From 8721eb8bc63740d636b98a6d640a747d550e14b8 Mon Sep 17 00:00:00 2001
From: Yhtyyar Sahatov <yhtiyarsahatow@gmail.com>
Date: Wed, 6 Jul 2022 16:41:29 +0300
Subject: [PATCH] `isApprovedForPool(poolId)` can mint tokens in that pool

---
 contracts/terminus/TerminusFacet.sol | 10 ++++++++--
 dao/test_terminus.py                 | 26 ++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/contracts/terminus/TerminusFacet.sol b/contracts/terminus/TerminusFacet.sol
index dc819e8..5d0a57f 100644
--- a/contracts/terminus/TerminusFacet.sol
+++ b/contracts/terminus/TerminusFacet.sol
@@ -250,7 +250,10 @@ contract TerminusFacet is ERC1155WithTerminusStorage {
         uint256 amount,
         bytes memory data
     ) external {
-        LibTerminus.enforcePoolIsController(poolID, msg.sender);
+        require(
+            isApprovedForPool(poolID, msg.sender),
+            "TerminusFacet: mint -- caller is neither owner nor approved"
+        );
         _mint(to, poolID, amount, data);
     }
 
@@ -261,7 +264,10 @@ contract TerminusFacet is ERC1155WithTerminusStorage {
         bytes memory data
     ) external {
         for (uint256 i = 0; i < poolIDs.length; i++) {
-            LibTerminus.enforcePoolIsController(poolIDs[i], _msgSender());
+            require(
+                isApprovedForPool(poolIDs[i], msg.sender),
+                "TerminusFacet: mintBatch -- caller is neither owner nor approved"
+            );
         }
         _mintBatch(to, poolIDs, amounts, data);
     }
diff --git a/dao/test_terminus.py b/dao/test_terminus.py
index 62e3e67..d177aba 100644
--- a/dao/test_terminus.py
+++ b/dao/test_terminus.py
@@ -350,6 +350,32 @@ class TestPoolOperations(TerminusTestCase):
             final_balance = self.diamond_terminus.balance_of(account.address, pool_id)
             self.assertEqual(final_balance, initial_balances[i])
 
+    def test_pool_mint_with_pool_approval(self):
+        self.diamond_terminus.create_pool_v1(10, False, False, {"from": accounts[1]})
+        pool_id = self.diamond_terminus.total_pools()
+
+        self.assertFalse(
+            self.diamond_terminus.is_approved_for_pool(pool_id, accounts[2].address)
+        )
+        with self.assertRaises(Exception):
+            self.diamond_terminus.mint(
+                accounts[2].address, pool_id, 1, b"", {"from": accounts[2]}
+            )
+
+        self.diamond_terminus.approve_for_pool(
+            pool_id, accounts[2].address, {"from": accounts[1]}
+        )
+        supply_0 = self.diamond_terminus.terminus_pool_supply(pool_id)
+        balance_0 = self.diamond_terminus.balance_of(accounts[2].address, pool_id)
+        self.diamond_terminus.mint(
+            accounts[2].address, pool_id, 1, b"", {"from": accounts[1]}
+        )
+        balance_1 = self.diamond_terminus.balance_of(accounts[2].address, pool_id)
+        supply_1 = self.diamond_terminus.terminus_pool_supply(pool_id)
+
+        self.assertEqual(balance_1, balance_0 + 1)
+        self.assertEqual(supply_0 + 1, supply_1)
+
     def test_transfer(self):
         pool_id = self.diamond_terminus.total_pools()
         self.diamond_terminus.mint(accounts[2], pool_id, 1, b"", {"from": accounts[1]})