correct entitlements for NFT.Withdraw because migrations also need th…

…e Owner entitlement

contracts/factories/NFTCollectionFactory.cdc

@@ -5,11 +5,11 @@ access(all) contract NFTProviderAndCollectionFactory {
     access(all) struct WithdrawFactory: CapabilityFactory.Factory {
         access(all) view fun getCapability(acct: auth(Capabilities) &Account, controllerID: UInt64): Capability? {
             if let con = acct.capabilities.storage.getController(byCapabilityID: controllerID) {
-                if !con.capability.check<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Collection}>() {
+                if !con.capability.check<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Collection}>() {
                     return nil
                 }
 
-                return con.capability as! Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Collection}>
+                return con.capability as! Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Collection}>
             }
 
             return nil

contracts/factories/NFTProviderAndCollectionFactory.cdc

@@ -5,11 +5,11 @@ access(all) contract NFTProviderAndCollectionFactory {
     access(all) struct Factory: CapabilityFactory.Factory {
         access(all) view fun getCapability(acct: auth(Capabilities) &Account, controllerID: UInt64): Capability? {
             if let con = acct.capabilities.storage.getController(byCapabilityID: controllerID) {
-                if !con.capability.check<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>() {
+                if !con.capability.check<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>() {
                     return nil
                 }
 
-                return con.capability as! Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>
+                return con.capability as! Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>
             }
 
             return nil

contracts/factories/NFTProviderFactory.cdc

@@ -5,11 +5,11 @@ access(all) contract NFTProviderFactory {
     access(all) struct Factory: CapabilityFactory.Factory {
         access(all) view fun getCapability(acct: auth(Capabilities) &Account, controllerID: UInt64): Capability? {
             if let con = acct.capabilities.storage.getController(byCapabilityID: controllerID) {
-                if !con.capability.check<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>() {
+                if !con.capability.check<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>() {
                     return nil
                 }
 
-                return con.capability as! Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>
+                return con.capability as! Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>
             }
 
             return nil

scripts/delegator/find_nft_provider_cap.cdc

@@ -10,7 +10,7 @@ access(all) fun main(addr: Address): Bool {
         acct.capabilities.storage.issue<auth(CapabilityDelegator.Get) &{CapabilityDelegator.GetterPrivate}>(CapabilityDelegator.StoragePath).borrow()
         ?? panic("could not borrow delegator")
 
-    let desiredType = Type<Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>>()
+    let desiredType = Type<Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>>()
     let foundType = delegator.findFirstPrivateType(desiredType) ?? panic("no type found")
 
     let nakedCap = delegator.getPrivateCapability(foundType) ?? panic("requested capability type was not found")

scripts/delegator/get_all_private_caps.cdc

@@ -9,7 +9,7 @@ access(all) fun main(address: Address): Bool {
         ?.getAllPrivate()
         ?? panic("could not borrow delegator")
 
-    let desiredType: Type = Type<Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>>()
+    let desiredType: Type = Type<Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>>()
 
     return privateCaps.length == 1 && privateCaps[0].getType() == desiredType
 }

scripts/delegator/get_nft_provider.cdc

@@ -10,12 +10,12 @@ access(all) fun main(addr: Address): Bool {
         acct.capabilities.storage.issue<auth(CapabilityDelegator.Get) &{CapabilityDelegator.GetterPrivate}>(CapabilityDelegator.StoragePath).borrow()
         ?? panic("could not borrow delegator")
 
-    let capType = Type<Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>>()
+    let capType = Type<Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>>()
     let nakedCap = delegator.getPrivateCapability(capType) ?? panic("requested capability type was not found")
 
