feat(gnovm): forbid importing realms in packages

examples/gno.land/p/demo/groups/gno.mod

@@ -1,6 +1,3 @@
 module gno.land/p/demo/groups
 
-require (
-	gno.land/p/demo/rat v0.0.0-latest
-	gno.land/r/demo/boards v0.0.0-latest
-)
+require gno.land/p/demo/rat v0.0.0-latest

examples/gno.land/p/demo/tests/gno.mod

@@ -3,5 +3,4 @@ module gno.land/p/demo/tests
 require (
 	gno.land/p/demo/tests/subtests v0.0.0-latest
 	gno.land/p/demo/uassert v0.0.0-latest
-	gno.land/r/demo/tests v0.0.0-latest
 )

examples/gno.land/p/demo/tests/tests.gno

@@ -4,19 +4,10 @@ import (
 	"std"
 
 	psubtests "gno.land/p/demo/tests/subtests"
-	"gno.land/r/demo/tests"
-	rtests "gno.land/r/demo/tests"
 )
 
 const World = "world"
 
-// IncCounter demonstrates that it's possible to call a realm function from
-// a package. So a package can potentially write into the store, by calling
-// an other realm.
-func IncCounter() {
-	tests.IncCounter()
-}
-
 func CurrentRealmPath() string {
 	return std.CurrentRealm().PkgPath()
 }
@@ -64,10 +55,6 @@ func GetPSubtestsPrevRealm() std.Realm {
 	return psubtests.GetPrevRealm()
 }
 
-func GetRTestsGetPrevRealm() std.Realm {
-	return rtests.GetPrevRealm()
-}
-
 // Warning: unsafe pattern.
 func Exec(fn func()) {
 	fn()

gno.land/cmd/gnoland/testdata/assertorigincall.txtar

@@ -9,20 +9,16 @@
 # | 4   |          | through /r/foo      | myrealm.A()            | PANIC  |
 # | 5   |          |                     | myrealm.B()            | pass   |
 # | 6   |          |                     | myrealm.C()            | PANIC  |
-# | 7   |          | through /p/demo/bar | myrealm.A()            | PANIC  |
+# | 7   | MsgRun   | wallet direct       | myrealm.A()            | PANIC  |
 # | 8   |          |                     | myrealm.B()            | pass   |
 # | 9   |          |                     | myrealm.C()            | PANIC  |
-# | 10  | MsgRun   | wallet direct       | myrealm.A()            | PANIC  |
+# | 10  |          | through /r/foo      | myrealm.A()            | PANIC  |
 # | 11  |          |                     | myrealm.B()            | pass   |
 # | 12  |          |                     | myrealm.C()            | PANIC  |
-# | 13  |          | through /r/foo      | myrealm.A()            | PANIC  |
-# | 14  |          |                     | myrealm.B()            | pass   |
-# | 15  |          |                     | myrealm.C()            | PANIC  |
-# | 16  |          | through /p/demo/bar | myrealm.A()            | PANIC  |
-# | 17  |          |                     | myrealm.B()            | pass   |
-# | 18  |          |                     | myrealm.C()            | PANIC  |
-# | 19  | MsgCall  | wallet direct       | std.AssertOriginCall() | pass   |
-# | 20  | MsgRun   | wallet direct       | std.AssertOriginCall() | PANIC  |
+# | 13  |          | through /p/demo/bar | bar.A()                | PANIC  |
+# | 14  |          |                     | bar.B()                | pass   |
+# | 15  |          |                     | bar.C()                | PANIC  |
+# | 16  | MsgRun   | wallet direct       | std.AssertOriginCall() | PANIC  |
 
 # Init
 ## set up and start a new node
@@ -56,61 +52,43 @@ stdout 'OK!'
 ! gnokey maketx call -pkgpath gno.land/r/foo -func C -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
 stderr 'invalid non-origin call'
 
-## remove due to update to maketx call can only call realm (case 7,8,9)
-## 7. MsgCall -> p/demo/bar.A -> myrlm.A: PANIC
-## ! gnokey maketx call -pkgpath gno.land/p/demo/bar -func A -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
-## stderr 'invalid non-origin call'
-
-## 8. MsgCall -> p/demo/bar.B -> myrlm.B: PASS
-## gnokey maketx call -pkgpath gno.land/p/demo/bar -func B -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
-## stdout 'OK!'
-
-## 9. MsgCall -> p/demo/bar.C -> myrlm.C: PANIC
-## ! gnokey maketx call -pkgpath gno.land/p/demo/bar -func C -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
-## stderr 'invalid non-origin call'
-
-## 10. MsgRun -> run.main -> myrlm.A: PANIC
+## 7. MsgRun -> run.main -> myrlm.A: PANIC
 ! gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/myrlmA.gno
 stderr 'invalid non-origin call'
 
-## 11. MsgRun -> run.main -> myrlm.B: PASS
+## 8. MsgRun -> run.main -> myrlm.B: PASS
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/myrlmB.gno
 stdout 'OK!'
 
