manage modify accesses

[SorooshMortazavi]

hi how we can ensure that only doctors has access to create a vaccine record and the passport holders can't cheat on that?

[SorooshMortazavi]

if doctor != *author.key {
            return Err(ErrorCode::UnauthorizedVaccinationInitiation.into());
        }

this line check that the doctor property in VaccinationRecord should be the signer of the transaction
its ok
but what if that the passport_holder send a fake doctor property pubkey and sign the transaction too
it wouldn't be an issue?

i think it would be better that doctor account should be send throw the transaction (not only the pubkey) and checking that
its a real doctor account after that the VaccinationRecord allowed to be create.

#[derive(Accounts)]
pub struct CreateVaccinationRecord<'info> {
    #[account(init, payer = author, space = VaccinationRecord::LEN)]
    pub vaccination_record: Account<'info, VaccinationRecord>,
    #[account(mut, has_one = authority)]
    pub doctor_account: Account<'info, Doctor>,
    #[account(mut)]
    pub author: Signer<'info>,
    #[account(address = system_program::ID)]
    pub system_program: AccountInfo<'info>,
}

i think in should be something like:
with above Account we check that the doctor_account pubkey is equal to author pubkey then we continue the instruction
and creating a Vaccination record.

[RuFerdZ]

Hi @SorooshMortazavi, thanks for the issue, and yes, it's true that a fake public key could be passed along with the creation of a new vaccination record account in the case where we cannot ensure that only doctors can create a vaccination.

Seems like your implementation is also a promising approach for the mentioned issue. Still, I guess we should also create a way to validate a doctor account within the system, i.e. a doctor account is legitimate or not.

When I was writing this Solana program, not many resources were available, and a very little community to ask for any advice and best practices, and was on a tight schedule since I did this as a part of my University projects. It would really help if I could get any valuable resources and links because now I'm continuing in this blockchain work area and improving my skills.

[SorooshMortazavi]

Hi yes its very poor resources for developers to access.
by the way i liked the project it's cool and i think with some rules and validation it could be business level project.
for example doctors account shouldn't be active till the vaccine camp confirm the doctors account. and etc...
by the way i liked the idea. it is great to create something in blockchain to solve real life issues