Prevent account permissions for receive and access from being changed

FungibleToken.test.ts

@@ -8,6 +8,7 @@ import {
   Int64,
   method,
   Mina,
+  Permissions,
   PublicKey,
   SmartContract,
   State,
@@ -423,6 +424,26 @@ describe("token integration", () => {
     })
   })
 
+  describe("account permissions", () => {
+    it("should reject a transaction that's changing the account permission for receive", async () => {
+      const permissions = localChain.getAccount(sender, tokenAContract.deriveTokenId()).permissions
+      permissions.receive = Permissions.impossible()
+      const updateSend = AccountUpdate.createSigned(
+        sender,
+        tokenAContract.deriveTokenId(),
+      )
+      updateSend.account.permissions.set(permissions)
+      await rejects(() =>
+        Mina.transaction({
+          sender: sender,
+          fee: 1e8,
+        }, async () => {
+          await tokenAContract.approveBase(AccountUpdateForest.fromFlatArray([updateSend]))
+        })
+      )
+    })
+  })
+
   describe("pausing/resuming", () => {
     const sendAmount = UInt64.from(1)
 

FungibleToken.ts

@@ -1,18 +1,22 @@
 import {
   AccountUpdate,
   AccountUpdateForest,
+  assert,
   Bool,
   DeployArgs,
   Field,
   Int64,
   MerkleList,
   method,
+  Permissions,
+  Provable,
   PublicKey,
   Reducer,
   State,
   state,
   Struct,
   TokenContract,
+  Types,
   UInt64,
   UInt8,
 } from "o1js"
@@ -127,10 +131,33 @@ export class FungibleToken extends TokenContract implements FungibleTokenLike {
     this.emitEvent("Transfer", new TransferEvent({ from, to, amount }))
   }
 
+  private permissionEquals(p1: Types.AuthRequired, p2: Types.AuthRequired) {
+    return p1.constant
+      .equals(p2.constant)
+      .and(p1.signatureNecessary.equals(p2.signatureNecessary))
+      .and(p1.signatureSufficient.equals(p2.signatureSufficient))
+  }
+
+  private checkPermissionsUpdate(update: AccountUpdate) {
+    let permissions = update.update.permissions
+
+    let { access, receive } = permissions.value
+    let accessIsNone = this.permissionEquals(access, Permissions.none())
+    let receiveIsNone = this.permissionEquals(receive, Permissions.none())
+    let updateAllowed = accessIsNone.and(receiveIsNone)
+
+    assert(updateAllowed.or(permissions.isSome.not()))
+  }
+
   @method
   async approveBase(updates: AccountUpdateForest): Promise<void> {
     this.paused.getAndRequireEquals().assertFalse()
-    this.checkZeroBalanceChange(updates)
+    let totalBalance = Int64.from(0)
+    this.forEachUpdate(updates, (update, usesToken) => {
+      this.checkPermissionsUpdate(update)
+      totalBalance = Provable.if(usesToken, totalBalance.add(update.balanceChange), totalBalance)
+    })
+    totalBalance.assertEquals(Int64.zero)
   }
 
   @method.returns(UInt64)