feat: allow module safe queries in ICA

modules/apps/27-interchain-accounts/host/keeper/keeper.go

@@ -36,7 +36,8 @@ type Keeper struct {
 
 	scopedKeeper exported.ScopedKeeper
 
-	msgRouter icatypes.MessageRouter
+	msgRouter   icatypes.MessageRouter
+	queryRouter icatypes.QueryRouter
 
 	// the address capable of executing a MsgUpdateParams message. Typically, this
 	// should be the x/gov module account.
@@ -48,7 +49,7 @@ func NewKeeper(
 	cdc codec.Codec, key storetypes.StoreKey, legacySubspace icatypes.ParamSubspace,
 	ics4Wrapper porttypes.ICS4Wrapper, channelKeeper icatypes.ChannelKeeper, portKeeper icatypes.PortKeeper,
 	accountKeeper icatypes.AccountKeeper, scopedKeeper exported.ScopedKeeper, msgRouter icatypes.MessageRouter,
-	authority string,
+	queryRouter icatypes.QueryRouter, authority string,
 ) Keeper {
 	// ensure ibc interchain accounts module account is set
 	if addr := accountKeeper.GetModuleAddress(icatypes.ModuleName); addr == nil {
@@ -69,6 +70,7 @@ func NewKeeper(
 		accountKeeper:  accountKeeper,
 		scopedKeeper:   scopedKeeper,
 		msgRouter:      msgRouter,
+		queryRouter:    queryRouter,
 		authority:      authority,
 	}
 }

modules/apps/27-interchain-accounts/host/keeper/keeper_test.go

@@ -147,6 +147,7 @@ func (suite *KeeperTestSuite) TestNewKeeper() {
 				suite.chainA.GetSimApp().AccountKeeper,
 				suite.chainA.GetSimApp().ScopedICAHostKeeper,
 				suite.chainA.GetSimApp().MsgServiceRouter(),
+				suite.chainA.GetSimApp().GRPCQueryRouter(),
 				suite.chainA.GetSimApp().ICAHostKeeper.GetAuthority(),
 			)
 		}, true},
@@ -161,6 +162,7 @@ func (suite *KeeperTestSuite) TestNewKeeper() {
 				authkeeper.AccountKeeper{}, // empty account keeper
 				suite.chainA.GetSimApp().ScopedICAHostKeeper,
 				suite.chainA.GetSimApp().MsgServiceRouter(),
+				suite.chainA.GetSimApp().GRPCQueryRouter(),
 				suite.chainA.GetSimApp().ICAHostKeeper.GetAuthority(),
 			)
 		}, false},
@@ -175,6 +177,7 @@ func (suite *KeeperTestSuite) TestNewKeeper() {
 				suite.chainA.GetSimApp().AccountKeeper,
 				suite.chainA.GetSimApp().ScopedICAHostKeeper,
 				suite.chainA.GetSimApp().MsgServiceRouter(),
+				suite.chainA.GetSimApp().GRPCQueryRouter(),
 				"", // authority
 			)
 		}, false},

modules/apps/27-interchain-accounts/host/keeper/msg_server.go

@@ -7,6 +7,8 @@ import (
 
 	sdk "github.com/cosmos/cosmos-sdk/types"
 
+	abci "github.com/cometbft/cometbft/abci/types"
+
 	"github.com/cosmos/ibc-go/v8/modules/apps/27-interchain-accounts/host/types"
 	ibcerrors "github.com/cosmos/ibc-go/v8/modules/core/errors"
 )
@@ -23,6 +25,43 @@ func NewMsgServerImpl(keeper *Keeper) types.MsgServer {
 	return &msgServer{Keeper: keeper}
 }
 