-## 12. MsgRun -> run.main -> myrlm.C: PANIC
+## 9. MsgRun -> run.main -> myrlm.C: PANIC
 ! gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/myrlmC.gno
 stderr 'invalid non-origin call'
 
-## 13. MsgRun -> run.main -> foo.A: PANIC
+## 10. MsgRun -> run.main -> foo.A: PANIC
 ! gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/fooA.gno
 stderr 'invalid non-origin call'
 
-## 14. MsgRun -> run.main -> foo.B: PASS
+## 11. MsgRun -> run.main -> foo.B: PASS
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/fooB.gno
 stdout 'OK!'
 
-## 15. MsgRun -> run.main -> foo.C: PANIC
+## 12. MsgRun -> run.main -> foo.C: PANIC
 ! gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/fooC.gno
 stderr 'invalid non-origin call'
 
-## 16. MsgRun -> run.main -> bar.A: PANIC
+## 13. MsgRun -> run.main -> bar.A: PANIC
 ! gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/barA.gno
 stderr 'invalid non-origin call'
 
-## 17. MsgRun -> run.main -> bar.B: PASS
+## 14. MsgRun -> run.main -> bar.B: PASS
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/barB.gno
 stdout 'OK!'
 
-## 18. MsgRun -> run.main -> bar.C: PANIC
+## 15. MsgRun -> run.main -> bar.C: PANIC
 ! gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/barC.gno
 stderr 'invalid non-origin call'
 
-## remove testcase 19 due to maketx call forced to call a realm
-## 19. MsgCall -> std.AssertOriginCall: pass
-## gnokey maketx call -pkgpath std -func AssertOriginCall -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
-## stdout 'OK!'
-
-## 20. MsgRun -> std.AssertOriginCall: PANIC
+## 16. MsgRun -> std.AssertOriginCall: PANIC
 ! gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/baz.gno
 stderr 'invalid non-origin call'
 
@@ -133,24 +111,25 @@ func B() {
 func C() {
 	std.AssertOriginCall()
 }
--- r/foo/foo.gno --
-package foo
+-- p/demo/bar/bar.gno --
+package bar
 
-import "gno.land/r/myrlm"
+import "std"
 
 func A() {
-	myrlm.A()
+	C()
 }
 
 func B() {
-	myrlm.B()
+	if false {
+		C()
+	}
 }
-
 func C() {
-	myrlm.C()
+	std.AssertOriginCall()
 }
--- p/demo/bar/bar.gno --
-package bar
+-- r/foo/foo.gno --
+package foo
 
 import "gno.land/r/myrlm"
 

gno.land/cmd/gnoland/testdata/prevrealm.txtar

@@ -8,16 +8,14 @@
 # | 2   |          |                     | myrlm.B()       | user address |
 # | 3   |          | through /r/foo      | myrlm.A()       | r/foo        |
 # | 4   |          |                     | myrlm.B()       | r/foo        |
-# | 5   |          | through /p/demo/bar | myrlm.A()       | user address |
+# | 5   | MsgRun   | wallet direct       | myrlm.A()       | user address |
 # | 6   |          |                     | myrlm.B()       | user address |
-# | 7   | MsgRun   | wallet direct       | myrlm.A()       | user address |
-# | 8   |          |                     | myrlm.B()       | user address |
-# | 9   |          | through /r/foo      | myrlm.A()       | r/foo        |
-# | 10  |          |                     | myrlm.B()       | r/foo        |
-# | 11  |          | through /p/demo/bar | myrlm.A()       | user address |
-# | 12  |          |                     | myrlm.B()       | user address |
-# | 13  | MsgCall  | wallet direct       | std.PrevRealm() | user address |
-# | 14  | MsgRun   | wallet direct       | std.PrevRealm() | user address |
+# | 7   |          | through /r/foo      | myrlm.A()       | r/foo        |
+# | 8   |          |                     | myrlm.B()       | r/foo        |
+# | 11  |          | through /p/demo/bar | bar.A()         | user address |
+# | 12  |          |                     | bar.B()         | user address |
+# | 9   | MsgCall  | wallet direct       | std.PrevRealm() | user address |
+# | 10  | MsgRun   | wallet direct       | std.PrevRealm() | user address |
 
