[NFTs] Rework permissions model (#13482)

* Disallow admin to transfer or burn items he doesn't own

* lock_collection should be accessible by collection's owner only

* Allow admin to access lock_item_properties()

* Fix do_lock_item_properties

* Move update_mint_settings() to Issuer

* Rename check_owner to check_origin

* Typo

* Make admin to be in charge of managing the metadata

* Make admin the main attributes manager

* offchain mint should be signed by Issuer

* Remove the special case when the Issuer calls the mint() function

* Rework burn and destroy methods

* Return back item_metadatas

* Don't repatriate the deposit on transfer

* A bit more tests

* One more test

* Add migration

* Chore

* Clippy

* Rename to owned_item

* Address comments

* Replace .filter_map with .find_map

* Improve version validation in pre_upgrade()

* ".git/.scripts/commands/bench/bench.sh" pallet dev pallet_nfts

---------

Co-authored-by: parity-processbot <>

substrate/frame/nfts/src/features/lock.rs

@@ -24,10 +24,7 @@ impl<T: Config<I>, I: 'static> Pallet<T, I> {
 		collection: T::CollectionId,
 		lock_settings: CollectionSettings,
 	) -> DispatchResult {
-		ensure!(
-			Self::has_role(&collection, &origin, CollectionRole::Freezer),
-			Error::<T, I>::NoPermission
-		);
+		ensure!(Self::collection_owner(collection) == Some(origin), Error::<T, I>::NoPermission);
 		ensure!(
 			!lock_settings.is_disabled(CollectionSetting::DepositRequired),
 			Error::<T, I>::WrongSetting
@@ -85,17 +82,17 @@ impl<T: Config<I>, I: 'static> Pallet<T, I> {
 	}
 
 	pub(crate) fn do_lock_item_properties(
-		maybe_check_owner: Option<T::AccountId>,
+		maybe_check_origin: Option<T::AccountId>,
 		collection: T::CollectionId,
 		item: T::ItemId,
 		lock_metadata: bool,
 		lock_attributes: bool,
 	) -> DispatchResult {
-		let collection_details =
-			Collection::<T, I>::get(&collection).ok_or(Error::<T, I>::UnknownCollection)?;
-
-		if let Some(check_owner) = &maybe_check_owner {
-			ensure!(check_owner == &collection_details.owner, Error::<T, I>::NoPermission);
+		if let Some(check_origin) = &maybe_check_origin {
+			ensure!(
+				Self::has_role(&collection, &check_origin, CollectionRole::Admin),
+				Error::<T, I>::NoPermission
+			);
 		}
 
 		ItemConfigOf::<T, I>::try_mutate(collection, item, |maybe_config| {