     // we don't need to do anything with this cap, being able to cast here is enough to know
     // that this works
-    let cap = nakedCap as! Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>
+    let cap = nakedCap as! Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>
 
     return true
 }

scripts/factory/get_nft_provider_from_factory.cdc

@@ -13,8 +13,8 @@ access(all) fun main(addr: Address) {
     let controllers = acct.capabilities.storage.getControllers(forPath: d.storagePath)
 
     for c in controllers {
-        if c.borrowType.isSubtype(of: Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()) {
-            factory.getCapability(acct: acct, controllerID: c.capabilityID)! as! Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>
+        if c.borrowType.isSubtype(of: Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()) {
+            factory.getCapability(acct: acct, controllerID: c.capabilityID)! as! Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>
             return 
         }
     }

scripts/factory/get_nft_provider_from_factory_allowed.cdc

@@ -15,22 +15,22 @@ access(all) fun main(filterFactoryAddr: Address, providerAddr: Address): Bool {
 
     let factoryManager = ruleAcct.storage.borrow<&CapabilityFactory.Manager>(from: CapabilityFactory.StoragePath)
         ?? panic("Problem borrowing CapabilityFactory Manager")
-    let factory = factoryManager.getFactory(Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>())
+    let factory = factoryManager.getFactory(Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>())
         ?? panic("No factory for NFT Provider found")
 
     let d = ExampleNFT.resolveContractView(resourceType: nil, viewType: Type<MetadataViews.NFTCollectionData>())! as! MetadataViews.NFTCollectionData
 
     var controllerID: UInt64? = nil
     for c in providerAcct.capabilities.storage.getControllers(forPath: d.storagePath) {
-        if c.borrowType.isSubtype(of: Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()) {
+        if c.borrowType.isSubtype(of: Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()) {
             controllerID = c.capabilityID
             break
         }
     }
 
     assert(controllerID != nil, message: "could not find existing provider capcon")
 
-    let provider = factory.getCapability(acct: providerAcct, controllerID: controllerID!)! as! Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>
+    let provider = factory.getCapability(acct: providerAcct, controllerID: controllerID!)! as! Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>
 
     let filter = ruleAcct.storage.borrow<&CapabilityFilter.AllowlistFilter>(from: CapabilityFilter.StoragePath)
         ?? panic("Problem borrowing CapabilityFilter AllowlistFilter")

scripts/hybrid-custody/get_child_account_nft_capabilities.cdc

@@ -9,7 +9,7 @@ access(all) fun main(addr: Address): AnyStruct {
 
   var typeIdsWithProvider: {Address: [String]} = {}
 
-  let providerType = Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()
+  let providerType = Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()
 
   // Iterate through child accounts
   for address in manager.getChildAddresses() {
@@ -26,7 +26,7 @@ access(all) fun main(addr: Address): AnyStruct {
         }
 
         if let cap = childAcct.getCapability(controllerID: c.capabilityID, type: providerType) {
-          let providerCap = cap as! Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}> 
+          let providerCap = cap as! Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}> 
 
           if !providerCap.check(){
             continue

scripts/hybrid-custody/get_nft_provider_capability.cdc

@@ -14,7 +14,7 @@ access(all) fun main(parent: Address, child: Address) {
 
     let d = ExampleNFT.resolveContractView(resourceType: nil, viewType: Type<MetadataViews.NFTCollectionData>())! as! MetadataViews.NFTCollectionData
 
-    let desiredType = Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()
+    let desiredType = Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()
     let controllerID = childAcct.getControllerIDForType(type: desiredType, forPath: d.storagePath)
         ?? panic("no capability found for desired type")
 

scripts/test/get_nft_provider_capability_optional.cdc

@@ -14,7 +14,7 @@ access(all) fun main(parent: Address, child: Address, returnsNil: Bool): Bool {
 
     let collectionData = ExampleNFT.resolveContractView(resourceType: nil, viewType: Type<MetadataViews.NFTCollectionData>())! as! MetadataViews.NFTCollectionData
 
-    let type = Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()
+    let type = Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()
     let controllerID = childAcct.getControllerIDForType(type: type, forPath: collectionData.storagePath)
         ?? panic("could not find controller for desired type")
 

scripts/test/remove_nft_provider_factory.cdc

@@ -10,7 +10,7 @@ access(all) fun main(address: Address): Bool {
 
     let expectedType = Type<NFTProviderFactory.Factory>()
 