 # Init
 ## deploy myrlm
@@ -49,44 +47,35 @@ stdout ${RFOO_ADDR}
 gnokey maketx call -pkgpath gno.land/r/foo -func B -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
 stdout ${RFOO_ADDR}
 
-## remove due to update to maketx call can only call realm (case 5, 6, 13)
-## 5. MsgCall -> p/demo/bar.A -> myrlm.A: user address
-## gnokey maketx call -pkgpath gno.land/p/demo/bar -func A -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
-## stdout ${USER_ADDR_test1}
-
-## 6. MsgCall -> p/demo/bar.B -> myrlm.B -> r/foo.A: user address
-## gnokey maketx call -pkgpath gno.land/p/demo/bar -func B -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
-## stdout ${USER_ADDR_test1}
-
-## 7. MsgRun -> myrlm.A: user address
+## 5. MsgRun -> myrlm.A: user address
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/myrlmA.gno
 stdout ${USER_ADDR_test1}
 
-## 8. MsgRun -> myrealm.B -> myrlm.A: user address
+## 6. MsgRun -> myrealm.B -> myrlm.A: user address
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/myrlmB.gno
 stdout ${USER_ADDR_test1}
 
-## 9. MsgRun -> r/foo.A -> myrlm.A: r/foo
+## 7. MsgRun -> r/foo.A -> myrlm.A: r/foo
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/fooA.gno
 stdout ${RFOO_ADDR}
 
-## 10. MsgRun -> r/foo.B -> myrlm.B -> r/foo.A: r/foo
+## 8. MsgRun -> r/foo.B -> myrlm.B -> r/foo.A: r/foo
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/fooB.gno
 stdout ${RFOO_ADDR}
 
-## 11. MsgRun -> p/demo/bar.A -> myrlm.A: user address
+## 9. MsgRun -> p/demo/bar.A -> myrlm.A: user address
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/barA.gno
 stdout ${USER_ADDR_test1}
 
-## 12. MsgRun -> p/demo/bar.B -> myrlm.B -> r/foo.A: user address
+## 10. MsgRun -> p/demo/bar.B -> myrlm.B -> r/foo.A: user address
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/barB.gno
 stdout ${USER_ADDR_test1}
 
-## 13. MsgCall -> std.PrevRealm(): user address
+## 9. MsgCall -> std.PrevRealm(): user address
 ## gnokey maketx call -pkgpath std -func PrevRealm -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1
 ## stdout ${USER_ADDR_test1}
 
-## 14. MsgRun -> std.PrevRealm(): user address
+## 10. MsgRun -> std.PrevRealm(): user address
 gnokey maketx run -gas-fee 100000ugnot -gas-wanted 4000000 -broadcast -chainid tendermint_test test1 $WORK/run/baz.gno
 stdout ${USER_ADDR_test1}
 
@@ -117,14 +106,14 @@ func B() string {
 -- p/demo/bar/bar.gno --
 package bar
 
-import "gno.land/r/myrlm"
+import "std"
 
 func A() string {
-	return myrlm.A()
+	return std.PrevRealm().Addr().String()
 }
 
 func B() string {
-	return myrlm.B()
+	return A()
 }
 -- run/myrlmA.gno --
 package main

gnovm/memfile.go

@@ -2,6 +2,8 @@
 
 import (
 	"fmt"
+	"go/parser"
+	"go/token"
 	"regexp"
 	"sort"
 	"strings"
@@ -87,6 +89,28 @@
 		prev = file.Name
 	}
 
+	pIndex := strings.Index(mempkg.Path, "/p/")
+	if pIndex > 0 && !strings.ContainsRune(mempkg.Path[:pIndex], '/') {
+		for _, file := range mempkg.Files {
+			if !strings.HasSuffix(file.Name, ".gno") {
+				continue
+			}
+			fset := token.NewFileSet()
+			astFile, err := parser.ParseFile(fset, file.Name, file.Body, parser.ImportsOnly)
+			if err != nil {
+				return fmt.Errorf("failed to parse imports in file %q of package %q: %w", file.Name, mempkg.Path, err)
+			}
+			for _, imp := range astFile.Imports {
+				// ensure the pkg is a realm by checking if the path contains /r/ and no other / character before it (i.e protect from gno.land/p/demo/r/)
+				importPath := strings.TrimPrefix(strings.TrimSuffix(imp.Path.Value, `"`), `"`)
+				rIndex := strings.Index(importPath, "/r/")
+				if rIndex > 0 && !strings.ContainsRune(importPath[:rIndex], '/') {
+					return fmt.Errorf("package %q imports realm %q", mempkg.Path, importPath)
+				}
+			}
+		}
+	}
+
 	return nil
 }