[AHM Gov] AssetHub as Superuser on Polkadot relay - utils & config

Cargo.toml

@@ -261,6 +261,7 @@ zombienet-sdk = { version = "0.2.4" }
 tuplex = { version = "0.1.0", default-features = false }
 relay-common = { path = "relay/common", default-features = false }
 ss58-registry = { version = "1.47.0" }
+pallets-common = { path = "pallets/common", default-features = false }
 
 [workspace]
 resolver = "2"
@@ -297,6 +298,7 @@ members = [
 	"integration-tests/zombienet",
 	"pallets/ah-migrator",
 	"pallets/ah-ops",
+	"pallets/common",
 	"pallets/rc-migrator",
 	"pallets/remote-proxy",
 	"relay/common",

pallets/common/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+authors.workspace = true
+description = "Shared utilities"
+edition.workspace = true
+license.workspace = true
+name = "pallets-common"
+repository.workspace = true
+version.workspace = true
+
+[dependencies]
+codec = { features = ["derive", "max-encoded-len"], workspace = true }
+scale-info = { features = ["derive"], workspace = true }
+xcm = { workspace = true }
+xcm-executor = { workspace = true }
+frame-support = { workspace = true }
+frame-system = { workspace = true }
+log = { workspace = true }
+
+[features]
+default = ["std"]
+std = [
+	"codec/std",
+	"frame-support/std",
+	"frame-system/std",
+	"log/std",
+	"scale-info/std",
+	"xcm-executor/std",
+	"xcm/std",
+]

pallets/common/src/lib.rs

@@ -0,0 +1,140 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// This file is part of Polkadot.
+
+// Polkadot is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Polkadot is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Polkadot. If not, see <http://www.gnu.org/licenses/>.
+
+//! Code shared between all runtimes
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use core::marker::PhantomData;
+use frame_support::traits::{Contains, OriginTrait};
+use xcm::latest::{Location, OriginKind};
+use xcm_executor::traits::ConvertOrigin;
+
+/// TODO: `LocationAsSuperuser` is temporary placed here, the final solution will be imported from
+/// `xcm_builder` (depends on backports) instead.
+///
+/// A converter that allows a specific `Location` to act as a superuser (`RuntimeOrigin::root()`)
+/// if it matches the predefined `SuperuserLocation` filter and `OriginKind::Superuser`.
+pub struct LocationAsSuperuser<SuperuserLocation, RuntimeOrigin>(
+	PhantomData<(SuperuserLocation, RuntimeOrigin)>,
+);
+impl<SuperuserLocation: Contains<Location>, RuntimeOrigin: OriginTrait> ConvertOrigin<RuntimeOrigin>
+	for LocationAsSuperuser<SuperuserLocation, RuntimeOrigin>
+{
+	fn convert_origin(
+		origin: impl Into<Location>,
+		kind: OriginKind,
+	) -> Result<RuntimeOrigin, Location> {
+		let origin = origin.into();
+		log::trace!(target: "xcm::origin_conversion", "LocationAsSuperuser origin: {:?}, kind: {:?}", origin, kind);
+		match (kind, &origin) {
+			(OriginKind::Superuser, loc) if SuperuserLocation::contains(loc) =>
+				Ok(RuntimeOrigin::root()),
+			_ => Err(origin),
+		}
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use frame_support::{construct_runtime, derive_impl, parameter_types, traits::Equals};
+	use xcm::latest::{Junction::*, Junctions::*, OriginKind};
+
+	type Block = frame_system::mocking::MockBlock<Test>;
+
+	construct_runtime!(
+		pub enum Test
+		{
+			System: frame_system,
+		}
+	);
+
+	#[derive_impl(frame_system::config_preludes::TestDefaultConfig)]
+	impl frame_system::Config for Test {
+		type Block = Block;
+	}
+
+	parameter_types! {
+		pub SuperuserLocation: Location = Location::new(0, Parachain(1));
+	}
+
+	#[test]
+	fn superuser_location_works() {
+		let test_conversion = |loc, kind| {
+			LocationAsSuperuser::<Equals<SuperuserLocation>, RuntimeOrigin>::convert_origin(
+				loc, kind,
+			)
+		};
+
+		// Location that was set as SuperUserLocation should result in success conversion to Root
+		assert!(matches!(test_conversion(SuperuserLocation::get(), OriginKind::Superuser), Ok(..)));
+		// Same Location as SuperUserLocation::get()
+		assert!(matches!(
+			test_conversion(Location::new(0, Parachain(1)), OriginKind::Superuser),
+			Ok(..)
+		));
+
+		// Same Location but different origin kind
+		assert!(matches!(test_conversion(SuperuserLocation::get(), OriginKind::Native), Err(..)));
+		assert!(matches!(
+			test_conversion(SuperuserLocation::get(), OriginKind::SovereignAccount),
+			Err(..)
+		));
+		assert!(matches!(test_conversion(SuperuserLocation::get(), OriginKind::Xcm), Err(..)));
+
+		// No other location should result in successful conversion to Root
+		// thus expecting Err in all cases below
+		//
+		// Non-matching parachain number
+		assert!(matches!(
+			test_conversion(Location::new(0, Parachain(2)), OriginKind::Superuser),
+			Err(..)
+		));
+		// Non-matching parents count
+		assert!(matches!(
+			test_conversion(Location::new(1, Parachain(1)), OriginKind::Superuser),
+			Err(..)
+		));
+		// Child location of SuperUserLocation
+		assert!(matches!(
+			test_conversion(
+				Location::new(1, [Parachain(1), GeneralIndex(0)]),
+				OriginKind::Superuser
+			),
+			Err(..)
+		));
+		// Here
+		assert!(matches!(test_conversion(Location::new(0, Here), OriginKind::Superuser), Err(..)));
+		// Parent
+		assert!(matches!(test_conversion(Location::new(1, Here), OriginKind::Superuser), Err(..)));
+		// Some random account
+		assert!(matches!(
+			test_conversion(
+				Location::new(0, AccountId32 { network: None, id: [0u8; 32] }),
+				OriginKind::Superuser
+			),
+			Err(..)
+		));
+		// Child location of SuperUserLocation
+		assert!(matches!(
+			test_conversion(
+				Location::new(0, [Parachain(1), AccountId32 { network: None, id: [1u8; 32] }]),
+				OriginKind::Superuser
+			),
+			Err(..)
+		));
+	}
+}

