refactor: authz audit changes (backport #16631) (#16647)

x/authz/client/cli/query.go

@@ -66,7 +66,7 @@ $ %s query %s grants cosmos1skjw.. cosmos1skjwj.. %s
 				return err
 			}
 			msgAuthorized := ""
-			if len(args) >= 3 {
+			if len(args) == 3 {
 				msgAuthorized = args[2]
 			}
 			pageReq, err := client.ReadPageRequest(cmd.Flags())

x/authz/client/cli/query_test.go

@@ -175,6 +175,79 @@ func (s *CLITestSuite) TestQueryAuthorization() {
 	}
 }
 
+func (s *CLITestSuite) TestQueryGranteeGrants() {
+	val := testutil.CreateKeyringAccounts(s.T(), s.kr, 1)
+
+	grantee := s.grantee[0]
+	twoHours := time.Now().Add(time.Minute * time.Duration(120)).Unix()
+	require := s.Require()
+
+	_, err := authzclitestutil.CreateGrant(
+		s.clientCtx,
+		[]string{
+			grantee.String(),
+			"send",
+			fmt.Sprintf("--%s=100stake", cli.FlagSpendLimit),
+			fmt.Sprintf("--%s=true", flags.FlagSkipConfirmation),
+			fmt.Sprintf("--%s=%s", flags.FlagFrom, val[0].Address),
+			fmt.Sprintf("--%s=%s", flags.FlagBroadcastMode, flags.BroadcastSync),
+			fmt.Sprintf("--%s=%d", cli.FlagExpiration, twoHours),
+			fmt.Sprintf("--%s=%s", flags.FlagFees, sdk.NewCoins(sdk.NewCoin("stake", sdkmath.NewInt(10))).String()),
+		},
+	)
+	s.Require().NoError(err)
+
+	testCases := []struct {
+		name        string
+		args        []string
+		expectErr   bool
+		expectedErr string
+	}{
+		{
+			"invalid address",
+			[]string{
+				"invalid-address",
+				fmt.Sprintf("--%s=json", flags.FlagOutput),
+			},
+			true,
+			"decoding bech32 failed",
+		},
+		{
+			"valid case",
+			[]string{
+				grantee.String(),
+				fmt.Sprintf("--%s=json", flags.FlagOutput),
+			},
+			false,
+			"",
+		},
+		{
+			"valid case with pagination",
+			[]string{
+				grantee.String(),
+				"--limit=2",
+				fmt.Sprintf("--%s=json", flags.FlagOutput),
+			},
+			false,
+			"",
+		},
+	}
+	for _, tc := range testCases {
+		s.Run(tc.name, func() {
+			cmd := cli.GetQueryGranteeGrants(addresscodec.NewBech32Codec("cosmos"))
+			out, err := clitestutil.ExecTestCLICmd(s.clientCtx, cmd, tc.args)
+			if tc.expectErr {
+				require.Error(err)
+				require.Contains(out.String(), tc.expectedErr)
+			} else {
+				require.NoError(err)
+				var grants authz.QueryGranteeGrantsResponse
+				require.NoError(s.clientCtx.Codec.UnmarshalJSON(out.Bytes(), &grants))
+			}
+		})
+	}
+}
+
 func (s *CLITestSuite) TestQueryGranterGrants() {
 	val := testutil.CreateKeyringAccounts(s.T(), s.kr, 1)
 

x/authz/client/cli/tx_test.go

@@ -15,6 +15,7 @@ import (
 	sdkmath "cosmossdk.io/math"
 
 	_ "cosmossdk.io/api/cosmos/authz/v1beta1"
+
 	"github.com/cosmos/cosmos-sdk/client"
 	"github.com/cosmos/cosmos-sdk/client/flags"
 	addresscodec "github.com/cosmos/cosmos-sdk/codec/address"
@@ -229,6 +230,19 @@ func (s *CLITestSuite) TestCLITxGrantAuthorization() {
 			true,
 			"invalid separator index",
 		},
+		{
+			"Invalid spend limit",
+			[]string{
+				grantee.String(),
+				"send",
+				fmt.Sprintf("--%s=0stake", cli.FlagSpendLimit),
+				fmt.Sprintf("--%s=%s", flags.FlagFrom, val[0].Address.String()),
+				fmt.Sprintf("--%s=true", flags.FlagGenerateOnly),
+				fmt.Sprintf("--%s=%d", cli.FlagExpiration, twoHours),
+			},
+			true,
+			"spend-limit should be greater than zero",
+		},
 		{
 			"Invalid expiration time",
 			[]string{
@@ -306,7 +320,7 @@ func (s *CLITestSuite) TestCLITxGrantAuthorization() {
 			"invalid denom",
 		},
 		{
-			"invalid bond denon for tx redelegate authorization",
+			"invalid bond denom for tx redelegate authorization",
 			[]string{
 				grantee.String(),
 				"redelegate",
@@ -337,6 +351,15 @@ func (s *CLITestSuite) TestCLITxGrantAuthorization() {
 			true,
 			"invalid decimal coin expression",
 		},
+		{
+			"invalid authorization type",
+			[]string{
+				grantee.String(),
+				"invalid authz type",
+			},
+			true,
+			"invalid authorization type",
+		},
 		{
 			"Valid tx send authorization",
 			[]string{