-    if let removed = managerRef.removeFactory(Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()) {
+    if let removed = managerRef.removeFactory(Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()) {
         return removed.getType() == expectedType
     }
 

scripts/test/test_get_accessible_child_nfts.cdc

@@ -29,7 +29,7 @@ access(all) fun main(addr: Address, expectedAddressToIDs: {Address: [UInt64]}){
   var typeIdsWithProvider: {Address: [String]} = {}
   var nftViews: {Address: {UInt64: MetadataViews.Display}} = {}
 
-  let providerType = Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()
+  let providerType = Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()
   let collectionType: Type = Type<@{NonFungibleToken.CollectionPublic}>()
 
   for address in manager.getChildAddresses() {

test/CapabilityDelegator_tests.cdc

@@ -60,7 +60,7 @@ fun testShareExampleNFTCollectionPrivate() {
     Test.assert(e.isPublic == false)
     Test.assert(e.active)
 
-    let capabilityType = Type<Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>>()
+    let capabilityType = Type<Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>>()
     Test.assertEqual(capabilityType, e.capabilityType)
 }
 
@@ -101,7 +101,7 @@ fun testRemoveExampleNFTCollectionPrivate() {
     Test.assert(e.isPublic == false)
     Test.assert(e.active == false)
 
-    let capabilityType = Type<Capability<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>>()
+    let capabilityType = Type<Capability<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>>()
     Test.assertEqual(capabilityType, e.capabilityType)
 
     let scriptCode = loadCode("delegator/find_nft_provider_cap.cdc", "scripts")

test/CapabilityFactory_tests.cdc

@@ -38,9 +38,9 @@ fun testGetSupportedTypesFromManager() {
         Type<&{FungibleToken.Receiver}>(),
         Type<&{FungibleToken.Receiver, FungibleToken.Balance}>(),
         Type<auth(FungibleToken.Withdraw) &{FungibleToken.Provider, FungibleToken.Receiver, FungibleToken.Balance}>(),
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
         Type<&{NonFungibleToken.CollectionPublic}>(),
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()
     ]
     for e in expectedTypes {
         Test.assert(supportedTypes.contains(e), message: "missing expected type in supported types")
@@ -51,7 +51,7 @@ access(all)
 fun testAddFactoryFails() {
     expectScriptFailure(
         "test/add_type_for_nft_provider_factory.cdc",
-        [creator.address, Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()],
+        [creator.address, Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()],
         "Factory of given type already exists"
     )
 }
@@ -71,9 +71,9 @@ fun testAddFactorySucceeds() {
         Type<&{FungibleToken.Receiver}>(),
         Type<&{FungibleToken.Receiver, FungibleToken.Balance}>(),
         Type<auth(FungibleToken.Withdraw) &{FungibleToken.Provider, FungibleToken.Receiver, FungibleToken.Balance}>(),
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
         Type<&{NonFungibleToken.CollectionPublic}>(),
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>(),
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>(),
         Type<&{NonFungibleToken.Receiver}>()
     ]
 
@@ -121,9 +121,9 @@ fun testSetupNFTManager() {
     let supportedTypes = scriptExecutor("factory/get_supported_types_from_manager.cdc", [tmp.address])! as! [Type]
 
     let expectedTypes = [
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
         Type<&{NonFungibleToken.CollectionPublic}>(),
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()
     ]
 
     for e in expectedTypes {
@@ -180,9 +180,9 @@ fun testSetupNFTFTManager() {
         Type<&{FungibleToken.Receiver}>(),
         Type<&{FungibleToken.Receiver, FungibleToken.Balance}>(),
         Type<auth(FungibleToken.Withdraw) &{FungibleToken.Provider, FungibleToken.Receiver, FungibleToken.Balance}>(),
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(),
         Type<&{NonFungibleToken.CollectionPublic}>(),
-        Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>()
+        Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>()
     ]
 
     for e in expectedTypes {

transactions/delegator/add_private_nft_collection.cdc

@@ -11,7 +11,7 @@ transaction {
 
         let d = ExampleNFT.resolveContractView(resourceType: nil, viewType: Type<MetadataViews.NFTCollectionData>())! as! MetadataViews.NFTCollectionData
 
