disable turrets from adding or removing themselves from a ctrlAccount

TODO.md

@@ -1,10 +1,10 @@
 - [ ] Support for per txFunction [dynamic variable fees](https://github.com/tyvdh/stellar-tss/blob/master/wrangler/src/txFunctions/run.js#L55)
 - [ ] Support dynamic variable tolerance fees ([here](https://github.com/tyvdh/stellar-tss/blob/master/wrangler/src/txFunctions/run.js#L90-L91) & [here](https://github.com/tyvdh/stellar-tss/blob/master/wrangler/src/txSponsors/add.js#L20))
 - [ ] Enable [cache](https://github.com/tyvdh/stellar-tss/blob/master/wrangler/src/index.js#L44-L53) in production
-- [ ] Prevent self swapping in the ctrlAccounts [heal.js function](https://github.com/tyvdh/stellar-tss/blob/master/wrangler/src/ctrlAccounts/heal.js)
 
 # Done
+- [x] ~Prevent self swapping in the ctrlAccounts [heal.js function](https://github.com/tyvdh/stellar-tss/blob/master/wrangler/src/ctrlAccounts/heal.js)~
 - [x] [~Wiki API docs~](https://github.com/tyvdh/stellar-tss/wiki)
-- [x] [~Implement txFunction heal functionality~](https://github.com/tyvdh/stellar-tss/pull/2)
-- [x] [~Implement fees for contract uploads~](https://github.com/tyvdh/stellar-tss/commit/6c8b299e22fec41fa546cc3a7d2f74016c5f2351)
 - [x] [~Implement fees for contract runs~](https://github.com/tyvdh/stellar-tss/pull/3)
+- [x] [~Implement fees for contract uploads~](https://github.com/tyvdh/stellar-tss/commit/6c8b299e22fec41fa546cc3a7d2f74016c5f2351)
+- [x] [~Implement txFunction heal functionality~](https://github.com/tyvdh/stellar-tss/pull/2)

wrangler/src/ctrlAccounts/heal.js

@@ -7,15 +7,19 @@ import { parse } from '@iarna/toml'
 import txFunctionsGet from '../txFunctions/get'
 import turretToml from '../turret/toml'
 
-// TODO: prevent self swapping. Turrets should not be able to add or remove themselves from a ctrlAccount
-
 export default async ({ request, params }) => {
   const { 
     functionHash: txFunctionHash, 
     sourceAccount, 
     removeTurret, 
     addTurret 
   } = await request.json()
+
+  if (
+    removeTurret === TURRET_ADDRESS
+    || addTurret === TURRET_ADDRESS
+  ) throw `Turrets may not add or remove themselves from a ctrlAccount`
+
   const { value, metadata } = await TX_FUNCTIONS.getWithMetadata(txFunctionHash, 'arrayBuffer')
 
   if (!value)