relay/common/Cargo.toml

@@ -16,7 +16,6 @@ sp-runtime = { workspace = true }
 polkadot-primitives = { workspace = true }
 pallet-staking-reward-fn = { workspace = true }
 
-
 [features]
 default = ["std"]
 std = [

relay/kusama/src/lib.rs

@@ -726,7 +726,7 @@ impl EnsureOriginWithArg<RuntimeOrigin, RuntimeParametersKey> for DynamicParamet
 		match key {
 			Inflation(_) => frame_system::ensure_root(origin.clone()),
 			Treasury(_) =>
-				// TODO: review - GeneralAdmin propagation from AssetHub?
+			// TODO: review - GeneralAdmin propagation from AssetHub?
 				EitherOf::<EnsureRoot<AccountId>, GeneralAdmin>::ensure_origin(origin.clone()),
 		}
 		.map_err(|_| origin)

relay/polkadot/Cargo.toml

@@ -104,6 +104,7 @@ polkadot-runtime-common = { workspace = true }
 runtime-parachains = { workspace = true }
 polkadot-primitives = { workspace = true }
 relay-common = { workspace = true }
+pallets-common = { workspace = true }
 
 xcm = { workspace = true }
 xcm-executor = { workspace = true }
@@ -197,6 +198,7 @@ std = [
 	"pallet-whitelist/std",
 	"pallet-xcm-benchmarks?/std",
 	"pallet-xcm/std",
+	"pallets-common/std",
 	"polkadot-parachain-primitives/std",
 	"polkadot-primitives/std",
 	"polkadot-runtime-common/std",

relay/polkadot/src/lib.rs

@@ -68,9 +68,9 @@ use frame_support::{
 	traits::{
 		fungible::HoldConsideration,
 		tokens::{imbalance::ResolveTo, UnityOrOuterConversion},
-		ConstU32, ConstU8, Contains, EitherOf, EitherOfDiverse, FromContains, Get, InstanceFilter,
-		KeyOwnerProofSystem, LinearStoragePrice, OnRuntimeUpgrade, PrivilegeCmp, ProcessMessage,
-		ProcessMessageError, WithdrawReasons,
+		ConstU32, ConstU8, Contains, EitherOf, EitherOfDiverse, Equals, FromContains, Get,
+		InstanceFilter, KeyOwnerProofSystem, LinearStoragePrice, OnRuntimeUpgrade, PrivilegeCmp,
+		ProcessMessage, ProcessMessageError, WithdrawReasons,
 	},
 	weights::{
 		constants::{WEIGHT_PROOF_SIZE_PER_KB, WEIGHT_REF_TIME_PER_MICROS},
@@ -1524,20 +1524,13 @@ parameter_types! {
 	pub AhExistentialDeposit: Balance = EXISTENTIAL_DEPOSIT / 100;
 }
 
