)]
+	Fungibles(fungibles::FungiblesKey<T>),
+}
+
+impl<T: fungibles::Config> Contains<RuntimeStateKeys<T>> for AllowedApiCalls {
+	/// Allowed state queries from the API.
+	fn contains(c: &RuntimeStateKeys<T>) -> bool {
+		use fungibles::FungiblesKey::*;
+		matches!(
+			c,
+			RuntimeStateKeys::Fungibles(
+				TotalSupply(..)
+					| BalanceOf(..) | Allowance(..)
+					| TokenName(..) | TokenSymbol(..)
+					| TokenDecimals(..)
 			)
 		)
 	}
@@ -975,15 +998,3 @@ cumulus_pallet_parachain_system::register_validate_block! {
 	Runtime = Runtime,
 	BlockExecutor = cumulus_pallet_aura_ext::BlockExecutor::<Runtime, Executive>,
 }
-
-pub(crate) mod state_keys {
-	use super::fungibles;
-	use codec::{Decode, Encode, MaxEncodedLen};
-
-	#[derive(Encode, Decode, Debug, MaxEncodedLen)]
-	#[repr(u8)]
-	pub enum RuntimeStateKeys<T: fungibles::Config> {
-		#[codec(index = 150)]
-		Fungibles(fungibles::FungiblesKey<T>),
-	}
-}