From f308bd875c9a95505670f7e98800de631cf96e16 Mon Sep 17 00:00:00 2001
From: clangenb <37865735+clangenb@users.noreply.github.com>
Date: Wed, 27 Oct 2021 13:00:26 +0200
Subject: [PATCH] Add dispatchable filter: SudoOnlyFilter (#34)

* [launch-runtime] add sudo only filter

* [launch-runtime] fix negated dispatchable filter

* [GA] cancel previous runs and add cargo cache

* [launch-runtime] fix filter

Co-authored-by: brenzi <brenzi@users.noreply.github.com>
---
 polkadot-parachains/launch-runtime/src/lib.rs | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/polkadot-parachains/launch-runtime/src/lib.rs b/polkadot-parachains/launch-runtime/src/lib.rs
index 4cde74a08a9..c8f5d5b97f4 100644
--- a/polkadot-parachains/launch-runtime/src/lib.rs
+++ b/polkadot-parachains/launch-runtime/src/lib.rs
@@ -158,6 +158,27 @@ parameter_types! {
 	pub const SS58Prefix: u8 = 42;
 }
 
+pub struct SudoOnly;
+impl Contains<Call> for SudoOnly {
+	fn contains(call: &Call) -> bool {
+		// the system relevant pallets have either:
+		//
+		// * `ensure_root(origin)`
+		// * `ensure_none(origin)`
+		//
+		// So effectively, this is a `SudoOnly` filter.
+		!matches!(
+			call,
+			// only enable force_transfer/set_balance, which are root calls.
+			Call::Balances(
+				pallet_balances::Call::transfer { .. } |
+					pallet_balances::Call::transfer_all { .. } |
+					pallet_balances::Call::transfer_keep_alive { .. }
+			) | Call::Treasury(_)
+		)
+	}
+}
+
 impl frame_system::Config for Runtime {
 	/// The identifier used to distinguish between accounts.
 	type AccountId = AccountId;
@@ -189,7 +210,7 @@ impl frame_system::Config for Runtime {
 	type OnNewAccount = ();
 	type OnKilledAccount = ();
 	type DbWeight = ();
-	type BaseCallFilter = frame_support::traits::Everything;
+	type BaseCallFilter = SudoOnly;
 	type SystemWeightInfo = ();
 	type BlockWeights = RuntimeBlockWeights;
 	type BlockLength = RuntimeBlockLength;