[NFTs] Rework permissions model (#13482)

* Disallow admin to transfer or burn items he doesn't own

* lock_collection should be accessible by collection's owner only

* Allow admin to access lock_item_properties()

* Fix do_lock_item_properties

* Move update_mint_settings() to Issuer

* Rename check_owner to check_origin

* Typo

* Make admin to be in charge of managing the metadata

* Make admin the main attributes manager

* offchain mint should be signed by Issuer

* Remove the special case when the Issuer calls the mint() function

* Rework burn and destroy methods

* Return back item_metadatas

* Don't repatriate the deposit on transfer

* A bit more tests

* One more test

* Add migration

* Chore

* Clippy

* Rename to owned_item

* Address comments

* Replace .filter_map with .find_map

* Improve version validation in pre_upgrade()

* ".git/.scripts/commands/bench/bench.sh" pallet dev pallet_nfts

---------

Co-authored-by: parity-processbot <>

substrate/frame/nfts/src/features/roles.rs

@@ -82,6 +82,21 @@ impl<T: Config<I>, I: 'static> Pallet<T, I> {
 			.map_or(false, |roles| roles.has_role(role))
 	}
 
+	/// Finds the account by a provided role within a collection.
+	///
+	/// - `collection_id`: A collection to check the role in.
+	/// - `role`: A role to find the account for.
+	///
+	/// Returns `Some(T::AccountId)` if the record was found, `None` otherwise.
+	pub(crate) fn find_account_by_role(
+		collection_id: &T::CollectionId,
+		role: CollectionRole,
+	) -> Option<T::AccountId> {
+		CollectionRoleOf::<T, I>::iter_prefix(&collection_id).into_iter().find_map(
+			|(account, roles)| if roles.has_role(role) { Some(account.clone()) } else { None },
+		)
+	}
+
 	/// Groups provided roles by account, given one account could have multiple roles.
 	///
 	/// - `input`: A vector of (Account, Role) tuples.