+// ModuleQuerySafe routes the queries to the keeper's query router if they are module_query_safe.
+// This handler doesn't use the signer.
+func (m msgServer) ModuleQuerySafe(goCtx context.Context, msg *types.MsgModuleQuerySafe) (*types.MsgModuleQuerySafeResponse, error) {
+	ctx := sdk.UnwrapSDKContext(goCtx)
+
+	responses := make([][]byte, len(msg.Requests))
+	for i, query := range msg.Requests {
+		isModuleQuerySafe, err := types.IsModuleQuerySafe(query.Path)
+		if err != nil {
+			return nil, err
+		}
+		if !isModuleQuerySafe {
+			return nil, errorsmod.Wrapf(ibcerrors.ErrInvalidRequest, "not module query safe: %s", query.Path)
+		}
+
+		route := m.queryRouter.Route(query.Path)
+		if route == nil {
+			return nil, errorsmod.Wrapf(ibcerrors.ErrInvalidRequest, "no route to query: %s", query.Path)
+		}
+
+		res, err := route(ctx, &abci.RequestQuery{
+			Path: query.Path,
+			Data: query.Data,
+		})
+		if err != nil {
+			return nil, err
+		}
+		if res == nil || res.Value == nil {
+			return nil, errorsmod.Wrapf(ibcerrors.ErrInvalidRequest, "no response for query: %s", query.Path)
+		}
+
+		responses[i] = res.Value
+	}
+
+	return &types.MsgModuleQuerySafeResponse{Responses: responses}, nil
+}
+
 // UpdateParams updates the host submodule's params.
 func (m msgServer) UpdateParams(goCtx context.Context, msg *types.MsgUpdateParams) (*types.MsgUpdateParamsResponse, error) {
 	if m.GetAuthority() != msg.Signer {

modules/apps/27-interchain-accounts/host/keeper/msg_server_test.go

@@ -1,10 +1,157 @@
 package keeper_test
 
 import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	banktypes "github.com/cosmos/cosmos-sdk/x/bank/types"
+	stakingtypes "github.com/cosmos/cosmos-sdk/x/staking/types"
+
 	"github.com/cosmos/ibc-go/v8/modules/apps/27-interchain-accounts/host/keeper"
 	"github.com/cosmos/ibc-go/v8/modules/apps/27-interchain-accounts/host/types"
+	transfertypes "github.com/cosmos/ibc-go/v8/modules/apps/transfer/types"
+	ibcerrors "github.com/cosmos/ibc-go/v8/modules/core/errors"
 )
 