-        let sharedCap = acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>(d.storagePath)
+        let sharedCap = acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>(d.storagePath)
 
         delegator.addCapability(cap: sharedCap, isPublic: false)
     }

transactions/delegator/remove_private_nft_collection.cdc

@@ -11,7 +11,7 @@ transaction {
 
         let d = ExampleNFT.resolveContractView(resourceType: nil, viewType: Type<MetadataViews.NFTCollectionData>())! as! MetadataViews.NFTCollectionData
 
-        let sharedCap = acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>(d.storagePath)
+        let sharedCap = acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>(d.storagePath)
 
         delegator.removeCapability(cap: sharedCap)
 

transactions/dev-setup/setup_nft_filter_and_factory_manager.cdc

@@ -72,8 +72,8 @@ transaction(nftContractAddress: Address, nftContractName: String) {
 
         // Add NFT-related Factories to the Manager
         factoryManager.updateFactory(Type<&{NonFungibleToken.CollectionPublic}>(), NFTCollectionPublicFactory.Factory())
-        factoryManager.updateFactory(Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(), NFTProviderAndCollectionFactory.Factory())
-        factoryManager.updateFactory(Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>(), NFTProviderFactory.Factory())
+        factoryManager.updateFactory(Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(), NFTProviderAndCollectionFactory.Factory())
+        factoryManager.updateFactory(Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>(), NFTProviderFactory.Factory())
 
         /* --- AllowlistFilter configuration --- */
         //

transactions/example-nft-2/setup_full.cdc

@@ -17,6 +17,6 @@ transaction {
             at: d.publicPath
         )
 
-        acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw) &{ExampleNFT2.ExampleNFT2CollectionPublic, NonFungibleToken.CollectionPublic, NonFungibleToken.Provider}>(d.storagePath)
+        acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{ExampleNFT2.ExampleNFT2CollectionPublic, NonFungibleToken.CollectionPublic, NonFungibleToken.Provider}>(d.storagePath)
     }
 }

transactions/example-nft/setup_full.cdc

@@ -15,6 +15,6 @@ transaction {
         let cap = acct.capabilities.storage.issue<&{ExampleNFT.ExampleNFTCollectionPublic, NonFungibleToken.CollectionPublic}>(d.storagePath)
         acct.capabilities.publish(cap, at: d.publicPath)
 
-        acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw) &{ExampleNFT.ExampleNFTCollectionPublic, NonFungibleToken.CollectionPublic, NonFungibleToken.Provider}>(d.storagePath)
+        acct.capabilities.storage.issue<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{ExampleNFT.ExampleNFTCollectionPublic, NonFungibleToken.CollectionPublic, NonFungibleToken.Provider}>(d.storagePath)
     }
 }

transactions/factory/setup_nft_ft_manager.cdc

@@ -33,8 +33,8 @@ transaction {
         let manager = acct.storage.borrow<auth(CapabilityFactory.Owner) &CapabilityFactory.Manager>(from: CapabilityFactory.StoragePath) ?? panic("manager not found")
 
         manager.updateFactory(Type<&{NonFungibleToken.CollectionPublic}>(), NFTCollectionPublicFactory.Factory())
-        manager.updateFactory(Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(), NFTProviderAndCollectionFactory.Factory())
-        manager.updateFactory(Type<auth(NonFungibleToken.Withdraw) &{NonFungibleToken.Provider}>(), NFTProviderFactory.Factory())
+        manager.updateFactory(Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider, NonFungibleToken.CollectionPublic}>(), NFTProviderAndCollectionFactory.Factory())
+        manager.updateFactory(Type<auth(NonFungibleToken.Withdraw, NonFungibleToken.Owner) &{NonFungibleToken.Provider}>(), NFTProviderFactory.Factory())
         manager.updateFactory(Type<auth(FungibleToken.Withdraw) &{FungibleToken.Provider}>(), FTProviderFactory.Factory())
         manager.updateFactory(Type<&{FungibleToken.Balance}>(), FTBalanceFactory.Factory())
         manager.updateFactory(Type<&{FungibleToken.Receiver}>(), FTReceiverFactory.Factory())