Block owner managed plugins on collection create (#36)

* Block owner managed plugins on collection create * JS format fix
metaplex-foundation · Mar 30, 2024 · deefd7d · deefd7d
1 parent cd53660
commit deefd7d
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 5 deletions.
diff --git a/clients/js/test/createCollection.test.ts b/clients/js/test/createCollection.test.ts
@@ -34,13 +34,12 @@ test('it can create a new collection', async (t) => {
 });
 
 test('it can create a new collection with plugins', async (t) => {
-  // Given a Umi instance and a new signer.
   const umi = await createUmi();
 
   const collection = await createCollection(umi, {
     plugins: [
       pluginAuthorityPair({
-        type: 'FreezeDelegate',
+        type: 'PermanentFreezeDelegate',
         data: { frozen: false },
       }),
     ],
@@ -50,9 +49,9 @@ test('it can create a new collection with plugins', async (t) => {
     ...DEFAULT_COLLECTION,
     collection: collection.publicKey,
     updateAuthority: umi.identity.publicKey,
-    freezeDelegate: {
+    permanentFreezeDelegate: {
       authority: {
-        type: 'Owner',
+        type: 'UpdateAuthority',
       },
       frozen: false,
     },
@@ -147,3 +146,22 @@ test('it cannot create a new asset with a collection if it is not the collection
 
   await t.throwsAsync(result, { name: 'InvalidAuthority' });
 });
+
+test('it cannot create a collection with an owner managed plugin', async (t) => {
+  const umi = await createUmi();
+
+  const result = createCollection(umi, {
+    plugins: [
+      pluginAuthorityPair({
+        type: 'FreezeDelegate',
+        data: {
+          frozen: false,
+        },
+      }),
+    ],
+  });
+
+  await t.throwsAsync(result, {
+    name: 'InvalidAuthority',
+  });
+});
diff --git a/programs/mpl-core/src/processor/create_collection.rs b/programs/mpl-core/src/processor/create_collection.rs
@@ -12,7 +12,7 @@ use crate::{
         create_plugin_meta, initialize_plugin, CheckResult, Plugin, PluginAuthorityPair,
         PluginType, ValidationResult,
     },
-    state::{CollectionV1, Key},
+    state::{Authority, CollectionV1, Key},
 };
 
 #[repr(C)]
@@ -90,6 +90,11 @@ pub(crate) fn create_collection<'a>(
             let mut approved = true;
             let mut force_approved = false;
             for plugin in &plugins {
+                // Cannot have owner-managed plugins on collection.
+                if plugin.plugin.manager() == Authority::Owner {
+                    return Err(MplCoreError::InvalidAuthority.into());
+                }
+
                 if PluginType::check_create(&PluginType::from(&plugin.plugin)) != CheckResult::None
                 {
                     match Plugin::validate_create(