+func (suite *KeeperTestSuite) TestModuleQuerySafe() {
+	var (
+		msg          *types.MsgModuleQuerySafe
+		expResponses [][]byte
+	)
+	testCases := []struct {
+		name     string
+		malleate func()
+		expErr   error
+	}{
+		{
+			"success",
+			func() {
+				queryBz, err := banktypes.NewQueryBalanceRequest(suite.chainA.SenderAccount.GetAddress(), sdk.DefaultBondDenom).Marshal()
+				suite.Require().NoError(err)
+
+				queryReq := types.QueryRequest{
+					Path: "/cosmos.bank.v1beta1.Query/Balance",
+					Data: queryBz,
+				}
+
+				msg = types.NewMsgModuleQuerySafe(suite.chainA.GetSimApp().ICAHostKeeper.GetAuthority(), []*types.QueryRequest{&queryReq})
+
+				balance := suite.chainA.GetSimApp().BankKeeper.GetBalance(suite.chainA.GetContext(), suite.chainA.SenderAccount.GetAddress(), sdk.DefaultBondDenom)
+
+				expResp := banktypes.QueryBalanceResponse{Balance: &balance}
+				expRespBz, err := expResp.Marshal()
+				suite.Require().NoError(err)
+
+				expResponses = [][]byte{expRespBz}
+			},
+			nil,
+		},
+		{
+			"success: multiple queries",
+			func() {
+				queryBz, err := banktypes.NewQueryBalanceRequest(suite.chainA.SenderAccount.GetAddress(), sdk.DefaultBondDenom).Marshal()
+				suite.Require().NoError(err)
+
+				queryReq := types.QueryRequest{
+					Path: "/cosmos.bank.v1beta1.Query/Balance",
+					Data: queryBz,
+				}
+
+				paramsQuery := stakingtypes.QueryParamsRequest{}
+				paramsQueryBz, err := paramsQuery.Marshal()
+				suite.Require().NoError(err)
+
+				paramsQueryReq := types.QueryRequest{
+					Path: "/cosmos.staking.v1beta1.Query/Params",
+					Data: paramsQueryBz,
+				}
+
+				msg = types.NewMsgModuleQuerySafe(suite.chainA.GetSimApp().ICAHostKeeper.GetAuthority(), []*types.QueryRequest{&queryReq, &paramsQueryReq})
+
+				balance := suite.chainA.GetSimApp().BankKeeper.GetBalance(suite.chainA.GetContext(), suite.chainA.SenderAccount.GetAddress(), sdk.DefaultBondDenom)
+
+				expResp := banktypes.QueryBalanceResponse{Balance: &balance}
+				expRespBz, err := expResp.Marshal()
+				suite.Require().NoError(err)
+
+				params, err := suite.chainA.GetSimApp().StakingKeeper.GetParams(suite.chainA.GetContext())
+				suite.Require().NoError(err)
+				expParamsResp := stakingtypes.QueryParamsResponse{Params: params}
+				expParamsRespBz, err := expParamsResp.Marshal()
+				suite.Require().NoError(err)
+
+				expResponses = [][]byte{expRespBz, expParamsRespBz}
+			},
+			nil,
+		},
+		{
+			"failure: not module query safe",
+			func() {
+				queryBz, err := banktypes.NewQueryBalanceRequest(suite.chainA.SenderAccount.GetAddress(), sdk.DefaultBondDenom).Marshal()
+				suite.Require().NoError(err)
+
+				queryReq := types.QueryRequest{
+					Path: "/cosmos.bank.v1beta1.Query/Balance",
+					Data: queryBz,
+				}
+
+				paramsQuery := transfertypes.QueryParamsRequest{}
+				paramsQueryBz, err := paramsQuery.Marshal()
+				suite.Require().NoError(err)
+
+				paramsQueryReq := types.QueryRequest{
+					Path: "/ibc.applications.transfer.v1.Query/Params",
+					Data: paramsQueryBz,
+				}
+
+				msg = types.NewMsgModuleQuerySafe(suite.chainA.GetSimApp().ICAHostKeeper.GetAuthority(), []*types.QueryRequest{&queryReq, &paramsQueryReq})
+			},
+			ibcerrors.ErrInvalidRequest,
+		},
+		{
+			"failure: invalid query path",
+			func() {
+				queryBz, err := banktypes.NewQueryBalanceRequest(suite.chainA.SenderAccount.GetAddress(), sdk.DefaultBondDenom).Marshal()
+				suite.Require().NoError(err)
+
+				queryReq := types.QueryRequest{
+					Path: "/cosmos.invalid.Query/Invalid",
+					Data: queryBz,
+				}
+
+				msg = types.NewMsgModuleQuerySafe(suite.chainA.GetSimApp().ICAHostKeeper.GetAuthority(), []*types.QueryRequest{&queryReq})
+			},
+			ibcerrors.ErrInvalidRequest,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+
+		suite.Run(tc.name, func() {
+			suite.SetupTest()
+
+			// reset
+			msg = nil
+			expResponses = nil
+
+			tc.malleate()
+
+			ctx := suite.chainA.GetContext()
+			msgServer := keeper.NewMsgServerImpl(&suite.chainA.GetSimApp().ICAHostKeeper)
+			res, err := msgServer.ModuleQuerySafe(ctx, msg)
+
+			if tc.expErr == nil {
+				suite.Require().NoError(err)
+				suite.Require().NotNil(res)
+
+				suite.Require().ElementsMatch(expResponses, res.Responses)
+			} else {
+				suite.Require().ErrorIs(err, tc.expErr)
+				suite.Require().Nil(res)
+			}
+		})
+	}
+}
+
 func (suite *KeeperTestSuite) TestUpdateParams() {
 	testCases := []struct {
 		name    string