fix(migration): adds module account perms changes (#1525)

app/keepers/migration.go

@@ -0,0 +1,27 @@
+package keepers
+
+import (
+	"fmt"
+	"slices"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	authtypes "github.com/cosmos/cosmos-sdk/x/auth/types"
+	"golang.org/x/exp/maps"
+)
+
+func (a *AppKeepers) MigrateModuleAccountPerms(ctx sdk.Context) {
+	keys := maps.Keys(maccPerms)
+	slices.Sort(keys)
+	for _, moduleName := range keys {
+		perms := maccPerms[moduleName]
+
+		accI := a.AccountKeeper.GetModuleAccount(ctx, moduleName)
+		if accI == nil {
+			panic(fmt.Sprintf("module account not been set: %s", moduleName))
+		}
+		//nolint:all - we want to panic here
+		acc := accI.(*authtypes.ModuleAccount)
+		acc.Permissions = perms
+		a.AccountKeeper.SetModuleAccount(ctx, acc)
+	}
+}

app/upgrades/v4/upgrade.go

@@ -62,6 +62,7 @@ func CreateUpgradeHandler(
 			return nil, err
 		}
 		migrateModuleParams(ctx, keepers)
+		keepers.MigrateModuleAccountPerms(ctx)
 
 		if err := deprecateCrisisModule(ctx, keepers.CrisisKeeper); err != nil {
 			return nil, err
@@ -154,7 +155,7 @@ func setKeyTables(keepers *keepers.AppKeepers) {
 	}
 }
 
-//nolint:staticcheck
+//nolint:staticcheck - note this is a cosmos SDK supplied function specifically for upgrading consensus params
 func migrateModuleParams(ctx sdk.Context, keepers *keepers.AppKeepers) {
 	// Migrate Tendermint consensus parameters from x/params module to a dedicated x/consensus module.
 	baseAppLegacySS := keepers.ParamsKeeper.Subspace(baseapp.Paramspace).WithKeyTable(paramstypes.ConsensusParamsKeyTable())

app/upgrades/v4/upgrade_test.go

@@ -12,6 +12,7 @@ import (
 	codectypes "github.com/cosmos/cosmos-sdk/codec/types"
 	"github.com/cosmos/cosmos-sdk/crypto/keys/ed25519"
 	sdk "github.com/cosmos/cosmos-sdk/types"
+	authtypes "github.com/cosmos/cosmos-sdk/x/auth/types"
 	upgradetypes "github.com/cosmos/cosmos-sdk/x/upgrade/types"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
@@ -150,6 +151,8 @@ func (s *UpgradeTestSuite) TestUpgrade() {
 
 				s.validateStreamerMigration()
 
+				s.validateModulePermissions()
+
 				return
 			},
 			expPass: true,
@@ -173,6 +176,12 @@ func (s *UpgradeTestSuite) TestUpgrade() {
 	}
 }
 
+func (s *UpgradeTestSuite) validateModulePermissions() {
+	// a bit hacky : just check at least one concrete example of a permission upgrade
+	acc := s.App.AccountKeeper.GetModuleAccount(s.Ctx, rollapptypes.ModuleName)
+	s.Require().True(acc.HasPermission(authtypes.Burner))
+}
+
 func (s *UpgradeTestSuite) validateDelayedAckParamsMigration() error {
 	delayedackParams := s.App.DelayedAckKeeper.GetParams(s.Ctx)
 	cond := delayedackParams.DeletePacketsEpochLimit == expectDelayedackDeletePacketsEpochLimit &&