-pub struct ContainsAssetHub;
-impl Contains<Location> for ContainsAssetHub {
-	fn contains(loc: &Location) -> bool {
-		*loc == AssetHubLocation::get()
-	}
-}
-
 impl pallet_rc_migrator::Config for Runtime {
 	type RuntimeEvent = RuntimeEvent;
 	type ManagerOrigin = EitherOfDiverse<
 		EnsureRoot<AccountId>,
 		EitherOfDiverse<
 			EnsureXcm<IsVoiceOfBody<CollectivesLocation, FellowsBodyId>>,
-			EnsureXcm<ContainsAssetHub, Location>,
+			EnsureXcm<Equals<AssetHubLocation>, Location>,
 		>,
 	>;
 	type Currency = Balances;

relay/polkadot/src/xcm_config.rs

@@ -46,6 +46,8 @@ use xcm_builder::{
 	WeightInfoBounds, WithComputedOrigin, WithUniqueTopic, XcmFeeManagerFromComponents,
 };
 
+use pallets_common::LocationAsSuperuser;
+
 pub use pallet_rc_migrator::xcm_config::*;
 
 parameter_types! {
@@ -113,6 +115,8 @@ type LocalOriginConverter = (
 	SignedAccountId32AsNative<ThisNetwork, RuntimeOrigin>,
 	// Xcm origins can be represented natively under the Xcm pallet's Xcm origin.
 	XcmPassthrough<RuntimeOrigin>,
+	// AssetHub can execute as root
+	LocationAsSuperuser<Equals<AssetHubLocation>, RuntimeOrigin>,
 );
 
 parameter_types! {

system-parachains/asset-hubs/asset-hub-polkadot/src/governance/mod.rs

@@ -40,7 +40,7 @@ impl pallet_conviction_voting::Config for Runtime {
 	type Currency = Balances;
 	type VoteLockingPeriod = VoteLockingPeriod;
 	type MaxVotes = ConstU32<512>; // TODO check with weight
-	// TODO: review - after/before migration check?
+								// TODO: review - after/before migration check?
 	type MaxTurnout =
 		frame_support::traits::tokens::currency::ActiveIssuanceOf<Balances, Self::AccountId>;
 	type Polls = Referenda;

system-parachains/bridge-hubs/bridge-hub-polkadot/Cargo.toml

@@ -85,6 +85,7 @@ cumulus-primitives-utility = { workspace = true }
 pallet-collator-selection = { workspace = true }
 parachain-info = { workspace = true }
 parachains-common = { workspace = true }
+pallets-common = { workspace = true }
 system-parachains-constants = { workspace = true }
 
 # Bridges
@@ -186,6 +187,7 @@ std = [
 	"pallet-xcm-benchmarks?/std",
 	"pallet-xcm-bridge-hub/std",
 	"pallet-xcm/std",
+	"pallets-common/std",
 	"parachain-info/std",
 	"parachains-common/std",
 	"polkadot-core-primitives/std",

system-parachains/bridge-hubs/bridge-hub-polkadot/src/xcm_config.rs

@@ -28,6 +28,7 @@ use frame_support::{
 use frame_system::EnsureRoot;
 use pallet_collator_selection::StakingPotAccountId;
 use pallet_xcm::XcmPassthrough;
+use pallets_common::LocationAsSuperuser;
 use parachains_common::xcm_config::{
 	AllSiblingSystemParachains, ConcreteAssetFromSystem, ParentRelayOrSiblingParachains,
 	RelayOrOtherSystemParachains,
@@ -73,6 +74,7 @@ parameter_types! {
 		LocationToAccountId::convert_location(&RelayTreasuryLocation::get())
 			.unwrap_or(TreasuryAccount::get());
 	pub StakingPot: AccountId = CollatorSelection::account_id();
+	pub AssetHubLocation: Location = (Parent, Parachain(system_parachain::ASSET_HUB_ID)).into();
 }
 
 /// Type for specifying how a `Location` can be converted into an `AccountId`.
@@ -127,6 +129,8 @@ pub type XcmOriginToTransactDispatchOrigin = (
 	SignedAccountId32AsNative<RelayNetwork, RuntimeOrigin>,
 	// Xcm origins can be represented natively under the Xcm pallet's Xcm origin.
 	XcmPassthrough<RuntimeOrigin>,
+	// AssetHub can execute as root
+	LocationAsSuperuser<Equals<AssetHubLocation>, RuntimeOrigin>,
 );
 
 pub struct ParentOrParentsPlurality;
@@ -171,6 +175,7 @@ pub type Barrier = TrailingSetTopicAsId<
 						ParentOrParentsPlurality,
 						FellowsPlurality,
 						Equals<RelayTreasuryLocation>,
+						Equals<AssetHubLocation>,
 					)>,
 					// Subscriptions for version tracking are OK.
 					AllowSubscriptionsFrom<ParentRelayOrSiblingParachains>,